All news
24 articles- newsThe Register·23 Oct 20264.7New PHP2Shell exploit defeats ASLR on x86-64 servers.
- newsInfoQ·26 Oct 20264.6PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical unauthenticated remote code execution bugs; Amazon saw exploitation attempts four days before the patches.
- blogCloudflare Blog·21 Oct 20264.4Cloudflare rolled out WAF rules for the php2shell PHP RCE flaws and notes a related session upload bug, CVE-2026-115560, that affects fully patched PHP.
- newsLobsters·24 Oct 20264.4Analysis of why php2shell is not yet mass-exploited despite the panic.
- newsLobsters·24 Oct 20264.3
This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli
The node2shell Brotli bug CVE-2026-111497 also affects Python and other Brotli consumers, not just Node. - newsBleepingComputer·23 Oct 20264.3PHP shares mitigations for a new unpatched RCE in non-default configurations.
- newsBleepingComputer·22 Oct 20264.2Amazon says PHP2Shell exploitation began four days before patches.
Also in Hacker News, The Register
- newsThe Register·24 Oct 20264.1A third PHP2Shell bug was found but will not get an emergency fix.
- newsTechCrunch·24 Oct 20264.1Two dormant PHP vulnerabilities nearly broke large parts of the web this week.
- blogSimon Willison·22 Oct 20264.1PHP security release notes and plans to strengthen PHP security.
- newsThe Register·21 Oct 20264.0PHP emergency fixes for two critical bugs; unpatched sites told to go offline.
- newsInfoQ·23 Oct 20263.8Anthropic launches OSS Scanner, a free opt-in service that periodically scans critical open-source projects for vulnerabilities.
- newsLobsters·25 Oct 20263.7POSIX
wordexp(3)can run command substitution, so using it for tilde expansion is a code execution risk. - blogCloudflare Blog·19 Oct 20263.7Cloudflare argues login pages are a key attack surface after the NetScaler flaws and shows how to shield gateways beyond patching.
- newsArs Technica·21 Oct 20263.6PHP warns of two imminent emergency patches.
- newsThe Register·22 Oct 20263.5PHP2Shell took 32 UK government services offline.
- newsThe Register·22 Oct 20263.5PHP accuses Chainguard of exposing critical bugs early.
- newsBleepingComputer·24 Oct 20263.4Researchers remotely disabled a vulnerable updater in an abandoned Popcorn Time fork that exposed millions of devices to RCE.
- newsThe Register·23 Oct 20263.2Max-severity unauthenticated RCE in self-managed GitLab spans 12 years of releases.
- newsHacker News·23 Oct 20263.1Asks whether the recent wave of critical web vulnerabilities is the new normal.
- newsArs Technica·20 Oct 20263.1Plex Media Server flaws are under active exploitation.
- newsHacker News·22 Oct 20263.1Live tracker of currently exploited vulnerabilities.
- newsBleepingComputer·23 Oct 20263.0HPE patches 72 ArubaOS flaws, eight max severity RCE or auth bypass.
- newsBleepingComputer·23 Oct 20263.0Arista patches an exploited zero-day in VeloCloud Orchestrator.