All news

PHP shares mitigations for a new unpatched RCE in non-default configurations.

Amazon says PHP2Shell exploitation began four days before patches.

A malicious AGENTS.md file in a Downloads folder made a coding agent install a rogue npm package. Researchers reproduced it against OpenAI Codex and showed a related trick against Claude.

Attackers compromised LiteLLM release pipeline and shipped PyPI packages and Docker images with credential stealers.

Researchers remotely disabled a vulnerable updater in an abandoned Popcorn Time fork that exposed millions of devices to RCE.

Sponsored piece on AI agent access control and prompt injection.

Railway tells developers to rotate secrets after suspicious access to systems storing customer environment variables.

HPE patches 72 ArubaOS flaws, eight max severity RCE or auth bypass.

Arista patches an exploited zero-day in VeloCloud Orchestrator.