Learn how the PHP2Shell vulnerability affects web applications and how FortiGuard Labs virtual patching reduces exposure while organizations deploy…
Tag: Patch & Updates
Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days
Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat…
EU Cyber Resilience Act (CRA) – Overview (Updated Oct 2026)
What is the Cyber Resilience Act – CRA The Cyber Resilience Act is the first European regulation to set a mandatory minimum level of cyber security for…
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The…
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t
You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not…
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations…
GitLab Patches Second 10.0 RCE Flaw in October, Forcing Another Security Update
GitLab’s latest critical RCE patch fixes CVE-2026-110264, leaving servers updated on October 12 exposed. Check affected versions and security guidance.
Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched Systems
A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The…
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
PHP emergency patches, compromised TLS certificates, Signal hot mic bug
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/…
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight…
Sites Go Dark As Admins Rush To Patch PHP Flaw
Governments, other organisations take websites offline after researchers publish fix for critical PHP flaw affecting 70 percent of internet
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV)…
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The…
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions…
URGENT – PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The…
Torvalds: AI is fine for competent devs, but spare us the ‘drive-by’ patches
Kernel maintainers stop asking who used AI, as long as the code is good
Critical PHP RCE Vulnerabilities: Update to PHP 8.5.12, 8.4.27 Immediately
HOC Shorts | The Emergency Release: The PHP development team issued an emergency security update covering PHP 8.5.12,…
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.