// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
There's a third PHP2Shell bug, but it won't get an emergency fix
A third PHP2Shell bug has been disclosed, but no emergency fix is planned.
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby released updates fixing three regex engine bugs linked to four GitLab remote code execution flaws caused by memory corruption during pattern compilation.
-
PHP shares mitigation for new RCE vulnerability with no patch
PHP security team shared mitigation measures for an unpatched remote code execution vulnerability affecting non-default configurations.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign compromising exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, exposing more than 70,000 credentials.
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linux kernel maintainer Linus Torvalds says AI-generated patches are acceptable if competent developers produce good code, but drive-by submissions should be avoided.
-
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of CVE-2026-115560, an unpatched remote code execution issue affecting only web applications with unusual configurations.
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Researchers demonstrated a Node.js remote code execution proof of concept using crafted Brotli data processed by the bundled decoder, affecting an official Linux arm64 Node.js 24.22.0 image.
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers made millions of unsuccessful attempts to exploit new PHP2Shell vulnerabilities to deploy a Mirai botnet variant, according to reported activity.
-
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Reports of exploitation attempts involving PHP bugs known as PHP2Shell increased, while experts said the exploits are less viable than headlines suggest.
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies
A security bulletin reports a ransomware supply chain attack affecting shipping firms, ongoing exploitation of PHP2Shell, and GoDaddy certificate revocations.
# Yesterday
-
PHP2Shell exploit bypasses protections designed to stop remote code execution
A PHP2Shell exploit reportedly bypasses protections designed to prevent remote code execution, according to researchers.
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised LiteLLM’s PyPI package and published malicious Docker images that steal credentials, secrets, and environment variables.
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista reports active exploitation of a zero-day SQL injection flaw in VeloCloud Orchestrator that allows authenticated users to gain operator privileges.
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
A security roundup describes AI secrets leaks, PingCAP source theft, a Signal hang-up flaw, a Laravel authentication bypass, and other software vulnerabilities.
-
Max-severity GitLab bug allows remote code execution over 12 years of releases
GitLab disclosed a critical bug enabling remote code execution affecting releases over 12 years.
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks issued security updates for an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises deployments.
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two CVSS 9.0 remote code execution flaws in Linux's KSMBD kernel SMB server were publicly disclosed before mainline kernel fixes were available.
-
PHP2Shell puts dozens of UK government services out of service
A PHP-related issue disrupted dozens of UK government services, with ministers reporting 32 unavailable and four partly disrupted but no confirmed compromise.
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Attackers began probing a PHP vulnerability before defenders were notified, giving them a four-day head start.
-
[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
The post covers PHP2Shell, Trail of Bits open-source skills, and AWS Pathrunner, a tool for automating AWS IAM privilege escalation path checks.
-
Amazon says PHP2Shell exploitation began 4 days before patches
Amazon reports that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were released.
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
AWS says attacks on PHP2Shell began before disclosure, and Cloudflare reported millions of exploit attempts against the vulnerability.
-
GitLab warns of new max severity code execution vulnerability
GitLab has released patches for a maximum-severity regular expression compiler flaw that could allow remote attackers to execute arbitrary code on vulnerable servers.
-
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
333 Tor exit nodes were hijacked for three days to intercept SSH traffic and retrieve plaintext email.
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft reports that a ConnectWise breach enabled Chinese spies to access 2,250 cloud tenants, with privileged access gained in some environments within three hours.
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Railway reported possible unauthorized access to customer environment variables, with some decrypted values exposed, affecting a subset of users.
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM said attackers compromised its release pipeline and pushed a malicious Python package and Docker image containing a credential stealer and backdoor.
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released updates for versions 22.x, 24.x, and 26.x fixing ten flaws, including a Brotli decoder bug that could enable remote code execution.
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon Threat Intelligence reported an attempted exploitation of newly disclosed PHP2Shell vulnerabilities four days before public disclosure, amid broader exploitation after patches.
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft said a China-aligned actor used the ARTEX AI framework in a supply chain attack against ConnectWise Cloud Backup.