Tag: exploit
-
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.”In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor First seen on…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable […]…
-
Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/25/week-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-flaw/
-
Pierluigi Paganini answers questions about the PHP2Shell flaws
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet,…
-
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online Built-in CODE Server is […] First…
-
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
-
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.…
-
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central management system for…
-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.The critical-severity vulnerabilities are listed below – CVE-2026-110447 (CVSS score: 9.2) – An operating First seen on thehackernews.com…
-
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
The headline-grabbing bugs known colloquially as PHP2Shell are giving cyber analysts a lot to track, and a lot to debunk. First seen on therecord.media Jump to article: therecord.media/php-php2shell-exploitation-attempts-pocs
-
Waiting for the PHP2Shell Onslaught as POCs Proliferate
No Confirmed Exploits in the Wild, But Researchers Find PHP Flaws Can Be Exploited. Cyber defenders are bracing for breakthroughs in weaponized exploits targeting the just-patched PHP2Shell vulnerabilities. No mass, in-the-wild exploits for what’s being dubbed PHP2Shell have yet been seen, but researchers have demonstrated it can be done and attackers remain keen. First seen…
-
PHP exploitation moves at slower-than-expected pace, but millions remain at risk
Security researchers flag botnet activity, but successful compromises have yet to break through. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/php-exploitation-slower-than-expected/833855/
-
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/why-caribbean-threats-cascade-global-cyber-risk
-
Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attacker gain administrative privileges and fully compromise an affected host. It has a CVSS v3.1 score of 9.8, indicating a high severity. Attackers can exploit…
-
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives…
-
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Tags: attack, cve, cvss, cyber, data-breach, exploit, hacker, rce, remote-code-execution, sophos, vulnerabilityPublic proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and carry CVSS v4.0 scores of 9.2, potentially allowing unauthenticated remote code execution with web server privileges. However, Sophos has corrected an earlier report of…
-
Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot
Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Researchers attribute the operation to APT41 with medium confidence. BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022. ESET confirmed its capabilities in March 2023, demonstrating exploitation of Baton Drop, tracked…
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.Their “Node2Shell” proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed…
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote First…
-
Schadcode-Attacken möglich: 12 Jahre alte Lücke gefährdet Gitlab-Server
Administratoren sollten dringend ihre Gitlab-Instanzen aktualisieren. Eine seit 2014 bestehende Lücke lässt Angreifer eigenen Code einschleusen. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-12-jahre-alte-luecke-gefaehrdet-gitlab-server-2610-214419.html
-
Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication. The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.1 score of 9.1 and advises distrusting impacted intermediate certificate authority certificates associated with eMudhra. The vulnerability specifically impacts…
-
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX
Tags: ai, attack, backup, breach, china, cloud, credentials, exploit, framework, group, microsoft, open-source, penetration-testing, supply-chain, toolChina-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks…
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over…
-
PHP Threat Is Likely Far From Over, Despite Limited Exploitation So Far: GuidePoint Expert
The threat of attackers potentially exploiting a pair of critical-severity PHP vulnerabilities could persist for some time, even though the initial evidence of exploitation of the PHP2Shell flaws appears to be modest, according to a threat intelligence expert at GuidePoint Security. First seen on crn.com Jump to article: www.crn.com/news/security/2026/php-threat-is-likely-far-from-over-despite-limited-exploitation-so-far-guidepoint-expert
-
Millions of Exploit Attempts Logged Against PHP Servers
Urgent PHP Patching Advised as Experts See Widespread Exploit-Building Attempts. Attacks targeting the critical PHP vulnerabilities dubbed PHP2Shell and patched Wednesday are continuing to mount as hundreds of proof-of-concept exploits appear online and technology giants log millions of attempted exploits. If they haven’t succeeded yet, experts predict they soon will. First seen on govinfosecurity.com Jump…
-
The race to fix huge PHP code flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Pretty Huge Problem with the internet The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
-
The Guardian view on AI safety: the push for global regulation must advance | Editorial
Tags: ai, attack, breach, computer, control, cyber, exploit, flaw, intelligence, openai, regulation, software, threat, vulnerabilityThe current US administration is an obstacle, but public demand for protection will ultimately prevailOrganisations around the world <a href=”https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world”>scrambled on Thursday to fix critical flaws in PHP, the software that powers much of the web. The vulnerabilities could allow attackers to take control of affected servers. Some websites were taken offline as a precaution…