Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory…
Tag: Vulnerability
Signal Vulnerability Could Keep Calls Alive After Users Hang Up
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical…
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the…
CVE-2026-115845 – Incomplete validation in the run_script Python sandbox in AWS MCP Server
Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is…
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-114625…
CVE-2026-87911
Read this article
PHP2Shell: What the Vulnerability Means and Why Patching Is Urgent
Two critical security vulnerabilities in the core of PHP affect a large proportion of websites – from personal WordPress blogs and online stores to…
Critical Node.js Brotli Decoder Bug (CVE-2026-111497) Allow RCE
HOC Shorts | Node.js released security updates across all supported active release lines (22.x, 24.x, and 26.x) addressing…
CVE-2026-84942 – Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Read this article
CVE-2026-85788 – Issue with awslabs mysql-mcp-server
Read this article
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
CVE-2026-85787 – An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
Read this article
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Read this article
CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web…
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected…
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on…
How CVE-2026-73570 turns a Zimbra log file into remote code execution
We reproduced the Zimbra command injection vulnerability and found that several public PoCs write a payload Swatchdog never matches, so a failed test…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…