Researchers have confirmed the first successful real-world exploitation of PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Perplexity's Adel Karimi documented honeypot evidence showing confirmed RCE with memory disclosure against an Apache mod_php server running PHP 8.4.26, a finding corroborated by Expel's Marcus Hutchins. The PHP security team patched the flaws on October 21, after earlier leaks and unconfirmed exploitation attempts detected by several security firms.
bleepingcomputer.com
· 2026-10-26
Security researchers disclosed a flaw in Brotli decoder versions 1.0.3 through 1.2.0 that lets maliciously crafted compressed data trigger an out-of-bounds write, potentially causing crashes, memory leaks, or remote code execution. The bug, rated 9.2 Critical by GitHub, affects any software built on Google's C decoder, including Node.js's built-in fetch and zlib bindings, Python's requests and aiohttp libraries, and frameworks like Express and body-parser that decompress Brotli-encoded data.
broccoli2shell.com
· 2026-10-24
Researchers at Eye Security found that Time4Popcorn, a Popcorn Time fork, used an insecure HTTP updater pointing to an abandoned domain that accepted unsigned executables, letting anyone controlling the domain run code as SYSTEM or root. The firm registered the domain and 14 related ones, observed roughly 3 million Windows and 350,000 macOS connections, and between November 2025 and March 2026 pushed remediation code to disable the vulnerable updater, collecting no host data in the process.
bleepingcomputer.com
· 2026-10-23
The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.
bleepingcomputer.com
· 2026-10-23
Hewlett Packard Enterprise issued patches addressing 72 vulnerabilities in ArubaOS, the software running Aruba Networking's mobility conductors, access points, controllers and gateways. Eight of the flaws, spanning AOS-8 and AOS-10, carry maximum severity ratings and allow unauthenticated remote attackers to bypass authentication or execute code without user interaction.
bleepingcomputer.com
· 2026-10-23
A Hacker News user has publicly apologized for prematurely disclosing details of two upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before the coordinated disclosure embargo lifted. The poster says they were told by a contact that no embargo existed and only meant to warn fellow PHP users who build from source about the urgency of upcoming patches.
news.ycombinator.com
· 2026-10-22
Microsoft released its largest-ever Patch Tuesday update in October, addressing a record number of vulnerabilities across its product line. The update includes fixes for security bypasses and unauthenticated remote code execution flaws, some of which are reported as actively exploited zero-days.
darkreading.com
· 2026-10-13
A vulnerability has been identified in middleware used by SWIFT banking systems and government networks that could allow attackers to achieve remote code execution. The flaw reportedly affects environments relying on hardware-based multi-factor authentication, and administrators are being urged to apply patches immediately.
darkreading.com
· 2026-10-02
CISA has issued an advisory for CVE-2026-84411, a critical integer underflow bug in MikroTik RouterOS's web-management HTTP handling that can be triggered before authentication. A single crafted request could let an unauthenticated attacker execute code as root or crash the device. Versions below 7.24 are affected, and the agency says the vendor advises upgrading to 7.23 or later, though it hasn't published its own advisory yet.
bleepingcomputer.com
· 2026-09-30
Security firm Patchstack says threat actors began exploiting a critical WordPress path traversal flaw, CVE-2026-87902, to write files that execute shell commands, after initial reconnaissance traffic surged tenfold. The bug, discovered by researcher Robert Ressl and rated 9.2/10 in severity, allows unauthenticated attackers to trick get_page_template() into loading arbitrary local PHP files under certain theme and server configurations. WordPress patched the issue in version 7.1.2 and backported fixes to branches as old as 4.7.
bleepingcomputer.com
· 2026-09-23
Security researchers at Hacktron identified a class of vulnerabilities, dubbed HEIF Heist, affecting native decoders like libheif and libde265 that process HEIF, HEIC, and AVIF image formats. These libraries are widely bundled inside popular tools such as ImageMagick, libvips, and Sharp, meaning the flaw can reach production systems through indirect dependencies rather than direct use.
heif-heist.com
· 2026-09-18
Researchers unveiled WeWorm, a proof-of-concept worm that spreads through WeChat calls without user interaction, affecting both iOS and Android devices. The demo involved three phones where an attacker could hijack accounts and propagate the infection by simply calling victims, who need not answer or even interact with their phones.
calif.io
· 2026-09-12
GoKawiil