Overview of incoming advisories.
2018 results found
PHP.net announced a critical security update addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.4. Due to the severity and widespread use of PHP, ISC SANS elevated the InfoCon level to YELLOW. Early proof-of-concept exploits were reportedly available before the patch was released, increasing the risk of exploitation. The high CVSS score and pre-patch PoC availability make this a high-priority issue for organizations running PHP-based applications. Administrators are strongly urged to apply the patch as soon as it becomes available.
View original advisory →A previously undocumented China-aligned threat cluster called Bronze Sandcastle has been identified targeting organizations in Asia and Africa since mid-2025. The group's most distinctive technical marker is its consistent use of Sandboxie DLL sideloading techniques to deploy backdoors. The campaign was disclosed by Sophos security researcher Gabor Szappanos. The threat actor is assessed to be aligned with Chinese state interests. The targeting pattern focuses on organizations across Asian and African regions. DLL sideloading via the legitimate Sandboxie application is used as a mechanism to load malicious payloads stealthily. This technique helps the attackers evade detection by abusing trusted software. The activity represents a newly documented cluster not previously attributed or tracked publicly.
View original advisory →CISA is urging organizations to immediately patch two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as 'php2shell'. These vulnerabilities allow unauthenticated remote code execution and affect all PHP installations serving web requests. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations unable to patch immediately should take PHP-based systems offline, especially internet-facing ones. PHP 8.1 and earlier unsupported versions are also affected. CISA recommends inventorying all PHP installations, applying patches with priority to internet-facing systems, and using web application firewalls as a temporary mitigation. Network defenders should monitor for suspicious activity such as PHP worker processes launching shells or downloading tools. No active exploitation has been observed at the time of publication.
View original advisory →Two critical PHP vulnerabilities collectively named PHP2Shell have been rated 9.2 out of 10 in severity and are scheduled for a patch release at 14:00 UTC on October 21. PHP has provided no official workaround prior to the fix. A setting being circulated in the security community as a mitigation has been clarified by the originating security firm to be insufficient on its own. Organizations are urged to apply the patch as soon as it becomes available. The flaws allow remote code execution (RCE), making them highly dangerous for any server running PHP. The article aims to clarify what partial mitigations may reduce risk in the window before patching and what measures are ineffective.
View original advisory →Attackers seized control of over 300 Tor exit relays in early October, using them to intercept SSH connections and steal login credentials. The attack targeted the final hop in Tor circuits, where traffic exits the anonymity network toward its destination. Users who authenticated to SSH servers via Tor between October 1 and 5 using password-based login were at risk. The attackers redirected connections to rogue servers designed to harvest passwords. This represents a significant man-in-the-middle attack against Tor users relying on the network for secure remote access. The incident highlights the risks of trusting exit relays in anonymity networks for sensitive operations like SSH authentication.
View original advisory →Unknown threat actors breached TeamUpdraft's website and gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. These stolen keys were subsequently used to plant backdoors on WordPress sites managed through these services. TeamUpdraft is the developer of UpdraftPlus, a widely-used WordPress backup plugin with over four million active installations. The attack represents a supply chain compromise targeting the management infrastructure rather than the plugin itself. Affected products include UpdraftCentral, UpdraftVault, and UpdraftClone. The breach allowed attackers to leverage legitimate credentials to gain persistent access to customer WordPress installations. The incident highlights risks associated with centralized management platforms for widely-deployed CMS plugins.
View original advisory →The Cybersecurity and Infrastructure Security Agency (CISA), alongside the FBI, has issued an advisory warning that the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. SafePay is an emerging ransomware threat targeting critical infrastructure sectors globally. The scale of the campaign—600+ victims—highlights the group's aggressive and widespread operational tempo. CISA's involvement underscores the severity and national security implications of the threat. The advisory likely includes indicators of compromise and mitigation guidance for affected organizations. Critical infrastructure sectors such as energy, healthcare, and transportation are typically primary targets for ransomware groups of this nature. Organizations are urged to review CISA's advisory and implement recommended defenses promptly.
View original advisory →CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws affecting Plex Media Server collectively known as Plex2Shell, as well as vulnerabilities in Siemens and SiteGuard products. One of the listed vulnerabilities is CVE-2026-96652, a Server-Side Request Forgery (SSRF) flaw in Plex Media Server with a CVSS score of 5.3. Federal agencies have been ordered to patch these vulnerabilities promptly. The inclusion in the KEV catalog indicates active exploitation in the wild. The directive underscores ongoing risks to government and enterprise environments from known, unpatched vulnerabilities in widely used software and industrial control systems.
View original advisory →Two critical unpatched remote code execution vulnerabilities in PHP have been discovered, rated 9.2 on the CVSS v4.0 scale. PHP is preparing an out-of-cycle emergency security release scheduled for 14:00 UTC on October 21, 2026. The flaws affect all four currently supported PHP branches: 8.2, 8.3, 8.4, and 8.5. Security researchers at watchTowr confirmed the vulnerabilities allow remote code execution. No active exploitation has been reported at the time of disclosure. The vulnerabilities have been collectively referred to as 'PHP2Shell' by the security community. No CVE identifiers have been publicly assigned yet. The PHP security team has not disclosed technical details about the flaws ahead of the patch release. Users on unsupported PHP branches will not receive fixes and remain exposed. This represents a significant risk given PHP's widespread use in web applications globally.
View original advisory →A threat actor breached TeamUpdraft's official website, the developer behind popular WordPress backup and security plugins including UpdraftPlus and UpdraftCentral. The attacker potentially compromised UpdraftCentral connection keys, which are used to authenticate and send commands to connected WordPress websites. This supply chain-style attack could allow the attacker to issue malicious commands to any WordPress site connected via the stolen keys. The breach raises significant concerns for WordPress site owners relying on UpdraftCentral for centralized management. Affected users are advised to rotate their connection keys and monitor their sites for unauthorized changes or backdoors. The incident highlights the risks of centralized WordPress management platforms as high-value attack targets.
View original advisory →Certificate authority eMudhra revoked eight intermediate certificates after researchers discovered their private keys were critically weak. The weak keys could be recovered almost instantly by anyone, enabling forgery of trusted certificates for legitimate websites. Mozilla, Google, and Apple took action by blocking these compromised certificates in their respective browsers and trust stores. The incident highlights a serious failure in certificate authority key generation practices. This type of compromise undermines the entire web PKI trust model, potentially exposing users to man-in-the-middle attacks and credential theft. Browser vendors acted swiftly to protect users by revoking trust in the affected intermediate certificates.
View original advisory →CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP core that leaked prior to official disclosure. The article examines the nature of these flaws and why exploitation consistently results in web servers spawning interactive shells. Elastic Security Labs analyzes the attack patterns associated with these vulnerabilities and details the detection logic developed to identify exploitation attempts. The convergence of exploitation behavior around web-server-to-shell patterns makes detection feasible through behavioral analysis. Elastic has developed specific detections targeting this behavior to provide coverage for affected organizations. The article serves both as a technical assessment and a practical guide for defenders using Elastic's security tooling.
View original advisory →The PHP security team has issued an urgent warning to administrators about two critical vulnerabilities affecting PHP. Information about the flaws was reportedly leaked ahead of their scheduled coordinated disclosure, prompting an accelerated emergency patch release. Administrators are advised to prepare for immediate updates to be released the following day. The early leak increases the risk of exploitation before patches are widely applied. No specific CVE identifiers or technical details were included in the initial warning. The situation underscores the dangers of premature vulnerability disclosure. PHP is widely used across web infrastructure globally, making the potential impact significant. Administrators running PHP-based systems should monitor official PHP channels and apply patches as soon as they are available.
View original advisory →Threat actors are conducting LLMjacking attacks by luring victims through malicious Google Search ads that lead to phishing sites stealing cloud credentials. Once credentials are compromised, attackers hijack cloud billing accounts to exploit LLM APIs such as those provided by major cloud providers. The unauthorized AI API usage can result in hundreds of thousands of dollars in charges to the victim. The attack chain begins with a simple ad click, progresses through credential theft, and culminates in large-scale abuse of AI services. This campaign highlights the growing financial motivation behind targeting cloud environments for AI resource exploitation. The technique represents an emerging threat vector where cloud-hosted LLM services are monetized by attackers at the victim's expense. Organizations using cloud-based AI services are urged to monitor billing anomalies and enforce strong credential hygiene.
View original advisory →Zeabur, a cloud development platform, disclosed a second cybersecurity incident within two months. An attacker exploited leaked internal credentials that were stored in plaintext to gain unauthorized access to Zeabur's infrastructure. The breach resulted in the theft of over 3.2 million environment variable records, which can contain sensitive configuration data and secrets. Additionally, account information for 321,810 users was compromised. The repeated nature of the breaches and the severity of the data exposure led Zeabur to announce it would be shutting down operations. The incident highlights the critical risk of storing credentials and secrets in plaintext. The scale of stolen environment variables poses significant downstream risks for affected developers and their applications.
View original advisory →Eight eMudhra intermediate certificate authority (CA) private keys have been confirmed compromised, as reported by Mozilla and Google's Chrome Root Program on October 20. Intermediate CA certificates are used to sign website certificates, meaning possession of these keys would allow an attacker to issue fraudulent certificates for any website that browsers would trust. A researcher reported the issue, triggering emergency responses from major browser vendors. Emergency fixes are being rolled out across browsers and software to revoke trust in the affected certificates. This represents a significant threat to web PKI integrity and HTTPS trust across the internet.
View original advisory →A critical path traversal vulnerability tracked as CVE-2026-106173 has been identified in Fortinet FortiSIEM with a CVSS score of 9.4. Cybersecurity researchers have released a public proof-of-concept (PoC) exploit for this flaw. The vulnerability allows an unauthenticated attacker to execute arbitrary code or commands remotely via specially crafted requests. Fortinet has released a patch for the issue. The public availability of a PoC significantly raises the risk of exploitation in the wild. Organizations using FortiSIEM are urged to apply the patch immediately. The flaw is classified as critical due to its unauthenticated nature and high CVSS score.
View original advisory →Palo Alto Networks has disclosed ongoing exploitation of CVE-2026-0257, a now-patched authentication bypass vulnerability affecting PAN-OS and Prisma Access. The flaw carries a CVSS score of 7.8 and allows threat actors to establish unauthorized VPN connections, effectively bypassing multi-factor authentication. Two ransomware groups, Qilin and INC, have been observed actively exploiting this vulnerability. Palo Alto Networks patched the flaw in May 2026. The continued exploitation post-patch indicates that many organizations have not yet applied the fix. The activity highlights the growing trend of ransomware actors targeting network edge devices to gain initial access.
View original advisory →A Chinese-speaking threat actor deployed autonomous AI agents to conduct automated attacks against company websites with minimal human intervention. The campaign targeted over 1,200 websites and successfully breached systems belonging to more than 100 companies, including major firms like John Deere. The operation was discovered because the attackers left their control panels exposed on the public internet, allowing a security researcher to observe the attacks in real time. This incident marks a significant escalation in the use of AI for offensive cybersecurity operations, demonstrating that autonomous agents can conduct web intrusions at scale. The event raises serious concerns about the future threat landscape where AI lowers the barrier to entry for sophisticated attacks.
View original advisory →The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was confirmed to be infected with NSO Group's Pegasus spyware in 2026. The infection was discovered by Citizen Lab and reported on October 19, just six days before Serbia's October 25 snap parliamentary election. The attack used a zero-click exploit, meaning the victim did not need to interact with any malicious link or file. This case highlights the continued use of Pegasus spyware against civil society figures, academics, and political activists. The timing of the discovery, shortly before a national election, raises serious concerns about political surveillance and interference.
View original advisory →