WHATS Pierluigi Paganini answers questions about the PHP2Shell flaws
Security Affairs ·
WHATS
THE HAX?
Top story
Also in coverage
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
BleepingComputer ·
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security Latest ·
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
The Hacker News ·
Article feed
60 sources ↓Breaking the AWS MCP Python Sandbox
How LLM-Based Penetration Testing Harnesses Work
Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-2022-22706 (Mali GPU page-cache write)
We used RCE on 3 million PCs to prevent a botnet
low-int-cert-monitor: Monitor Certificate Transparency logs for certificates with trivially small EC private keys (the eMudhra weak-key class). P-256/384/521.
I spun up a free, read-only script to check WordPress sites for signs of PHP2Shell compromise. Looking for feedback
CTO at NCSC Summary: week ending October 25th
PHP2Shell: Obstacles to Weaponizing Likely Constrain Immediate Exploitation
Looking for a mentor
BlackX UEFI Bootkit Leverages “Baton Drop” Flaw to Bypass Secure Boot
Today, we hacked what we'd set out to hack: the iPhone
The Adversary v0.5.0-alpha for Cardputer/ADV is out!
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
Pierluigi Paganini answers questions about the PHP2Shell flaws
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
Usage Intelligence: The Monetization Signal Most AI Companies Are Ignoring
HackTheBox - Checkpoint
HackTheBox - Eloquia
HackTheBox - DevHub
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Microsoft Teams to get AI-powered, context-aware phishing detection
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Reversing a Ren’Py installer: hidden payloads, Amatera Stealer and a changing C2
Windows msi Malware file - Downloaded from fake cloudflare Clickfix page
Nextcloud compromised via the built-in Collabora app (richdocumentscode): how I found out and what I found
Friday Squid Blogging: Increasing Squid Populations
Compromised TLS Certificates
New Serious PHP Vulnerabilities Released and Patched
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
AI Tools Are Generating Massive Attacks for Little Cost
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd)
BOTS WIPED OUT? | Threat Wire
🍍📟 Don't dox yourself: Censor Mode - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
🍍📟 "App Store" Anyone?: Pager Portal - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Agents are your newest insiders. Security must move at their speed.
Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0
Dual BIOS: The laptop security feature SMBs don’t know they need
Meta hit with $25 billion fine for illegally sharing user data
FCC bans two devices with surveillance chips linked to Huawei
UK proposes 14-year prison terms for undersea cable sabotage
Quest Diagnostics warns of potential data theft after attack on lab service system
Knicks sent employees fake offer of championship rings in phishing test: Report
Disgraced eMudhra drops out of TLS business after using cert private key of 4
Hackers got a four-day head start on epic PHP2Shell vulnerability
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
U.S. Banks Detect Unauthorized AI Agents Accessing Accounts
Cyber Breach Hits Quest Diagnostics, Patient Records May Be Affected
PHP Issues Patches for Two Critical Flaws, Security Leaders Discuss
The #1 Danger Isn't Roblox
0day Hacks NetworkChuck (OSINT)
Flushing the toilet kills our network!
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
AI Agent Order Data: Agentic Commerce on Forter’s Network
The Biggest Opportunity in Gaming & Betting Is Knowing When to Say Yes
US Shoppers Are Ready to Give AI More of Their Holiday To-Do List
How Police Can Track Your Phone
Learn More About AI With Me at GTC
What Is Machine Data?
CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability
CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed
Crime Stoppers chapter freezes tips after breach breaks anonymity promise
Facebook’s misleading privacy claims land Meta a $25 billion penalty
UK proposes 14-year jail terms for subsea cable saboteurs
Microsoft 365 accounts compromised at 79 organizations, no passwords needed
Capcom data breach exposes 11.7 million account records
Hacker leaks 281 GB of data from Germany’s far-right AfD party
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Adds One Known Exploited Vulnerability to Catalog
Critical Vulnerabilities in PHP Require Immediate Patching
Siemens Industrial Edge App Publisher
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
php situation 24h later
The race to the first exploit // php2shell
Self-efficacy in the age of AI
FTC Data Shows Investment Scams Fuel Fivefold Surge in Seniors’ Fraud Losses
What Fraud Data Says About Where Payment Security Is Headed
Booking.com Probe Exposes Travel Fraud Beyond Checkout
A stranger disassembled my mouse’s official app, fixed my checksum, and by accident gave me the idea for USB cable support
Hello everyone,It's Aditya from India. I am working on a project where I use machine code to make my own ultra photorealistic graphics game engine while using math.So if anyone is interested to talk about this, I would like to discuss with you
I reverse engineered Black & White with Astra and added LLM + voice support on top of the game's original AI. The environment is exposed to the LLM's context and the creature can select tools to inspect and interact with the world or answer questions about it.
In Singapore for a few days hanging out with hackers and having a good time.
Your AI hackbot has found another 100+ vulnerabilities. Who fixes them? And how? ft Erlend
wood will keep you warm, once when chop, carry, staple and sort it, and once when you burn it.
The Economics of AI
AI Changes Security Research
AI Security Engineering with Ashish Rajan!
News alert: Gcore extends free web protection to government agencies after widespread PHP exploits
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
News alert: Bright Security launches AI-powered tool to uncover hidden software vulnerabilities
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
Is the ad a scam? How to tell before you click
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Operation FlashHole: Lazarus breaks security, defies control
Behind Japan’s Warnings of a Cyber Crisis
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
TAG-217 Targets South Korean Financial Services with ARTEX
AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web
Critical PHP2Shell Vulnerabilities (CVSS 9.2): CVE-2026-109618 & CVE-2026-109619 — Patch & Hunt Immediately
Graysentinel
Widespread PHP Flaw May Cause Many Site Outages Today
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.K. Sanctions Cryptomus for RU Money Laundering
Does your fraud risk assessment measure up when a financial crime occurs?
Fraud Risk Assessment: A New Model and New Approach
Assessing the Strength of Your Fraud Controls
Black Hat Stories | Island.io
Black Hat Europe 2026 | Hear From Our Sponsors
Black Hat Stories | First Time Exhibitor
Why people don’t report scams, and it’s not embarrassment
6 alternatives to Blackpoint for your shortlist
Cybercrime Detective Explains Cybersecurity Jargon in 60-Second Videos for Cybersecurity Awareness Month
ZDI-CAN-34171: Adobe
What Does a GRC Cybersecurity Professional Do?
CTF Walkthrough: The Cuckoo's Log
Purple Team Incident Adventure | TCM Community Live | Cybersecurity
#StopRansomware: SafePay Ransomware
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
HackerOne Limited Me to 3 Reports After 12 Years
Google just paid a $90,000 bounty for this vulnerability
I Built a Hackbot for Less Than $250
Anthropic’s AI Reversal Is A Warning Shot For Agentic Defense
Agentic AI Is Changing Security Decisions: Why Accountability Must Be Designed, Not Assumed
A New OT Security Playbook for Connected Robots
Proofpoint CEO Sumit Dhawan On ‘Market-Changing’ $6.3B Varonis Deal, IPO Goal
Proofpoint CEO on acquiring Varonis for $6.3B: ‘Opportunities like this don’t come every day’
Thoma Bravo's Proofpoint to buy Varonis Systems in $6.3 billion all-cash deal
eIDAS 2.0 and AMLR Updated Standards: What Should Regulated Businesses Do Next?
Business Fraud at Network Scale: What the $3.5B Medicare Hospice Crisis Reveals About Know Your Business
DCSG1 - Pwn2Own Level Break of a Printer - SungJun Park, WonBeen Im
DCSG1 - Augmenting Apple's Source Code and OS Logs with AI Agents -Olivia Gallucci
DCSG1 - Actual OT Cyber Security - Dillon Lee
Introducing the new Copilot with Home, Code and Autopilot
Building the system for AI at work
Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead
AI Agents Can Be Secured. We Can Do It.
Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility
Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
Ransomware: A Continuing Threat for Small Businesses
AI in Tax Season: Risks, Scams, and How to Protect Your Data
Tax Season Scams to Watch For This Year
Why every payments team should be watching for ACH fraud
From the Edge to the Core: 9 Ways PKI Secures Your Network
How to Secure Your Email Server on an SMB Budget
Microsoft Build 2026: Building agentic apps with Microsoft Fabric and Microsoft Databases
Azure IaaS: Defense in depth built on secure-by-design principles
Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM
How FIN6 Exfiltrates Files Over FTP
Emulating FIN6 - Active Directory Enumeration Made EASY
The SECRET to Embedding Metasploit Payloads in VBA Macros
Try another search or clear the filters.
Showing 180 of 1019 loaded entries. Search and all-headlines view include all available entries in this section. Browse the feed archive.