Tag: vulnerability
-
Critical Unpatched Linux Kernel Vulnerabilities Accidentally Disclosed, Including Two Remote Code Execution Flaws
In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely available. These disclosures included two critical flaws in KSMBD that could let remote attackers execute code, along with reports of privilege escalation and information disclosure. Trend Micro’s Zero Day Initiative (ZDI) submitted the reports, prompting Linux…
-
Botched PHP2Shell disclosure revealed as panic continues
As security teams worldwide grapple with the deep impact of the PHP2Shell flaws, the PHP Foundation has revealed how a carefully planned vulnerability disclosure process went horribly wrong. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652674/Botched-PHP2Shell-disclosure-revealed-as-panic-continues
-
Independent Auditors Find Gaps in OpenAI Agent Monitoring
Metr and Redwood Uncover Codex Safeguard Bypasses, OpenAI Says Flaws Now Patched. Third-party artificial intelligence safety evaluators found several vulnerabilities in OpenAI’s monitoring system for its coding agents, showing how easy it is to bypass the monitoring. Metr and Redwood Research stress-tested OpenAI’s internal misalignment monitoring system from July 21 to Aug. 11. First seen…
-
The race to fix huge PHP code flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
PHP Threat Is Likely Far From Over, Despite Limited Exploitation So Far: GuidePoint Expert
The threat of attackers potentially exploiting a pair of critical-severity PHP vulnerabilities could persist for some time, even though the initial evidence of exploitation of the PHP2Shell flaws appears to be modest, according to a threat intelligence expert at GuidePoint Security. First seen on crn.com Jump to article: www.crn.com/news/security/2026/php-threat-is-likely-far-from-over-despite-limited-exploitation-so-far-guidepoint-expert
-
I had plans for that second
Tags: vulnerabilityThe Earth is speeding up, the leap second is being abolished, oh, and there’s critical vulnerabilities in PHP. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/i-had-plans-for-that-second/
-
Signal Vulnerability Could Keep Calls Alive After Users Hang Up
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ‘s calling library could allow a malicious caller to interfere with call termination, potentially leaving the victim’s microphone and camera active after…
-
Millions of Exploit Attempts Logged Against PHP Servers
Urgent PHP Patching Advised as Experts See Widespread Exploit-Building Attempts. Attacks targeting the critical PHP vulnerabilities dubbed PHP2Shell and patched Wednesday are continuing to mount as hundreds of proof-of-concept exploits appear online and technology giants log millions of attempted exploits. If they haven’t succeeded yet, experts predict they soon will. First seen on govinfosecurity.com Jump…
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
-
The Guardian view on AI safety: the push for global regulation must advance | Editorial
Tags: ai, attack, breach, computer, control, cyber, exploit, flaw, intelligence, openai, regulation, software, threat, vulnerabilityThe current US administration is an obstacle, but public demand for protection will ultimately prevailOrganisations around the world <a href=”https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world”>scrambled on Thursday to fix critical flaws in PHP, the software that powers much of the web. The vulnerabilities could allow attackers to take control of affected servers. Some websites were taken offline as a precaution…
-
The race to fix huge PHP flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Pretty Huge Problem with the internet The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
How PHP’s Coordinated Disclosure Process Went Belly Up
Open-Source PHP Team Also Admits to Decision Paralysis After 1 Flaw Found in 2024. The PHP Foundation said its coordinated vulnerability disclosure process for PHP2Shell worked, until it didn’t. A demonstration video of a binary update spilled early. Cybersecurity experts have since discovered exploit attempts that predate even those leaks. First seen on govinfosecurity.com Jump…
-
Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React
Two critical PHP vulnerabilities, the widely used programming language underpinning millions of websites and web applications, have prompted urgent warnings from cybersecurity authorities worldwide. Following reports on the 20th October that details of the vulnerabilities had leaked ahead of their scheduled disclosure, PHP developers released emergency security updates on 21 October. The UK’s National Cyber…
-
Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year
Contern, Luxembourg, October 22nd, 2026, CyberNewswire Gcore is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026. The offer follows the php2shell vulnerabilities that forced public websites offline across Europe earlier this week. Gcore WAAP blocks the php2shell attack path (CVE-2026-109618 and CVE-2026-109619) by default…
-
What is PHP and how serious is the computer language flaw causing website shutdowns?
Tags: attack, computer, cyber, data, exploit, flaw, government, hacker, open-source, programming, vulnerabilityAn estimated 70% of websites use the open-source language. What is the identified vulnerability in it?Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem.The <a href=”https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world”>newly discovered vulnerabilities in PHP, a programming language that…
-
Pretty Huge Problem with the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Kritische Schwachstelle in PHP bedroht zahlreiche Websites
Das BSI warnt vor kritischen Schwachstellen in PHP. Weiteren Berichten zufolge sind zahlreiche Websites gefährdet. Ismael Valenzuela, VP of Threat Intelligence Research, und Justin Moore, Director of Adversary Research bei Arctic Wolf, erläutern ihre Einschätzung zum Risikofaktor der PHP-Schwachstellen und sprechen Empfehlungen für Unternehmen aus, was diese tun können, um sich zu schützen. Justin Moore,…
-
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence. >>Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot…
-
Johannes Schätzl: SPD-Digitalpolitiker kritisiert nach PHP-Lücke das BSI
Der Informatiker fordert eine grundlegende Neuaufstellung der deutschen Cyberabwehr. Da Angreifer Schwachstellen mithilfe von KI direkt und in Rekordzeit ausnutzen, reiche das Hinterherlaufen mit Updates nicht mehr aus. First seen on golem.de Jump to article: www.golem.de/news/johannes-schaetzl-spd-digitalpolitiker-kritisiert-nach-php-luecke-das-bsi-2610-214409.html
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/
-
Ausnutzung kritischer PHP-Schwachstellen durch KI-gestützte Angriffe
Das Zscaler-ThreatLabz-Team warnt vor der aktiven Ausnutzung von zwei kritischen PHP-Schwachstellen (CVE-2026-109618 und CVE-2026-109619), die unauthentifizierte Remote-Code-Execution (RCE) ermöglichen. Da PHP das Rückgrat unzähliger internetseitiger Web-Infrastrukturen bildet, besteht eine große Angriffsfläche für Unternehmen weltweit. Hinzu kommt, dass Bedrohungsakteure zunehmend lünstliche Intelligenz einsetzen, um Schwachstellen schneller zu finden und automatisierte Angriffe zu koordinieren. Agentic-AI als […]…
-
Websites across world hit by millions of attempts to exploit PHP code flaw
Tags: computer, control, cybersecurity, data, exploit, flaw, government, Internet, programming, update, vulnerabilityProblem in language that underpins 70% of sites has led governments and companies to pull sites offline to patch faultWebsites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US National Security Agency warned the flaw could allow attackers…
-
Critical Cisco Expressway Flaw Lets Attackers Execute Commands as Root
Cisco has released security updates to address a critical vulnerability in its Expressway Series. This flaw, tracked as CVE-2026-76466, could allow unauthenticated remote attackers to execute arbitrary operating system commands with root privileges. It has a CVSS v3.1 base score of 9.8 and affects vulnerable Expressway deployments configured in a cluster. The advisory was published…
-
Claude Security can now spot vulnerabilities that reappear in code
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/claude-security-continuous-scanning-update/
-
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/
-
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials… First seen on hackread.com Jump to article: hackread.com/qilin-inc-exploit-palo-alto-vpn-flaw-ransomware-attacks/
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/
-
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/
-
Hackers Exploit Siemens Software Center Vulnerability to Execute Malicious Code
Siemens has confirmed that the CVE-2026-110936 vulnerability, a DLL side-loading flaw in Siemens Software Center, is being actively exploited. Attackers are using this vulnerability to execute malicious code through a legitimate, digitally signed application. Siemens published advisory SSA-580366 on October 15 and has addressed the issue in version 4.0.9.8. According to the campaign report, attackers…