// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Analysis of the LiteLLM 1.107.0 supply chain compromise describes credential theft through Python startup hooks and remote code loading.
-
Metasploit Wrap Up: Langflow, MongoDB, and More
Metasploit adds modules for Langflow authentication bypass and remote code execution flaws, along with other targets such as MongoDB.
-
Infostealer riding the AI Train
An infostealer targets browser credentials, cryptocurrency wallets, AI applications, development tools, cloud credentials, and local development files.
-
Compromised TLS Certificates
A certificate authority disclosed eight TLS certificates with private keys containing only 3 to 8 bits of entropy, far below the expected 384 bits.
-
ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context
The report discusses using code-to-cloud context to prioritize exploitable application security risks across code, infrastructure, and runtime.
-
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
PHP developers released fixes for two critical vulnerabilities, and attacks are continuing, though no confirmed compromises have been reported so far.
# Yesterday
-
CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
A missing authentication flaw in Splunk Enterprise's Patroni REST API could let unauthenticated network users execute operating-system commands.
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP
PHP2Shell exposure may affect bundled runtimes, containers, and hosted applications beyond direct PHP usage, requiring validation of exploitability.
-
I had plans for that second
The post discusses leap second abolition and critical vulnerabilities in PHP.
-
EMudhra Intermediate CA Certificates Compromised
Eight eMudhra intermediate CA private keys were compromised, creating risk of unauthorized TLS certificate issuance and man-in-the-middle interception.
-
The Current Landscape of OAuth Attacks
A report outlines current OAuth attack techniques and mitigation measures for organizations using authentication protocols.
-
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
A report examined three phishing kits that provide tools for less experienced attackers to steal authentication tokens and run credential-harvesting campaigns.
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers released fixes for two critical vulnerabilities enabling unauthenticated remote code execution in several supported versions.
-
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
A threat actor linked to Storm-0940 is using the ARTEX AI agent to target software vendors and attack Okta, Entra, and Cognito identity services.
-
Localizing compliance at scale: achieving South Korea’s ISMS certification
A South Korean ISMS certification was achieved after an audit of 80 controls, including localized consent flows and edge sign-up adaptations.
-
How do you verify AI coding agent output from any tool, not just one?
A guide describes verifying AI coding agent output using deterministic analysis, CI quality gates, and SonarQube MCP Server.
-
SonarQube container scanning is now in open beta
SonarQube has introduced an open beta feature for scanning container images to detect vulnerabilities and malicious packages as part of its Advanced Security offering.
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
A 10-week Microsoft 365 campaign used token replay, AiTM relays, rogue Entra devices, MFA tampering, and hidden inbox rules to compromise business email accounts.
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
Researchers reported a Go-based backdoor using the Yggdrasil mesh network to conceal command-and-control traffic during attacks against a Ukrainian grain firm.
-
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
APT41 reportedly revived the BlackLotus bootkit as a new UEFI bootkit, BlackX, exploiting CVE-2022-21894 against diplomatic organizations in Central Asia.
-
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two PHP vulnerabilities affecting WordPress sites can allow unauthenticated code execution.
# 21 Oct
-
Compromised eMudhra intermediate certificates
Eight intermediate certificates belonging to certificate authority eMudhra have been compromised.
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used AI to accelerate a ConnectWise supply chain compromise and abuse application credentials in Microsoft 365 environments.
-
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
PHP has released security updates addressing two critical vulnerabilities that may allow unauthenticated remote code execution.
-
Audit-Ready Isn’t Attack-Ready.
Three financial and insurance organizations used penetration testing and continuous exposure management to identify attack paths that audits may not reveal.
-
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, a scripting language used for web servers and CMS systems.
-
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
The PHP project released security updates for two critical unauthenticated remote code execution flaws affecting memory handling and request state.
-
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core may affect PHP-based applications and services.
-
CVE-2026-109618 / CVE-2026-109619 | What is Known
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution and are addressed in October 2026 security updates.