Tag: update
-
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
-
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives…
-
SBI Notifies Customers Affected by Recent Cybersecurity Incident
The State Bank of India (SBI) has individually notified customers whose data was involved in a recent cybersecurity incident. In an update focused on customer safety, the bank confirmed it contacted affected individuals via email and/or WhatsApp. They reassured customers that their account balances and funds are safe. This announcement follows an earlier communication about…
-
Qualys Update und erste Untersuchungen zu PHP2Shell in Zahlen
Tags: updateDie große Mehrheit von 110 Millionen Installationen (71 %) nutzt dagegen Versionen von PHP 5.4 bis 8.1, deren Support bereits ausgelaufen ist. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/qualys-update-und-erste-untersuchungen-zu-php2shell-in-zahlen/a46898/
-
Wenn die Laufzeitumgebung zum Risiko wird: Die Management-Lektion aus PHP2Shell
Zwei kritische Schwachstellen in PHP rücken eine oft übersehene Abhängigkeit ins Zentrum: die Laufzeitumgebung unterhalb von Websites, Shops und Verwaltungsoberflächen. Die Sicherheitsupdates sind verfügbar doch ein aktualisiertes CMS ist noch kein Nachweis für eine abgesicherte PHP-Installation. Für Geschäftsführung und IT-Verantwortliche geht es deshalb um mehr als einen weiteren Patch: um vollständige Bestandsaufnahmen, belegte Aktualisierungen,… First…
-
Signal Vulnerability Could Keep Calls Alive After Users Hang Up
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ‘s calling library could allow a malicious caller to interfere with call termination, potentially leaving the victim’s microphone and camera active after…
-
Millions of Exploit Attempts Logged Against PHP Servers
Urgent PHP Patching Advised as Experts See Widespread Exploit-Building Attempts. Attacks targeting the critical PHP vulnerabilities dubbed PHP2Shell and patched Wednesday are continuing to mount as hundreds of proof-of-concept exploits appear online and technology giants log millions of attempted exploits. If they haven’t succeeded yet, experts predict they soon will. First seen on govinfosecurity.com Jump…
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
-
How PHP’s Coordinated Disclosure Process Went Belly Up
Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024. The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn’t. A demonstration video of a binary update spilled early. Cybersecurity experts have since discovered exploit attempts that predate even those leaks. First seen on govinfosecurity.com Jump…
-
Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React
Two critical PHP vulnerabilities, the widely used programming language underpinning millions of websites and web applications, have prompted urgent warnings from cybersecurity authorities worldwide. Following reports on the 20th October that details of the vulnerabilities had leaked ahead of their scheduled disclosure, PHP developers released emergency security updates on 21 October. The UK’s National Cyber…
-
Johannes Schätzl: SPD-Digitalpolitiker kritisiert nach PHP-Lücke das BSI
Der Informatiker fordert eine grundlegende Neuaufstellung der deutschen Cyberabwehr. Da Angreifer Schwachstellen mithilfe von KI direkt und in Rekordzeit ausnutzen, reiche das Hinterherlaufen mit Updates nicht mehr aus. First seen on golem.de Jump to article: www.golem.de/news/johannes-schaetzl-spd-digitalpolitiker-kritisiert-nach-php-luecke-das-bsi-2610-214409.html
-
PHP2Shell Qualys rät zu sofortigen PHP-Updates
Das BSI hat zu PHP2Shell eine Cybersicherheitswarnung der Warnstufe ‘3 / Orange” herausgegeben und stuft das Risiko damit als außerordentlich hoch ein. Einige Organisationen haben vorsorglich Dienste vom Netz genommen. Die Lücken stecken in der PHP-Engine selbst. Damit sind auch Systeme gefährdet, deren eigener Code fehlerfrei ist: Content-Management-Systeme wie WordPress, Drupal oder Joomla, im deutschsprachigen…
-
Websites across world hit by millions of attempts to exploit PHP code flaw
Tags: computer, control, cybersecurity, data, exploit, flaw, government, Internet, programming, update, vulnerabilityProblem in language that underpins 70% of sites has led governments and companies to pull sites offline to patch faultWebsites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US National Security Agency warned the flaw could allow attackers…
-
Critical Cisco Expressway Flaw Lets Attackers Execute Commands as Root
Cisco has released security updates to address a critical vulnerability in its Expressway Series. This flaw, tracked as CVE-2026-76466, could allow unauthenticated remote attackers to execute arbitrary operating system commands with root privileges. It has a CVSS v3.1 base score of 9.8 and affects vulnerable Expressway deployments configured in a cluster. The advisory was published…
-
Fortinet Releases Critical Security Updates for FortiOS, FortiManager, and FortiAnalyzer
Fortinet has announced coordinated security hardening updates for FortiOS, FortiManager, and FortiAnalyzer, scheduled for October 22, 2026. These updates aim to address critical and high-severity vulnerabilities. The company urges customers to prioritize updating internet-facing systems and treat these upgrades as urgent, not routine maintenance. In an announcement on October 21, Fortinet’s Chief Information Security Officer,…
-
European Cybersecurity Challenge – Schweden gewinnt die ECSC 2026
First seen on security-insider.de Jump to article: www.security-insider.de/ecsc-2026-bochum-european-cybersecurity-challenge-a-6cb65ba7f8812b8f55e97e3a45beff56/
-
Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions
Hirudo, an Android banking remote-access trojan (RAT) that can steal credentials and remotely control an infected phone. Its most unusual feature is the ability to replace selected genuine banking apps with modified copies designed to interfere with security checks from inside the app itself. Hirudo uses a two-app setup. Victims first install a convincing shopping…
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected…
-
PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline
Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/
-
Node.js Patches 10 Security Vulnerabilities, Including High-Severity RCE Flaw
The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines. The updates fix a critical Brotli decoder flaw that allows remote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions. The release addresses four high-severity, three…
-
PHP Fixes Two Critical RCE Vulnerabilities Allowing Unauthenticated Code Execution
PHP released emergency security updates to address two critical vulnerabilities that could allow unauthenticated attackers to execute code on vulnerable servers. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 score of 9.2. The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should update immediately, as…
-
Critical PHP Vulnerabilities Were Under Attack Days Before Security Updates Were Released
The detected exploitation attempts targeting two critical PHP vulnerabilities on October 17, 2026, four days before their public disclosure and security updates. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and can enable unauthenticated remote code execution on vulnerable web servers. Both carry CVSS v4.0 scores of 9.2. The earliest attempt reached…
-
GitLab Patches Critical 10.0 RCE Vulnerability Allowing Unauthenticated Remote Code Execution
GitLab has released emergency security updates to address a critical remote code execution vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the patches on October 21,…
-
5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation
Two critical vulnerabilities in PHP are facing active exploitation attempts, creating an urgent need for widespread patching, according to cybersecurity researchers. First seen on crn.com Jump to article: www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation
-
Weak Certificates From Indian CA Cause Cascade of Updates
eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs. An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only one byte in length, making it trivial for hackers to recover the key and issue their own fraudulent certs. The issue has the…
-
PHP releases emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. First seen on cyberscoop.com Jump to article: cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
-
What to do as critical PHP flaws puts millions of websites at risk
Patch or go offline, say UK, US and EU agencies as two AI-discovered flaws in PHP, the language behind most websites, allow unauthenticated remote code execution First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652446/Critical-PHP-flaws-puts-millions-of-websites-at-risk-of-takeover
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2…
-
Democrat lawmakers say Russia is aiming to undermine party ahead of midterms
The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes. First seen on therecord.media Jump to article: therecord.media/democrat-lawmakers-say-russia-is-aiming-to-undermine-party
-
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.The flaws, together called PHP2Shell, sit in the PHP…