// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Ruby Regexp compilation fixes related to GitLab's CVE's
Ruby released Regexp compilation fixes related to GitLab CVEs.
-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Analysis of the LiteLLM 1.107.0 supply chain compromise describes credential theft through Python startup hooks and remote code loading.
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby released updates fixing three regex engine bugs linked to four GitLab remote code execution flaws caused by memory corruption during pattern compilation.
-
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
CVE-2026-87912 and CVE-2026-87913 identify missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server.
-
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
A CVE reports an issue in awslabs mysql-mcp-server, a tool for connecting MySQL databases with Model Context Protocol clients.
-
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
A stored cross-site scripting issue in OpenSearch Dashboards involves a bypass of a Vega expression function.
-
CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
CVE-2026-85787 affects Amazon's PostgreSQL MCP server, allowing disallowed SQL inputs to modify data beyond read-only limits.
-
PHP Informational advisory: Session upload progress (CVE-2026-115560)
PHP published an informational security advisory for CVE-2026-115560, which affects session upload progress functionality.
-
Metasploit Wrap Up: Langflow, MongoDB, and More
Metasploit adds modules for Langflow authentication bypass and remote code execution flaws, along with other targets such as MongoDB.
-
PHP shares mitigation for new RCE vulnerability with no patch
PHP security team shared mitigation measures for an unpatched remote code execution vulnerability affecting non-default configurations.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign compromising exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, exposing more than 70,000 credentials.
-
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
A security alert update summarized recent PHP vulnerabilities and returned to normal status.
-
CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-95664 affects Apache Camel’s AWS2-S3 producer, which evaluates untrusted S3 object keys from the CamelAwsS3Key header as simple expressions.
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linux kernel maintainer Linus Torvalds says AI-generated patches are acceptable if competent developers produce good code, but drive-by submissions should be avoided.
-
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of CVE-2026-115560, an unpatched remote code execution issue affecting only web applications with unusual configurations.
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Researchers demonstrated a Node.js remote code execution proof of concept using crafted Brotli data processed by the bundled decoder, affecting an official Linux arm64 Node.js 24.22.0 image.
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers made millions of unsuccessful attempts to exploit new PHP2Shell vulnerabilities to deploy a Mirai botnet variant, according to reported activity.
-
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Reports of exploitation attempts involving PHP bugs known as PHP2Shell increased, while experts said the exploits are less viable than headlines suggest.
-
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
A Palo Alto Networks advisory says PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect some of its products, with severity rated high.
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies
A security bulletin reports a ransomware supply chain attack affecting shipping firms, ongoing exploitation of PHP2Shell, and GoDaddy certificate revocations.
-
DSA-6579-1 roundcube - security update
A security update for Roundcube webmail has been released for Debian systems.
-
DSA-6581-1 unbound - security update
A security update has been released for the Unbound DNS resolver in Debian.
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect certain Cisco products.
-
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
PHP developers released fixes for two critical vulnerabilities, and attacks are continuing, though no confirmed compromises have been reported so far.
-
VU#763488: Memory corruption vulnerabilities in PHP
Two memory corruption vulnerabilities in older PHP versions could allow remote code execution through crafted HTTP requests.
# Yesterday
-
PHP2Shell exploit bypasses protections designed to stop remote code execution
A PHP2Shell exploit reportedly bypasses protections designed to prevent remote code execution, according to researchers.
-
CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
A missing authentication flaw in Splunk Enterprise's Patroni REST API could let unauthenticated network users execute operating-system commands.
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised LiteLLM’s PyPI package and published malicious Docker images that steal credentials, secrets, and environment variables.
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista reports active exploitation of a zero-day SQL injection flaw in VeloCloud Orchestrator that allows authenticated users to gain operator privileges.
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP
PHP2Shell exposure may affect bundled runtimes, containers, and hosted applications beyond direct PHP usage, requiring validation of exploitability.