News · via SecurityWeek
PHP2Shell Exploitation Started Days Before Patches
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
Exploit
Coverage tagged "Exploit".
News · via Cyble
The Keys Are in the Browser: Secret Exposure Across AI-Built Websites
Cyble scanned 1.3M+ newly registered domains and found AI-built sites leaking live secrets to the browser: OpenAI keys, Stripe keys, and database tokens. Spinning up a website no longer takes a…
News · via Security Affairs
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s…
News · via The Hacker News
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the…
News · via Kaspersky Securelist
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Introduction Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could…
News · via Zero Day Initiative
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
This vulnerability allows network-adjacent attackers to tamper with CMS AuthEnvelopedData messages on affected installations of OpenSSL. An attacker must first obtain the ability to modify CMS…
News · via Zero Day Initiative
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a…
News · via Zero Day Initiative
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a…
News · via Zero Day Initiative
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target…
News · via Zero Day Initiative
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS…
News · via arXiv cs.CR
Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain
arXiv:2610.28794v1 Announce Type: new Abstract: Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the…
News · via arXiv cs.CR
Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
arXiv:2610.28810v1 Announce Type: new Abstract: The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By…
News · via Wired
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.
News · via Wordfence
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website…
News · via Exploit-DB
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
News · via Recorded Future
Behind Japan’s Warnings of a Cyber Crisis
Reporting on cyberattacks against Japanese entities rose 48% between Q2 and Q3 2026, encompassing ransomware, exploitation of vulnerabilities, credential leaks, and service disruptions. Significant…
News · via Zscaler ThreatLabz
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both…
News · via GuidePoint Security
Keep Calm, and Patch PHP2Shell
Keep Calm and Patch PHP2Shell October 21, 2026 Justin Timothy With contributions by the GuidePoint Security GRIT team BLOG 10 min. How to Respond to CVE-2026-109618 and CVE-2026-109619 *Note: This is…
News · via Dark Reading
'PHP2Shell' Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
News · via Flashpoint
The Missing Layer in Vulnerability Prioritization: Full Visibility Into Your Attack Surface
Table Of ContentsTable of ContentsHow EASM Extends Vulnerability Prioritization to Your Full EnvironmentWhy This Matters More in Regulated IndustriesDiscovery and Prioritization, Built Into One…