// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby released updates fixing three regex engine bugs linked to four GitLab remote code execution flaws caused by memory corruption during pattern compilation.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign compromising exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, exposing more than 70,000 credentials.
-
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of CVE-2026-115560, an unpatched remote code execution issue affecting only web applications with unusual configurations.
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Researchers demonstrated a Node.js remote code execution proof of concept using crafted Brotli data processed by the bundled decoder, affecting an official Linux arm64 Node.js 24.22.0 image.
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers made millions of unsuccessful attempts to exploit new PHP2Shell vulnerabilities to deploy a Mirai botnet variant, according to reported activity.
# Yesterday
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista reports active exploitation of a zero-day SQL injection flaw in VeloCloud Orchestrator that allows authenticated users to gain operator privileges.
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
A security roundup describes AI secrets leaks, PingCAP source theft, a Signal hang-up flaw, a Laravel authentication bypass, and other software vulnerabilities.
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two CVSS 9.0 remote code execution flaws in Linux's KSMBD kernel SMB server were publicly disclosed before mainline kernel fixes were available.
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Railway reported possible unauthorized access to customer environment variables, with some decrypted values exposed, affecting a subset of users.
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM said attackers compromised its release pipeline and pushed a malicious Python package and Docker image containing a credential stealer and backdoor.
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released updates for versions 22.x, 24.x, and 26.x fixing ten flaws, including a Brotli decoder bug that could enable remote code execution.
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon Threat Intelligence reported an attempted exploitation of newly disclosed PHP2Shell vulnerabilities four days before public disclosure, amid broader exploitation after patches.
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft said a China-aligned actor used the ARTEX AI framework in a supply chain attack against ConnectWise Cloud Backup.
# 21 Oct
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab issued fixes for an unauthenticated remote code execution flaw affecting self-managed instances since version 7.0.
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
LiteLLM version 1.107.0 was compromised in a supply-chain attack that distributed a credential stealer and backdoor through PyPI and Docker images.