// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Analysis of the LiteLLM 1.107.0 supply chain compromise describes credential theft through Python startup hooks and remote code loading.
-
Metasploit Wrap Up: Langflow, MongoDB, and More
Metasploit adds modules for Langflow authentication bypass and remote code execution flaws, along with other targets such as MongoDB.
-
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
PHP developers released fixes for two critical vulnerabilities, and attacks are continuing, though no confirmed compromises have been reported so far.
# Yesterday
-
CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
A missing authentication flaw in Splunk Enterprise's Patroni REST API could let unauthenticated network users execute operating-system commands.
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP
PHP2Shell exposure may affect bundled runtimes, containers, and hosted applications beyond direct PHP usage, requiring validation of exploitability.
-
I had plans for that second
The post discusses leap second abolition and critical vulnerabilities in PHP.
-
The Current Landscape of OAuth Attacks
A report outlines current OAuth attack techniques and mitigation measures for organizations using authentication protocols.
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers released fixes for two critical vulnerabilities enabling unauthenticated remote code execution in several supported versions.
-
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
A threat actor linked to Storm-0940 is using the ARTEX AI agent to target software vendors and attack Okta, Entra, and Cognito identity services.
-
Localizing compliance at scale: achieving South Korea’s ISMS certification
A South Korean ISMS certification was achieved after an audit of 80 controls, including localized consent flows and edge sign-up adaptations.
-
SonarQube container scanning is now in open beta
SonarQube has introduced an open beta feature for scanning container images to detect vulnerabilities and malicious packages as part of its Advanced Security offering.
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
A 10-week Microsoft 365 campaign used token replay, AiTM relays, rogue Entra devices, MFA tampering, and hidden inbox rules to compromise business email accounts.
-
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two PHP vulnerabilities affecting WordPress sites can allow unauthenticated code execution.
# 21 Oct
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used AI to accelerate a ConnectWise supply chain compromise and abuse application credentials in Microsoft 365 environments.
-
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
PHP has released security updates addressing two critical vulnerabilities that may allow unauthenticated remote code execution.
-
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, a scripting language used for web servers and CMS systems.
-
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
The PHP project released security updates for two critical unauthenticated remote code execution flaws affecting memory handling and request state.
-
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core may affect PHP-based applications and services.
-
CVE-2026-109618 / CVE-2026-109619 | What is Known
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution and are addressed in October 2026 security updates.