-
Critical PHP vulnerabilities send organizations scrambling to secure their systems
The underlying technical issue behind PHP2Shell has been present in PHP for decades. However, researchers believed that it can’t be …
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects …
-
CISO Burnout Isn’t a Personal Problem — It’s Organizational
Security magazine tackles the issue of CISO burnout alongside Chris Bevil, global cyber resilience and AI leader at …
-
Can’t delete your WhatsApp account? Its chatbot was told to leave out privacy regulators
WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, …
-
Flaw in PHP computer language leads to shutdown of websites around world
Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world …
-
LiteLLM supply chain attack hoovers up passwords and secrets
Unknown crims compromised LiteLLM’s release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to …
-
ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as Root
ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as …
-
Parasoft Continuous Testing Platform 10.7.5 – JSP command execution
Parasoft Continuous Testing Platform 10.7.5 – JSP command …
-
Exasol Database 7.1.30 – command execution
Exasol Database 7.1.30 – command …
-
Edimax BR-6478AC firmware v2.20 – authenticated command injection
Edimax BR-6478AC firmware v2.20 – authenticated command …
-
Automotive Shop Management System 1.0 – SQLi
Automotive Shop Management System 1.0 – …
-
Open eClass 3.15 – RCE
Open eClass 3.15 – …
●●●
NVD
- CVE-2026-113707 – A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected …
- CVE-2026-109681 – The FTP client trusts the server’s PASV response IP:port without validation against the …
- CVE-2026-109682 – Metasploit Framework versions before 6.5.7 allow HTTP requests made through …
- CVE-2026-113706 – A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown …
- CVE-2026-114490 – Incorrect authorization in the COM administration API of Progressive Robot hMailServer …
EXPLOITS
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as Root
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload
- The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through com