// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista reports active exploitation of a zero-day SQL injection flaw in VeloCloud Orchestrator that allows authenticated users to gain operator privileges.
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP
PHP2Shell exposure may affect bundled runtimes, containers, and hosted applications beyond direct PHP usage, requiring validation of exploitability.
-
CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook
CVE-2026-115414 describes an OS command injection issue in AWS SAM CLI's Terraform hook, where resource addresses are interpolated into generated Makefile recipes.
-
I had plans for that second
The post discusses leap second abolition and critical vulnerabilities in PHP.
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
A security roundup describes AI secrets leaks, PingCAP source theft, a Signal hang-up flaw, a Laravel authentication bypass, and other software vulnerabilities.
-
Max-severity GitLab bug allows remote code execution over 12 years of releases
GitLab disclosed a critical bug enabling remote code execution affecting releases over 12 years.
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks issued security updates for an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises deployments.
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two CVSS 9.0 remote code execution flaws in Linux's KSMBD kernel SMB server were publicly disclosed before mainline kernel fixes were available.
-
The Current Landscape of OAuth Attacks
A report outlines current OAuth attack techniques and mitigation measures for organizations using authentication protocols.
-
PHP2Shell puts dozens of UK government services out of service
A PHP-related issue disrupted dozens of UK government services, with ministers reporting 32 unavailable and four partly disrupted but no confirmed compromise.
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Attackers began probing a PHP vulnerability before defenders were notified, giving them a four-day head start.
-
[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
The post covers PHP2Shell, Trail of Bits open-source skills, and AWS Pathrunner, a tool for automating AWS IAM privilege escalation path checks.
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers released fixes for two critical vulnerabilities enabling unauthenticated remote code execution in several supported versions.
-
Amazon says PHP2Shell exploitation began 4 days before patches
Amazon reports that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were released.
-
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
A threat actor linked to Storm-0940 is using the ARTEX AI agent to target software vendors and attack Okta, Entra, and Cognito identity services.
-
Localizing compliance at scale: achieving South Korea’s ISMS certification
A South Korean ISMS certification was achieved after an audit of 80 controls, including localized consent flows and edge sign-up adaptations.
-
SonarQube container scanning is now in open beta
SonarQube has introduced an open beta feature for scanning container images to detect vulnerabilities and malicious packages as part of its Advanced Security offering.
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
A 10-week Microsoft 365 campaign used token replay, AiTM relays, rogue Entra devices, MFA tampering, and hidden inbox rules to compromise business email accounts.
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
AWS says attacks on PHP2Shell began before disclosure, and Cloudflare reported millions of exploit attempts against the vulnerability.
-
GitLab warns of new max severity code execution vulnerability
GitLab has released patches for a maximum-severity regular expression compiler flaw that could allow remote attackers to execute arbitrary code on vulnerable servers.
-
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
333 Tor exit nodes were hijacked for three days to intercept SSH traffic and retrieve plaintext email.
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft reports that a ConnectWise breach enabled Chinese spies to access 2,250 cloud tenants, with privileged access gained in some environments within three hours.
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Railway reported possible unauthorized access to customer environment variables, with some decrypted values exposed, affecting a subset of users.
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM said attackers compromised its release pipeline and pushed a malicious Python package and Docker image containing a credential stealer and backdoor.
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released updates for versions 22.x, 24.x, and 26.x fixing ten flaws, including a Brotli decoder bug that could enable remote code execution.
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon Threat Intelligence reported an attempted exploitation of newly disclosed PHP2Shell vulnerabilities four days before public disclosure, amid broader exploitation after patches.
-
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
OpenSSL CMP has a remote information disclosure vulnerability, tracked as CVE-2026-63073, requiring no authentication.
-
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
OpenSSL contains a vulnerability in CMS AuthEnvelopedData integrity check validation that could allow tampering by network-adjacent attackers.
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft said a China-aligned actor used the ARTEX AI framework in a supply chain attack against ConnectWise Cloud Backup.
-
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two PHP vulnerabilities affecting WordPress sites can allow unauthenticated code execution.