Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory…
Tag: Vulnerability
Patch Now: php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Initially published Oct 21st at 6 AM PT- last updated 8:40AM PT Patch Now: Ensure you are up to date with the latest version and use this link to patch…
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the…
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1…
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges…
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting…
The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don’t always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody…
Signal RingRTC CVE-2026-113380 Call Hang-Up Flaw
A high-severity vulnerability in Signal’s calling infrastructure could allow malicious participants to continue listening after other users believe they…
php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
What happened? On October 20, a post on Hacker News claimed that two critical remote code execution (RCE) vulnerabilities in PHP – tracked by researchers…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected…
PHP2Shell Vulnerability Gets a Public PoC Exploit for Security Testing
A public proof-of-concept repository shares verification tools and a lab setup to test two critical PHP vulnerabilities known as php2shell. The flaws,…
Microsoft Offers $40,000 for Complete Azure Vulnerability Reports, Just $4,000 for Incomplete Ones
Microsoft has introduced a new report-assessment system across its bug bounty programs, making the evidence security researchers submit a key factor in…
ConnectWise backup app breaches 173 Microsoft tenants, Chinese spies exploit BeyondTrust zero-day, Japan declares first cyber state of emergency
Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency…
Risky Bulletin: Linux patches PwnEscape KVM vulnerability
A serious vulnerability lets attackers escape Kernel-based virtual machines, OpenCode users become collateral damage in a distillation attack, supply…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…
Critical Fortinet FortiSIEM RCE Vulnerability Gets Public PoC Exploit, Allowing Unauthenticated Attacks
Horizon3.ai has released a public proof-of-concept exploit for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM. This vulnerability allows…
DevGuard: Open-source vulnerability management for the software supply chain
DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk,…
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.