The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations…
Tag: Vulnerability
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities
Attackers Exploit Third Arista VCO Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
Critical Pillow CVE-2026-112900 RCE Flaw
A critical security vulnerability in Pillow, the dominant image processing library for Python, allows attackers to execute arbitrary commands on servers…
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP…
Critical Okta Access Gateway Vulnerability Enables Remote Command Execution
A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could allow an authenticated administrator to execute…
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
PHP2Shell: Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Initially published Oct 21st at 6 AM PT- last updated 8:40AM PT Patch Now: Ensure you are up to date with the latest version IPS protection-…
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability…
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical…
Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital…
Critical Fortinet FortiSIEM Flaw (CVE-2026-106173) Public Exploit Released
HOC Shorts | Security agencies issued urgent advisories for a CVSS 9.8 critical vulnerability (`CVE-2026-106173`) impacting Fortinet FortiSIEM,…
CVE-2026-115417 – Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT Description: aws-c-mqtt is a…
CVE-2026-115416 – Incorrect authorization checks in Amazon Athena engine version 3 query processing
Bulletin ID: 2026-144-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 09:30 AM PDT Description: Amazon Athena is…
CVE-2026-112408 – Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Bulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT Description: The Amazon…
CVE-2026-115419 – Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT Description: Strands Agents is…
Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks
Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root.…
CVE-2026-115414 – OS Command Injection Issue in SAM CLI Terraform Hook
Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT Description: AWS SAM CLI is an…
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
October 22, 2026: We updated this post to add the AWS WAF PHP application managed rule group. Version 2.3 of the rule group adds the PHP2Shell_BODY rule…