The Hacker News (2 hours ago)
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution.
Read the full story on The Hacker News.
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.
The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
A threat actor breached TeamUpdraft’s website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.
The vulnerabilities were not to be disclosed to anyone outside the White House, CISA was told.
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google’s Chrome Root Program confirms on October 20.
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.
Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.
72 active sources
27 Turkish · 45 English
All sources
