Tag: vulnerability
-
Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit
A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against the Steal My Bitcoin challenge. This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server. The researcher, using the GitHub username KillaBoi, published the exploit in…
-
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.”What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application,” a spokesperson for the company told…
-
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.”In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor First seen on…
-
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable […]…
-
Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/25/week-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-flaw/
-
Pierluigi Paganini answers questions about the PHP2Shell flaws
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet,…
-
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online Built-in CODE Server is […] First…
-
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
-
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began. First seen on wired.com Jump to article: www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/
-
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.…
-
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central management system for…
-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.The critical-severity vulnerabilities are listed below – CVE-2026-110447 (CVSS score: 9.2) – An operating First seen on thehackernews.com…
-
Why AI Labs, HR Giants Are Emerging as Cybersecurity Buyers
Identity Governance and Vulnerability Remediation Startups Draw Unexpected Suitors Workday’s buy of C1.ai, Cohere’s purchase of Aisle and OpenAI’s reported talks with Trail of Bits highlight how AI providers and enterprise software companies are expanding into cybersecurity, creating new startup exit opportunities while raising questions about competition and partner independence. First seen on govinfosecurity.com Jump…
-
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/
-
4 Flaws Found in Widely Used Health Data Exchange Software
Researcher: HAPI FHIR Vulnerabilities Put Patient Data, System Availability at Risk. Four vulnerabilities in a widely used open-source healthcare interoperability software could enable attackers to improperly access sensitive patient records, cross security boundaries separating healthcare organizations’ data and potentially disrupt services, according to new security research. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/4-flaws-found-in-widely-used-health-data-exchange-software-a-33192
-
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP…
-
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/
-
PHP-Sicherheitslücken Warum Unternehmen ihre Cyberabwehr neu aufstellen müssen
Am 21. Oktober 2026 wurden zwei kritische PHP-Sicherheitslücken bekannt, die aufgrund der weiten Verbreitung der Programmiersprache und ihrer teilweise einfachen Ausnutzbarkeit ein erhebliches Risiko darstellen. Ein Kommentar von Udo Fink, Leiter Cybersicherheit Zentraleuropa bei DXC Technology. ‘Die aktuellen PHP-Sicherheitslücken zeigen, wie schnell Unternehmen durch Schwachstellen in weitverbreiteten Softwarekomponenten unter Handlungsdruck geraten. Es ist zu befürchten,…
-
426 Android and iOS Apps Linked to PHP2Shell Backend Risks
Research found 426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, raising concerns… First seen on hackread.com Jump to article: hackread.com/426-android-ios-apps-linked-php2shell-backend-risks/
-
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
-
Critical Okta Access Gateway Vulnerability Enables Remote Command Execution
A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could allow an authenticated administrator to execute system commands by submitting specially formatted configuration values through the appliance’s Admin Console. This vulnerability is documented in an advisory dated October 22, 2026. Tracked as CVE-2026-115547, the issue affects versions of the OAG…
-
Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attacker gain administrative privileges and fully compromise an affected host. It has a CVSS v3.1 score of 9.8, indicating a high severity. Attackers can exploit…
-
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives…
-
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Tags: attack, cve, cvss, cyber, data-breach, exploit, hacker, rce, remote-code-execution, sophos, vulnerabilityPublic proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and carry CVSS v4.0 scores of 9.2, potentially allowing unauthenticated remote code execution with web server privileges. However, Sophos has corrected an earlier report of…
-
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled. ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant. Citrix disclosed the vulnerability on September 27, 2026,…
-
Wenn die Laufzeitumgebung zum Risiko wird: Die Management-Lektion aus PHP2Shell
Zwei kritische Schwachstellen in PHP rücken eine oft übersehene Abhängigkeit ins Zentrum: die Laufzeitumgebung unterhalb von Websites, Shops und Verwaltungsoberflächen. Die Sicherheitsupdates sind verfügbar doch ein aktualisiertes CMS ist noch kein Nachweis für eine abgesicherte PHP-Installation. Für Geschäftsführung und IT-Verantwortliche geht es deshalb um mehr als einen weiteren Patch: um vollständige Bestandsaufnahmen, belegte Aktualisierungen,… First…
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote First…
-
Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication. The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.1 score of 9.1 and advises distrusting impacted intermediate certificate authority certificates associated with eMudhra. The vulnerability specifically impacts…
-
Die PHP-Schwachstelle Segen und Fluch der KI-getriebenen Suche nach Softwarefehlern
Die kritischen PHP-Schwachstellen PHP2Shell treffen eine zentrale Laufzeitumgebung vieler Webanwendungen. Sicherheitsupdates sind verfügbar; europäische Cybersecurity-Stellen rufen zum sofortigen Handeln auf. [1][2] Für das Management reicht die Frage nach dem Patchstatus jedoch nicht aus: Welche Geschäftsprozesse müssen nach einem Angriff zuerst wieder funktionieren? Welche Daten sind dafür erforderlich? Und wurde die Wiederherstellung unter realistischen Bedingungen getestet?……