Tag: vulnerability
-
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws…
-
HashiCorp Consul Vulnerability Allows Attackers to Bypass Authorization and Gain Elevated Privileges
HashiCorp disclosed a vulnerability in consul-k8s, a cross-namespace authorization bypass that could let attackers with limited Kubernetes permissions gain elevated Consul privileges. This vulnerability is tracked as CVE-2026-110720 and affects component access control list (ACL) binding rules when automated system ACL management is enabled. HashiCorp published advisory HCSEC-2026-50 on October 26, 2026, and released fixes…
-
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/
-
Microsoft Authenticator vulnerability let rogue Android apps steal work account access
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/
-
Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones
Tags: attack, cyber, cybercrime, exploit, group, hacker, infrastructure, iphone, malicious, spyware, vulnerabilityCybercriminal groups are using malicious Instagram advertisements, abandoned analytics tags, and compromised websites to deliver Coruna and DarkSword exploit kits to vulnerable iPhones. The investigation exposes a scalable spyware distribution model in which attackers exploit advertising infrastructure to reach victims during ordinary browsing. Researchers describe these as “half-click” attacks: users must encounter an infected webpage…
-
EUVD-2026-92807 / CVE-2026-21589 – Kritische Atlassian-Schwachstelle mit unklarer Kennung
First seen on security-insider.de Jump to article: www.security-insider.de/atlassian-kritische-schwachstelle-datei-zugriff-ohne-login-a-a941faa4105ef969fc69117785defed8/
-
71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/27/rapid7-vulnerability-exploitation-trends-q3-2026-report/
-
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Tags: cisa, cve, cvss, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments – CVE-2026-109618 – An out-of-memory First seen on…
-
Maritime Sector to Catalog Nautical Software Vulnerabilities
Blue Initiative Will List Vulnerabilities Affecting Maritime IT or OT Systems. A new public access database launched Monday will catalogue IT and industrial control systems software vulnerabilities that affect maritime systems. The vision is to have a public and open single source of truth for maritime-related vulnerabilities. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/maritime-sector-to-catalog-nautical-software-vulnerabilities-a-33216
-
Critical ‘HTTP2Shell’ Brotli vulnerability triggers emergency patches
A critical flaw dubbed ‘HTTP2Shell’ in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
-
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/
-
10 Software Security Practices Built for the Next 250 Years
This Cybersecurity Awareness Month’s theme, Securing the Next 250, asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/10-software-security-practices-built-250-years
-
New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials
A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets. The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. Rather than exploiting an identified vulnerability in these products, the malware…
-
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project’s maintainers say.An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64…
-
Kostenloser Service von Qualys, um PHP2Shell-Sicherheitslücken schnell zu finden und zu beheben
Qualys gab bekannt, dass es seine Lösungen kostenlos als Service für die Community zur Verfügung stellt, um Unternehmen dabei zu helfen, ihre Anfälligkeit für PHP2Shell zwei kritische Schwachstellen in PHP, die unter den Kennungen CVE-2026-109618 und CVE-2026-109619 erfasst sind zu erkennen, zu validieren und zu mindern. Der Service ist ab dem Zeitpunkt der […] First…
-
KeePassXC 2.8.0 Released to Fix Multiple Security Vulnerabilities Affecting Password Manager
KeePassXC has released version 2.8.0 to address multiple security vulnerabilities related to database imports, browser integration, SSH key handling, and the protection of sensitive information. Published on October 21, this update includes eight security fixes, platform improvements, and a migration to Qt 6. Notably, one vulnerability is identified as CVE-2026-69150, and four additional issues are…
-
Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
Microsoft’s updates address two newly disclosed vulnerabilities in the .NET developer platform, as well as flaws not fully addressed in an earlier release First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-patch-update-net-flaw/
-
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates…
-
OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes
OpenBSD 8.0 was released on October 20, 2026, marking the project’s 61st release. This update includes significant improvements, including enhanced firewall security, memory-safety fixes, stronger validation for network daemons, and security updates to core components. Key updates include enhancements to PF, OpenBSD’s packet filtering firewall, as well as fixes for vulnerabilities related to virtualization, cryptographic…
-
Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database
Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/blue-initiative-maritime/
-
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/
-
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/php-publishes-mitigation-advice/
-
Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-2026-111497
Cloudflare announced an emergency release of its Web Application Firewall (WAF) on October 25, 2026. This update introduces two detection rules for the Brotli vulnerability tracked as CVE-2026-111497. These rules specifically target requests that declare Brotli body encoding and traffic accessing the Next.js image optimization endpoint. By default, both rules are enabled in Log mode,…
-
Microsoft Authenticator Flaw Allows Android Apps With Zero Permissions to Steal Authentication Tokens
A high-severity vulnerability in Microsoft Authenticator for Android could let a malicious app, without any Android permissions, impersonate trusted Microsoft apps and steal authentication tokens for a victim’s signed-in work account. This vulnerability is tracked as CVE-2026-80097 and affects Microsoft Authenticator versions earlier than 6.2606.4246. Microsoft has since issued a patch. Microsoft Authenticator Flaw Security…
-
Microsoft Issues Emergency .NET Security Updates to Fix Four Vulnerabilities
Microsoft released emergency out-of-band security updates addressing four vulnerabilities across .NET, including a Brotli buffer overflow and incomplete fixes from an earlier October release. The updates apply to .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft recommends updating as soon as possible. .NET Security Updates CVE-2026-111497 affects .NET’s implementation of…
-
OpenAI Codex Breaks USB Drive Encryption in Minutes, Exposing Critical Security Flaws
OpenAI Codex helped researcher Xusheng Li identify vulnerabilities in encrypted USB and copy-protection products, showing how AI can speed up reverse engineering. Published on October 22, 2026, the research details passwordless file recovery, embedded encryption keys, and hidden accounts across four different products. Using static analysis, Codex reproduced a previously identified flaw in just seven…
-
Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts
Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign. Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22. However, those figures include defensive scanners and do not establish successful server compromises.…
-
Tailscale SSH Vulnerabilities Allow Attackers to Gain Root Access to Connected Servers
Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to connected servers, bypass network security policies, steal credentials, and disrupt remote-access infrastructure. Erica Windisch of Cyberdione Labs published these findings in a security research report titled Tailworm. The assessment examined Tailscale version 1.104.2 and headscale version…