WHATS Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Security Latest ·
WHATS
THE HAX?
Top story
Also in coverage
ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)
SANS Internet Storm Center, InfoCON: yellow ·
OpenAI’s models are deliberately breaking their misalignment monitoring systems
CSO Online ·
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
GRAHAM CLULEY ·
Article feed
59 sources ↓Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
AI Guardrails Aren’t Stopping Criminal Hackers
A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)
ISC Stormcast For Tuesday, October 20th, 2026 https://isc.sans.edu/podcastdetail/10142, (Tue, Oct 20th)
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
Cisco Unified Communications Manager Improper Access Control Vulnerability
PHP Just Patched Two Critical Remote Code Execution Flaws. Update Now.
CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window
Gallery of PHP maintenance pages from today
PHP2Shell - quick mitigation pre-patch
OpenAI’s models are deliberately breaking their misalignment monitoring systems
Two critical PHP flaws put the web on alert as emergency patches arrive
Microsoft: Treat AI agents as insider threats
WordPress sites compromised after TeamUpdraft credential exposure
PHP2Shell disclosure-day telemetry: scanners that double as droppers, a second stage not in public malware feeds, and IOCs (user agents, boundary strings, hashes)
Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques - JPCERT/CC Eyes
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Dissecting Operation FlashHole, a complex attack by Lazarus
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
Irish police force has its Twitter hacked in cryptocurrency scam
Krybit ransomware: what you need to know
Chrome puts insecure sites behind a permission prompt
eMudhra security blunder left trusted CA signing keys exposed to anyone
NVIDIA unveils security architecture that can stop AI agents crossing set boundaries
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Lazarus hackers use post-quantum cryptography for malware delivery
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
Booking.com Probe Exposes Travel Fraud Beyond Checkout
Booking.com Anti-Fraud Practices Face Scrutiny in Europe
Google Mandates Further Verification for US and Canada Financial Ads
Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine
OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight
US Government Orders DeepSeek Out of Federal Civilian Systems
TiDB Breach Exposes Flawed Cloud Security Assumptions
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Meta on the spot for $25 billion under New Mexico privacy ruling
Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
Democrat lawmakers say Russia is aiming to undermine party ahead of midterms
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators
PHP2Shell: Why websites are going offline for emergency security updates
Fake Amazon Music x YouTube deal lures creators into a Google login trap
gore: a CLI that turns a Godot game (PCK or EXE) into a project you can open, with automatic AES-256 key recovery
How Cryo's Atlantis: The Lost Tales (1997) engine works: formats, panoramic projection, scripts and 3D heads
I extended decomp.wtf into a REA system.
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Agents are your newest insiders. Security must move at their speed.
Managing open-weight model risk in enterprise deployments
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
🍍📟 Don't dox yourself: Censor Mode - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
🍍📟 "App Store" Anyone?: Pager Portal - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
Hackers Turned GitHub Against Its Own Users | Threat Wire
I went through the confirmed AI coding agent security incidents since July 2025. The agent was rarely the way in. The things installed next to it were.
Over a decade in PHP's codebase. AI made it exploitable in a week.
Is it possible to intercept/read an Email?
AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web
Critical PHP2Shell Vulnerabilities (CVSS 9.2): CVE-2026-109618 & CVE-2026-109619 — Patch & Hunt Immediately
Graysentinel
CISO Burnout Isn’t a Personal Problem — It’s Organizational
35% of Organizations Run Over 1000 AI Agents
Only 7% of CISOs at Large Companies Own AI Governance
The Biggest Opportunity in Gaming & Betting Is Knowing When to Say Yes
US Shoppers Are Ready to Give AI More of Their Holiday To-Do List
The Agentic Commerce Conversations Merchants Are Having Now
Widespread PHP Flaw May Cause Many Site Outages Today
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.K. Sanctions Cryptomus for RU Money Laundering
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Operation FlashHole: Lazarus breaks security, defies control
The journey of a paper unicorn: adventures inside a modern warehouse
Does your fraud risk assessment measure up when a financial crime occurs?
Fraud Risk Assessment: A New Model and New Approach
Assessing the Strength of Your Fraud Controls
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Black Hat Stories | Island.io
Black Hat Europe 2026 | Hear From Our Sponsors
Black Hat Stories | First Time Exhibitor
CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability
CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability
CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability
Critical Vulnerabilities in PHP Require Immediate Patching
CISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA Adds Two Known Exploited Vulnerabilities to Catalog
#StopRansomware: SafePay Ransomware
Workshop on Economics and Information Security (WEIS) Archive
Possible new Cellebrite iPhone Radio Zero-Day
Training AIs to Solve CAPTCHAs
Why people don’t report scams, and it’s not embarrassment
6 alternatives to Blackpoint for your shortlist
Cybercrime Detective Explains Cybersecurity Jargon in 60-Second Videos for Cybersecurity Awareness Month
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
News alert: Bright Security launches AI-powered tool to uncover hidden software vulnerabilities
NEWS ALERT: G2A reports 35% jump in security software orders as consumers broaden protection
ZDI-CAN-33882: FreeBSD
PHP warns it plans to release 2 emergency patches imminently
The Internet goes on high alert after discovery of 8 compromised TLS certs
Meta Muse exposes users' personal and business secrets when they share conversations
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
TAG-217 Targets South Korean Financial Services with ARTEX
Working in Boston at the World’s Largest Intelligence Company
LOLCHAIN: Blockchain abuse research and evidence for malware analysts
The OffiDocs Browser Extension Campaign
Offensive toolkit (payload builder, serialized gadgets, stager) pulled from an open directory
What Does a GRC Cybersecurity Professional Do?
CTF Walkthrough: The Cuckoo's Log
Purple Team Incident Adventure | TCM Community Live | Cybersecurity
0day Hacks NetworkChuck (OSINT)
Flushing the toilet kills our network!
You can monitor EVERYTHING in your homelab with this
Learn More About AI With Me at GTC
What Is Machine Data?
2 Hacking Tools You Need to See
Is the ad a scam? How to tell before you click
Inbox flooded with sign-up messages? Email bombing explained
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
AI Changes Security Research
AI Security Engineering with Ashish Rajan!
Browser Cache Payloads
Self-efficacy in the age of AI
Team Introduction Videos for the European Cyber Security Challenge
Security Through Complexity #shorts
HackerOne Limited Me to 3 Reports After 12 Years
Google just paid a $90,000 bounty for this vulnerability
I Built a Hackbot for Less Than $250
Anthropic’s AI Reversal Is A Warning Shot For Agentic Defense
Agentic AI Is Changing Security Decisions: Why Accountability Must Be Designed, Not Assumed
A New OT Security Playbook for Connected Robots
HackTheBox - Eloquia
HackTheBox - DevHub
HackTheBox - Reactor
Proofpoint CEO Sumit Dhawan On ‘Market-Changing’ $6.3B Varonis Deal, IPO Goal
Proofpoint CEO on acquiring Varonis for $6.3B: ‘Opportunities like this don’t come every day’
Thoma Bravo's Proofpoint to buy Varonis Systems in $6.3 billion all-cash deal
eIDAS 2.0 and AMLR Updated Standards: What Should Regulated Businesses Do Next?
Business Fraud at Network Scale: What the $3.5B Medicare Hospice Crisis Reveals About Know Your Business
Your AI hackbot has found another 100+ vulnerabilities. Who fixes them? And how? ft Erlend
wood will keep you warm, once when chop, carry, staple and sort it, and once when you burn it.
I tend to sauna 2-3 days a week, it have made wonders for my recovery. #sauna #mobilesauna #vlog
DCSG1 - Pwn2Own Level Break of a Printer - SungJun Park, WonBeen Im
DCSG1 - Augmenting Apple's Source Code and OS Logs with AI Agents -Olivia Gallucci
DCSG1 - Actual OT Cyber Security - Dillon Lee
Introducing the new Copilot with Home, Code and Autopilot
Building the system for AI at work
Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead
AI Agents Can Be Secured. We Can Do It.
Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility
Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
Ransomware: A Continuing Threat for Small Businesses
AI in Tax Season: Risks, Scams, and How to Protect Your Data
Tax Season Scams to Watch For This Year
Why every payments team should be watching for ACH fraud
From the Edge to the Core: 9 Ways PKI Secures Your Network
How to Secure Your Email Server on an SMB Budget
Microsoft Build 2026: Building agentic apps with Microsoft Fabric and Microsoft Databases
Azure IaaS: Defense in depth built on secure-by-design principles
Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM
Try another search or clear the filters.
Showing 180 of 1013 loaded entries. Search and all-headlines view include all available entries in this section. Browse the feed archive.