SecurityWeek (1 hour ago)
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.
Read the full story on SecurityWeek.
Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution.
The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
A threat actor breached TeamUpdraft’s website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.
Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.
The company has restored many websites and apps in Europe and expects e-commerce brands in the US to be restored in days.
72 active sources
27 Turkish · 45 English
All sources
