-
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly …
-
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core …
-
A critical flaw affecting 70% of all websites has the cybersecurity world panicked
Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. …
-
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Oh, yes. Well done to …
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
PHP developers have accused software supply chain security shop Chainguard of effectively revealing critical bugs in the open-source …
-
Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth
The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated …
-
Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now …
-
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before …
-
Interoperability vs. Security: Why not both?
An open internet where people can freely build, share, and remix each other’s work is a powerful engine of grassroots innovation we’ve …
-
Critical PHP vulnerabilities send organizations scrambling to secure their systems
The underlying technical issue behind PHP2Shell has been present in PHP for decades. However, researchers believed that it can’t be …
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects …
-
CISO Burnout Isn’t a Personal Problem — It’s Organizational
Security magazine tackles the issue of CISO burnout alongside Chris Bevil, global cyber resilience and AI leader at …
●●●
NVD
- CVE-2026-113707 – A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected …
- CVE-2026-109681 – The FTP client trusts the server’s PASV response IP:port without validation against the …
- CVE-2026-109682 – Metasploit Framework versions before 6.5.7 allow HTTP requests made through …
- CVE-2026-113706 – A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown …
- CVE-2026-96778 – Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in …
EXPLOITS
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as Root
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload
- The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through com