IT Security News: Afternoon roundup, 2026-10-22 Summary This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to…
GitLab critical patches include one for a bug that allows code execution by unauthenticated users
GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues,…
Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
What ARTEX Reveals About Overlooked Attack Surfaces
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: What ARTEX Reveals About Overlooked Attack Surfaces
Understanding PHP2Shell: Everything You Need to Know
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Understanding PHP2Shell: Everything You Need to Know
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN…
Les supermarchés de l’UE paient d’un firmware de réfrigérateur non mis à jour
Des centaines de magasins ont subi des pertes se chiffrant en millions d’euros parce qu’ils avaient fait appel à des tiers pour gérer le micrologiciel OT…
Browsers Revoke Trust in Eight eMudhra Certificates After Private Key Compromise
Major browser vendors and certificate trust stores have blacklisted eight intermediate certificates issued by Indian certificate authority eMudhra…
WorkNest Secure Gains The Cyber Scheme Accreditation
UK cybersecurity specialist WorkNest Secure has achieved Accredited Organisation status under The Cyber Scheme, providing further independent recognition…
Facebook’s misleading privacy claims land Meta a $25 billion penalty
Users were misled about who could access their personal information on Facebook. Now Meta has been ordered to pay $25 billion.
Max-severity GitLab bug allows remote code execution over 12 years of releases
Vendor ‘strongly recommends’ upgrading to a fixed version ‘as soon as possible’
PHP2Shell – Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619)
Two major CVEs have been discovered in PHP core, both rated critical, leading to server crashes and potential remote code execution on affected web…
PHP2Shell Update: One in ten organizations impacted as Europe bears the brunt
Two critical vulnerabilities in PHP, the programming language behind a large share of the world’s websites, online stores and internet services, are being…
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to…
LiteLLM Compromised- Credential Steals Through Supply Chain Attack
HOC Shorts | The Incident: The widely used AI developer tool LiteLLM compromised in a software supply chain…
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and…
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise’s breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
I had plans for that second
The Earth is speeding up, the leap second is being abolished, oh, and there’s critical vulnerabilities in PHP.
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors don’t need to rely on malware to breach organizations anymore. They’re simply calling help desks and politely asking for access, with a…
The Department of Know: PHP2Shell strikes, EU EOL still SOL, Cairn used in cyberattacks
Read the full stories at CISOSeries.com . This week’s Department of Know is hosted by Rich Stroffolino, with guests Gary Chan , CISO, SSM Health, and Doug…
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem…
FBI Flags SafePay Ransomware as One of 2026’s Most Active Threats After 600 Victims
The FBI, alongside cybersecurity authorities in Germany and the United Kingdom, issued a joint advisory this week warning that a ransomware group called…
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security…
Your AI agent fixed the bug, but what else did it change?
Today we’re publishing patching-bugs and regression-hunt , two plugins that let engineers delegate patch development and regression checks to agents. Our…