// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# 22 Oct
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers released fixes for two critical vulnerabilities enabling unauthenticated remote code execution in several supported versions.
-
Amazon says PHP2Shell exploitation began 4 days before patches
Amazon reports that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were released.
-
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
A threat actor linked to Storm-0940 is using the ARTEX AI agent to target software vendors and attack Okta, Entra, and Cognito identity services.
-
Localizing compliance at scale: achieving South Korea’s ISMS certification
A South Korean ISMS certification was achieved after an audit of 80 controls, including localized consent flows and edge sign-up adaptations.
-
How do you verify AI coding agent output from any tool, not just one?
A guide describes verifying AI coding agent output using deterministic analysis, CI quality gates, and SonarQube MCP Server.
-
SonarQube container scanning is now in open beta
SonarQube has introduced an open beta feature for scanning container images to detect vulnerabilities and malicious packages as part of its Advanced Security offering.
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
A 10-week Microsoft 365 campaign used token replay, AiTM relays, rogue Entra devices, MFA tampering, and hidden inbox rules to compromise business email accounts.
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
AWS says attacks on PHP2Shell began before disclosure, and Cloudflare reported millions of exploit attempts against the vulnerability.
-
GitLab warns of new max severity code execution vulnerability
GitLab has released patches for a maximum-severity regular expression compiler flaw that could allow remote attackers to execute arbitrary code on vulnerable servers.
-
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
333 Tor exit nodes were hijacked for three days to intercept SSH traffic and retrieve plaintext email.
-
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft reports that a ConnectWise breach enabled Chinese spies to access 2,250 cloud tenants, with privileged access gained in some environments within three hours.
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Railway reported possible unauthorized access to customer environment variables, with some decrypted values exposed, affecting a subset of users.
-
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A vulnerability in OpenCode allowed malicious MCP servers to execute code on Windows or WSL during sign-in, fixed in version 1.18.33.
-
Encryption isn’t enough to protect data wherever it goes
An opinion piece argues that pseudonymization may reduce the value of stolen data when encryption cannot protect information in use.
-
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
Auditors and IT staff at a pharmacy chain argued over using the word 'password' as a Cisco firewall password, citing misaligned incentives.
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
Researchers reported a Go-based backdoor using the Yggdrasil mesh network to conceal command-and-control traffic during attacks against a Ukrainian grain firm.
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM said attackers compromised its release pipeline and pushed a malicious Python package and Docker image containing a credential stealer and backdoor.
-
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Authorities disrupted nearly 11,000 cybercrime networks and arrested over 1,400 people in Operation Serengeti III targeting business email compromise, ransomware, and online scams.
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released updates for versions 22.x, 24.x, and 26.x fixing ten flaws, including a Brotli decoder bug that could enable remote code execution.
-
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
-
Certification authority eMudhra defends its laughably weak private keys
eMudhra says it passed audits and made a minor error after reports of weak private keys.
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon Threat Intelligence reported an attempted exploitation of newly disclosed PHP2Shell vulnerabilities four days before public disclosure, amid broader exploitation after patches.
-
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
APT41 reportedly revived the BlackLotus bootkit as a new UEFI bootkit, BlackX, exploiting CVE-2022-21894 against diplomatic organizations in Central Asia.
-
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
A NoMachine nxwebrunner heap-based buffer overflow, CVE-2026-114549, enables unauthenticated remote code execution and is rated CVSS 9.8.
-
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
A vulnerability in NVIDIA Megatron Bridge YAML parsing can allow remote code execution when users open malicious files or visit malicious pages.
-
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
Cisco Snort has a stack-based buffer overflow in OLE VBA decompression that can allow unauthenticated remote code execution.
-
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
OpenSSL CMP has a remote information disclosure vulnerability, tracked as CVE-2026-63073, requiring no authentication.
-
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
OpenSSL contains a vulnerability in CMS AuthEnvelopedData integrity check validation that could allow tampering by network-adjacent attackers.
-
ZDI-CAN-36560: Apple (CVSS 8.8)
A CVSS 8.8 Apple vulnerability reported through a coordinated disclosure process is pending public disclosure after a fix period.
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft said a China-aligned actor used the ARTEX AI framework in a supply chain attack against ConnectWise Cloud Backup.