Tag: vulnerability
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.”The exploit attempt originated from an IP address associated with a commercial anonymization…
-
Ransomware-Recovery – Wenn Backups die Schwachstellen wiederherstellen
First seen on security-insider.de Jump to article: www.security-insider.de/ransomware-recovery-identity-governance-backup-risiko-a-40ff7d926c375f0bbb11660fdcbea9ae/
-
PHP2Shell-Alarm: Zwei kritische Sicherheitslücken bedrohen Millionen PHP-Anwendungen
Tags: vulnerabilityPHP2Shell: Zwei kritische PHP-Schwachstellen ermöglichen Remote Code Execution. Qualys warnt vor Angriffen und empfiehlt sofortige Sicherheitsupdates. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/php2shell-alarm-zwei-kritische-sicherheitsluecken-bedrohen-millionen-php-anwendungen/a46864/
-
AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to flaws in PHP, the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/openai-vulnerability-disclosure-plan/
-
Signal Vulnerability Could Keep Microphone Active Even After Users Hang Up
A critical vulnerability in Signal’s RingRTC calling library could let a malicious call participant keep receiving audio after another user tries to hang up. This vulnerability, tracked as CVE-2026-113380, affects versions of RingRTC before 2.72.0 and carries a CVSS v4.0 score of 9.3. While video tracks could also remain active, the official vulnerability description does…
-
Node.js Patches 10 Security Vulnerabilities, Including High-Severity RCE Flaw
The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines. The updates fix a critical Brotli decoder flaw that allows remote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions. The release addresses four high-severity, three…
-
PHP Fixes Two Critical RCE Vulnerabilities Allowing Unauthenticated Code Execution
PHP released emergency security updates to address two critical vulnerabilities that could allow unauthenticated attackers to execute code on vulnerable servers. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 score of 9.2. The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should update immediately, as…
-
Critical PHP Vulnerabilities Were Under Attack Days Before Security Updates Were Released
The detected exploitation attempts targeting two critical PHP vulnerabilities on October 17, 2026, four days before their public disclosure and security updates. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and can enable unauthenticated remote code execution on vulnerable web servers. Both carry CVSS v4.0 scores of 9.2. The earliest attempt reached…
-
GitLab Patches Critical 10.0 RCE Vulnerability Allowing Unauthenticated Remote Code Execution
GitLab has released emergency security updates to address a critical remote code execution vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the patches on October 21,…
-
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet. First seen on wired.com Jump to article: www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
-
5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation
Two critical vulnerabilities in PHP are facing active exploitation attempts, creating an urgent need for widespread patching, according to cybersecurity researchers. First seen on crn.com Jump to article: www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
-
PHP releases emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. First seen on cyberscoop.com Jump to article: cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
-
The internet is having a very bad cybersecurity day
From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/
-
Hackers chain Plex flaws in Plex2Shell attacks to breach servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
-
Mögliche Zero Days – Zwei kritische PHP-Schwachstellen bedrohen Millionen Webseiten
First seen on security-insider.de Jump to article: www.security-insider.de/kritische-php-schwachstellen-behoerden-offline-a-607c4678fa935b333a4c48f8efaca22e/
-
PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why it scrambled to post information earlier than planned. First seen on therecord.media Jump to article: therecord.media/php-foundation-statement-critical-vulnerabilities
-
Critical PHP Patches Address ‘Very, Very Bad Vulnerability’
Immediate Updating Advised as Experts Warn Large-Scale Attacks Likely Imminent. Security experts are warning all organizations to immediately apply new fixes for two critical PHP2Shell vulnerabilities in widely used PHP that can be remotely exploited by unauthenticated attackers to run arbitrary code, take full control of the underlying server and steal data. First seen on…
-
Critical PHP vulnerabilities expose most websites to potential compromise
Government agencies urged organizations to take their sites offline until they could be fixed. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/php-website-vulnerabilities/833580/
-
Sicherheitslücke erfordert sofortige Absicherung kritischer PHP-Systeme
Die Absicherung kritischer PHP-Systeme erfordert mehr als das Einspielen eines Patches: Unternehmen müssen sämtliche PHP-Instanzen identifizieren, verwundbare Systeme priorisieren und nicht patchbare Server vorübergehend vom Internet trennen. Don Smith, VP Threat Intelligence, Sophos Counter Threat Unit, warnt, dass Angreifer die Schwachstelle kurzfristig gezielt ausnutzen könnten auch mithilfe von KI. ‘Die unmittelbare Herausforderung besteht nicht […]…
-
PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities
PHP releases emergency PHP2Shell fixes for two critical flaws allowing unauthenticated code execution. Website owners and hosting providers… First seen on hackread.com Jump to article: hackread.com/php-releases-emergency-fixe-php2shell-vulnerabilities/
-
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences. First seen on wired.com Jump to article: www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/
-
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
-
Critical PHP vulnerabilities expose vast majority of websites to potential compromise
The serious flaws in popular website software prompted government agencies to urge organizations to take their sites offline until they could be fixed. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/php-website-vulnerabilities/833580/
-
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
Tags: vulnerabilityThe maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe. First seen on therecord.media Jump to article: therecord.media/php-script-vulnerabilities-warnings
-
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. First seen on cyberscoop.com Jump to article: cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
-
PHP2Shell: Critical PHP vulnerabilities patched, update now!
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
-
Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP
Tags: authentication, control, data-breach, exploit, flaw, Internet, update, vulnerability, zero-dayInternet-Facing Systems Now Under Attack; PHP Team Promises Imminent Patch Release. Attackers are exploiting one or more zero-day vulnerabilities in PHP after details of the bugs leaked in advance of patches being released. The flaws can be remotely exploited without authentication to take control of servers that run PHP, which is widely used across numerous…