56 results for “PHP”

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Rekt's "News or Hype?" compares four October 2026 AI headlines with their sources. These are Justin Drake's "bunker mode" ECDSA warning, Anthropic's Claude tracing NIST curve seeds to lrand48, OpenAI's agent spending Sepolia ETH from a default-mnemonic account, and Wiz's "AI uncovers" PHP RCE claim of 70% reach. It ends with four questions for checking claims.

rekt.newsarticleAdded 30 Oct 2026🧠 AI

Rekt News piece tracing three AI-security headlines back to their sources. It covers Justin Drake's October 2026 "bunker mode" warning about AI breaking ECDSA, OpenAI's report of a model spending Sepolia test ETH from a default developer mnemonic, and Wiz's "70% of the Internet" claim for PHP CVE-2026-109618 and CVE-2026-109619. It closes with four questions for checking a claim.

rekt.newsarticleAdded 29 Oct 2026🛡️ Security

Explainer on "shell" vulnerabilities, the -Shell naming for RCE flaws that began with Log4Shell (CVE-2021-44228). It compares memory-corruption bugs (PHP2Shell, CVE-2026-109618 and CVE-2026-109619; Node2Shell, CVE-2026-111497, in the Brotli decoder) with design-flaw bugs (Log4Shell, React2Shell, CVE-2025-55182). It covers shared traits, exposure through inherited components, and Brotli patch status across runtimes and distributions.

aikido.devarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

blog.talosintelligence.comarticlePublished and added 29 Oct 2026🛡️ Security

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

SecurityWeek roundup of patches from Adobe, Veeam and Juniper Networks covering over three dozen vulnerabilities. Adobe fixed 12 flaws (eight critical in Campaign Classic), Veeam fixed nine (including a cross-tenant RCE in Backup for Microsoft 365), and Juniper fixed 18 in Session Smart Router and Conductor. None were reported exploited. Juniper said CVE-2026-109618 (PHP2Shell) affects Junos OS but is not exploitable there.

securityweek.comarticlePublished and added 29 Oct 2026🛡️ Security

Aikido's analysis of the PHP2Shell disclosures (CVE-2026-109618 and CVE-2026-109619), published October 2026. It covers the timeline: the CVE IDs leaked on 20 October, PHP moved its release to 21 October, and Amazon reports exploitation attempts from 17 October. It cites Censys data (32.5 million services still affected on 27 October) and argues that AI-driven discovery and exploit building call for shorter embargoes and faster patching.

aikido.devarticleAdded 28 Oct 2026, published 29 Oct 2026🛡️ Security

A China-linked actor chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root firewalls and drop PHP webshells, per Dream. Using FOFA, the actor narrowed 19,000 firewalls to 240 targets and rooted 24 on 23-24 October. On two US government-affiliated devices it used a reverse SSH tunnel, hit the firewall management server, and attempted LDAP and Active Directory abuse.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

Akamai SIG argues that vendors and researchers broke embargo norms during the October 2026 PHP2Shell leak, when the PHP fix shipped a day early on 21 October. It explains the four TLP 2.0 labels, tabulates past embargo breaks (Heartbleed, a collapsed six-month kernel-era embargo, the Alibaba Cloud and MIIT case), and lists seven practices, such as no proofs of concept or CVE numbers before the fix.

akamai.comarticleAdded 30 Oct 2026, published 28 Oct 2026🛡️ Security

Wiz Research follow-up on PHP2Shell (CVE-2026-109618, CVE-2026-109619) after the 21 October 2026 disclosure. Honeypot data shows two variants of an open source exploit kit, one stopped by post_max_size and the other by failed memory leaks and worker pinning, plus PHP2Shell-branded tools that rely on session poisoning and LFI. Daily exposed vulnerable machines fell about 67%.

wiz.ioarticlePublished and added 27 Oct 2026🛡️ Security

The Cloudflare PHP Capture the Flag challenge is a HackerOne bug bounty CTF. Researchers must bypass Cloudflare WAF rules protecting CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) on stock PHP 8.5.11 with Apache mod_php in a Cloudflare Container, get RCE, and read /flag. The post lists scope (POST to /php/* only), report requirements and duplicate rules, which count only materially distinct WAF bypasses.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

aikido.devarticlePublished and added 26 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical unauthenticated RCE flaws in the PHP engine, patched on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Industrial vendors including Schneider Electric, Siemens, ABB, B&R, Johnson Controls, Belden, HMS Networks and Wibu-Systems have confirmed affected OT products, with fixed versions or mitigations listed. Rockwell Automation and Hitachi Energy were still assessing, and Moxa reported no impact.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) reached working shells on 24 October 2026, when Perplexity researcher Adel Karimi's honeypots (PHP 8.4.26, Apache mod_php, single worker) logged 35 shells across three servers. Attackers used a four-stage HTTP chain: memory exhaustion, memory leak, then shell command execution, matching a public PoC. No second-stage payload was seen, and CISA had not added the flaws to KEV as of 26 October.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

Code security for new coders is a Datadog Security Labs primer for vibe coders on first-party versus third-party code, hardcoded secrets and software supply chain risk (vulnerable and malicious dependencies). It lists security questions to put to a coding agent before and after code is written. It also defines SCA, SAST, IAST, DAST, IaC scanning and secret scanning, and cites the PHP2Shell vulnerabilities.

securitylabs.datadoghq.comarticleAdded 29 Oct 2026, published 26 Oct 2026🛡️ Security

Galaxy Research's weekly brief includes a section on PHP2Shell, two decade-old PHP remote code execution bugs affecting versions back to 5.4, patched in an emergency release. It reports an Amazon honeypot exploit attempt four days before disclosure, thousands of attempts in the 10 hours before the patch per Cloudflare's Matthew Prince, and NSA and FBI offline advice. The author argues the bugs were found with GPT-5.6 Sol and that defence must become agentic. It also lists the week's other incidents, including a CVSS 10.0 GitLab bug and eMudhra's guessable private keys.

galaxy.comarticleAdded 24 Oct 2026🛡️ Security

Endor Labs roundup of the 20 to 21 October 2026 patch wave: eMudhra certificate authority keys that anyone can recover, PHP2Shell (CVE-2026-109618, CVE-2026-109619), Node2Shell (CVE-2026-111497) and malware in LiteLLM 1.107.0. It lists fixed versions (PHP 8.2.35 to 8.5.12, Node.js 22.23.4, 24.22.1, 26.12.1, LiteLLM back to 1.106.2) and explains why many separate trust-store copies each need updating. It closes with advice on triage, remediation and SBOM/VEX reporting.

endorlabs.comarticlePublished and added 24 Oct 2026🛡️ Security

PHP2Shell is the name for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4 9.2), in the PHP engine back to version 5.4. The post covers the leaked October 2026 embargo, AI-assisted exploit building by Calif and others, patch availability by PHP version, and a 72-hour and quarterly response plan covering inventory, patching, secret rotation and edge virtual patching. It ends with a short Orca product section.

orca.securityarticlePublished and added 23 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) are unauthenticated RCE bugs in PHP, patched on 21 October 2026. Sophos, Arctic Wolf and Hunt.io tie exploitation attempts to the Potassium Mirai variant, and VulnCheck built an ASLR-bypassing exploit. SOCRadar and Hunt.io found an exposed attacker server, and Qualys data shows about 110 million instances on end-of-life PHP. No confirmed compromise exists.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

AINews issue for 21-22 October 2026, built from 12 subreddits and 544 Twitter accounts. It leads with "Black October", a 48-hour run of AI-found vulnerability disclosures (PHP2Shell, a GitLab CVSS 10 flaw, a LiteLLM 1.107.0 password stealer, eMudhra CA keys). It also covers MiniMax M3.1 Flash, Carbon-X and Flint releases, Artificial Analysis coding-agent and CritPt v2 results, and a METR/Redwood audit of OpenAI monitoring.

latent.spacearticlePublished and added 23 Oct 2026🧠 AI

Quest Diagnostics disclosed in a regulatory filing on Thursday that an unauthorized party accessed its Quanum Lab Services Manager, a platform where clients order tests and look up results. The company found the breach on Wednesday and notified federal law enforcement. The number of patients and records affected is unknown, and Quest said the breach is not related to the PHP vulnerabilities disclosed that week.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

Horizon3.ai post on assessing exposure to PHP2Shell (CVE-2026-109618, CVE-2026-109619), two memory-handling flaws in PHP. It says affected PHP may be bundled in third-party products, containers or managed hosting, and that finding it shows a remediation need, not proven exploitability. It lists questions to ask hosting providers and says Horizon3.ai has validated exploitation under specific preconditions that are still being characterized.

horizon3.aiarticleAdded 29 Oct 2026, published 22 Oct 2026🛡️ Security

tl;dr sec #351 is a weekly security newsletter. Clint Gibler describes working with OpenAI, Calif, Wiz and the PHP maintainers on the PHP2Shell unauthenticated RCE disclosure, which affects 13 years of PHP. It also covers Datadog's pathrunner AWS IAM escalation framework, Trail of Bits' patching-bugs and regression-hunt Codex plugins, XBOW finding de-duplication, backdoored open-weight models, and CREBench.

tldrsec.comarticleAdded 30 Oct 2026, published 22 Oct 2026🛡️ Security

SecurityWeek roundup of responses to PHP2Shell, two critical unauthenticated RCE flaws (CVE-2026-109618, CVE-2026-109619) fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the exploitation timeline (first attempt 17 October), vendor exposure checks, Red Hat's lower 8.1 score against NVD's 9.8, detections from Cisco Talos, CrowdStrike and Corelight, and government alerts.

securityweek.comarticlePublished and added 22 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution flaws. Amazon saw the first exploitation on 17 October 2026, four days before patches on 21 October, and Cloudflare logged millions of attempts after disclosure. Censys, VulnCheck and VirusTotal counted over 1 million unpatched PHP hosts, and CISA urged updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

securityweek.comarticlePublished and added 22 Oct 2026🛡️ Security

AINews issue for 20-21 October 2026. The top story covers PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two PHP-engine memory-corruption bugs found separately by Calif researchers using GPT-5.6 Sol under OpenAI's Patch the Planet and by Wiz, followed by two months of coordinated remediation. It also covers the Flint coding MoE, DeepSeek's DeepInfer, TorchTPU, eval critiques and agent product launches. The text is truncated.

latent.spacearticlePublished and added 22 Oct 2026🧠 AI

This AINews issue (20 to 21 October 2026) leads with PHP2Shell, two PHP-engine memory-corruption bugs (CVE-2026-109618 and CVE-2026-109619). Calif researchers found them with GPT-5.6 Sol under OpenAI's Patch the Planet, and Wiz reportedly found them independently with Gemini 4 Argon. It reconstructs the two-month coordinated response, Cloudflare WAF stopgaps and NSA guidance, and the dispute over vetted researcher access to models. Only the first 40,000 of 114,281 characters were reviewed.

latent.spacearticleAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

AINews issue of 20-21 October 2026 whose top story reconstructs PHP2Shell (CVE-2026-109618, CVE-2026-109619), two PHP-engine memory-corruption bugs with reported pre-auth RCE against WordPress, Drupal and Joomla. It covers the two-month coordinated disclosure, independent discovery by Calif/OpenAI (GPT-5.6 Sol) and Wiz, Cloudflare WAF stopgaps and NSA guidance. It flags missing primary sources: fixed versions, CVSS and leak details.

latent.spacearticlePublished and added 22 Oct 2026🛡️ Security

AINews issue of 20-21 October 2026 whose top story reconstructs PHP2Shell, two PHP-engine memory-corruption flaws (CVE-2026-109618 and CVE-2026-109619) with reported pre-auth RCE against WordPress, Drupal and Joomla. It covers the two-month coordinated response, separate discovery by Calif/OpenAI (GPT-5.6 Sol) and Wiz (Gemini 4 Argon), Cloudflare's WAF stopgap and NSA guidance. It lists open gaps: fixed versions, leak details, exploitation versus scanning.

latent.spacearticleAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security

VirusTotal sizes the internet-facing PHP footprint around CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, session.upload_progress) using Internet Scanning. About 5.1M IPs run PHP, roughly 4 in 5 hide their version, and ~758K disclose an end-of-life branch. It gives queries that use the SSH banner to match leaked LiteSpeed lsphp 8.2.34 builds, plus mitigations.

blog.virustotal.comarticleAdded 22 Oct 2026🛡️ Security

AWS Security Blog guide to mitigating the PHP2Shell unauthenticated RCE flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) with AWS WAFv2 rules. It covers rules for the PHP_SESSION_UPLOAD_PROGRESS trigger, blocking multipart/form-data, body size caps and rate limits, plus body inspection limits. It lists PHP fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) and server settings, and stresses WAF only reduces exposure.

aws.amazon.comarticlePublished and added 22 Oct 2026🛡️ Security

Blog post from 21 October 2026 arguing that the recent PHP vulnerability (UAF chaining, tracked as PHP2Shell) has no easy working exploit, unlike Log4Shell, Heartbleed, Shellshock or the Rails YAML bug. The author says the many GitHub PoCs fail against vanilla PHP in Docker, or depend on a local-file-inclusion precondition or on an LLM modifying the target server. It also reflects on LLM-driven uniform judgement.

eliastaylor.comarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

An opinion post from 21 October 2026 arguing that a widely feared PHP vulnerability has no easy exploit. The author says the many GitHub "PoC" repositories fail against a vanilla PHP instance in Docker. They claim LLM agents produced them by depending on a local-file-inclusion flaw or by modifying the server to be vulnerable. The author also argues that LLM defaults make many people's judgements identical.

eliastaylor.comarticleAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

Amazon Threat Intelligence reports PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) seen in MadPot honeypot telemetry on 17 October 2026, four days before the 21 October disclosure, from anonymization-network IPs. Multiple actors and PoCs appeared within hours of the patch. It recommends upgrading PHP, hunting for PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, and investigating from the earliest exploitation date, with patch SLAs measured in hours.

aws.amazon.comarticlePublished and added 21 Oct 2026🛡️ Security

Trail of Bits announces two open-source plugins, patching-bugs and regression-hunt, for AI coding agents that speed up bug patching. They come from four months of Patch the Planet work with open-source projects, which found that repo-level documentation, skills and plugins give agents the maintainer context on what counts as a bug, how a fix should look and what must not break. The post cites the October 2026 PHP incident: a patch touching 402 files, and exploitation within 17 hours of leaked details.

x.comarticleAdded 23 Oct 2026, published 21 Oct 2026🧠 AI

The PHP Foundation's October 21, 2026 postmortem says Chainguard broke an embargo by publishing patched PHP container images over six hours before the coordinated release of fixes for CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws. The piece covers the leaked CVE IDs, Calif's accidentally published exploit video, Chainguard CEO Dan Lorenc's defence citing exploitation in the wild, and the 2024 origin of the memory management bug.

socket.devarticlePublished and added 21 Oct 2026🛡️ Security

Simon Willison's link post on the 21 October 2026 PHP security release, which fixes two remote code execution flaws across the PHP 8.x line. The CVE IDs leaked on 20 October with a wrong CVSS of 10.0 (actual 9.2), and Calif accidentally published a proof-of-concept video. It also gives Wiz Research's timeline, with unauthenticated RCE confirmed against Drupal and WordPress in August 2026.

simonwillison.netarticlePublished and added 21 Oct 2026🛡️ Security

Report on two critical PHP remote code execution vulnerabilities, rated 9.2 out of 10, disclosed on 20 October 2026 and patched on 21 October. Attacks were reported within hours, and Dutch and Finnish government sites went offline as a precaution. The EU CERT and the UK NCSC advise patching or isolating systems. Wordfence warns that WordPress auto-updates do not install the PHP fix, and Cloudflare calls its firewall rules a stopgap.

en.cryptonomist.charticlePublished and added 21 Oct 2026🛡️ Security

PHP2Shell is a pair of unauthenticated remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, found by Calif using OpenAI's GPT-5.6 Sol during an OpenAI-funded audit. Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4-8.1 rolling out, while PHP 7 and 5 sites stay unpatched. Wiz confirmed the flaws; Cloudflare applied a stopgap and Finnish and Dutch government sites went offline.

protos.comarticlePublished and added 21 Oct 2026🛡️ Security

PHP2Shell is a pair of critical PHP core flaws, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), both CVSS 9.2 and giving unauthenticated RCE, confirmed on Apache with mod_php. Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4 to 8.1. Exploitation attempts were reported by watchTowr, Hadrian, Patchstack, Cloudflare and Vega after a leak moved disclosure up from 22 October 2026 to one day earlier.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

The PHP Foundation explains the 21 October 2026 release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical unauthenticated RCE flaws in memory management and error handling, including an OOM problem behind CVE-2026-109618. It covers the 2024 Quarkslab audit, the stalled fix, the August 2026 reports from Calif, OpenAI and Wiz, and the embargo leaks (CVE IDs, a Calif video, Chainguard images). It also lists new security team structure and AI-assisted triage.

thephp.foundationarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Decrypt reports on CVE-2026-109618 and CVE-2026-109619, two PHP flaws rated CVSSv4 9.2 that allow unauthenticated remote code execution. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October 2026 after an early leak and Cloudflare-observed attacks. The article covers the memory-handling root causes, mod_php and upload-progress exposure, government site shutdowns, affected version range (PHP 5.4 and later per Sansec), and patch guidance.

decrypt.coarticlePublished and added 21 Oct 2026🛡️ Security

PHP2Shell is a pair of memory-safety flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Unauthenticated requests can reach code execution, most readily through Apache mod_php, and Cloudflare reports active attack traffic. The post covers W3Techs data showing about 48.5% of PHP sites on end-of-life branches, the leak timeline, and the need to patch the runtime itself.

socket.devarticlePublished and added 21 Oct 2026🛡️ Security

Cloudflare describes its WAF protections for php2shell (CVE-2026-109618 and CVE-2026-109619), two PHP runtime memory-handling flaws affecting PHP 5.4 and later that can cause denial of service, remote code execution and data exposure. Rules shipped 21 October 2026, about 9 hours before disclosure, using a new "full transaction detection" that matches request and origin response together. It lists ruleset IDs and says patching PHP is still required.

blog.cloudflare.comarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Cloudflare announces full transaction detection and response-phase rules for its WAF. Detections evaluate an HTTP request together with the origin's response, so exploitation can be confirmed (for example, path traversal returning a config file) and the response replaced with a 403 block page. Covers managed and custom rules, the limit of three custom response rules, no response-body matching yet, and a first managed rule for php2shell. Available on all plans, including Free.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 21 Oct 2026🛡️ Security

PHP2Shell is the name given to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each), that could allow unauthenticated remote code execution. Details leaked before PHP's planned patch release on 21 October 2026 at 14:00 UTC. Reports say all versions from PHP 5 onward are affected and one flaw may be a use-after-free; watchTowr reproduced CVE-2026-109618, and Sansec expects mass exploitation within 15 minutes of the patch.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

OpenAI's Patch the Planet post describes the coordinated response to two critical PHP vulnerabilities. Calif found one with GPT-5.6 Sol, and Wiz independently reported both. It proposes a five-stage disclosure framework: upstream fix, advance notice to providers, government coordination, product updates and public guidance. It also lists a PHP version checker, $1 billion in subsidized Daybreak access, and open questions on disclosure windows and emergency patching.

openai.comarticlePublished and added 21 Oct 2026🛡️ Security

Rank Math PRO version 3.0.123, a WordPress SEO plugin, shipped malicious packages between 15 October 2026 20:02 UTC and 16 October 2026 07:12 UTC. The malware gives persistent backdoor access, can expose credentials and API keys, and uses .htaccess rules to run .cache files as PHP. Rank Math released clean v3.0.124 and advises restoring from backup, blocking rank1cdn[.]com, and checking SSH keys and crontabs.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

SecurityWeek reports that China-linked Armory Castle (UNC5221, Warp Panda) exploited CVE-2026-102764 (CVSS 9.3), an improper origin validation flaw in BeyondTrust Remote Support enabling file operations, as a zero-day from August 29. Mandiant/GTIG observed the Sawfly PHP webshell and Bareclaw SOCKS5 tunneler, root takeover, credential harvesting, log deletion, and abuse of the native file transfer service for exfiltration. Patch BT26-05-RS covers versions through 26.2.3; the actor's earlier edge-device zero-days (CitrixBleed, Ivanti Connect Secure, Dell RecoverPoint) are listed.

securityweek.comarticlePublished and added 16 Oct 2026🛡️ Security

Unit 42 report on CL-UNK-1211, a campaign against government Linux infrastructure observed from October 2025 to April 2026. Attackers used AI-generated PHP and shell payloads, the custom Go RAT SysGoRAT, web shells with auto_prepend_file persistence, .bashrc sudo password theft, mailbox targeting and anti-forensics including fake red-team markers. It lists TTPs, detections and IOCs including a CVE-2025-55182 scanner.

unit42.paloaltonetworks.comarticleAdded 30 Oct 2026, published 15 Oct 2026🛡️ Security

SecurityWeek reports that Patchstack has observed in-the-wild exploitation of CVE-2026-85097 (CVSS 9.8), an unauthenticated arbitrary file upload leading to code execution in the Bricksforge WordPress plugin (add-on for Bricks builder, ~6,000 sites). Versions 3.1.8.9 and earlier are affected and 3.1.8.10 fixes it. Exploitation began October 7; telemetry shows one cluster of 44 IPs sending 56 identical payloads and another of 3 IPs trying 25 PHP extension/encoding variations against the same temp file, consistent with automated exploitation over rotating proxies.

securityweek.comarticlePublished and added 12 Oct 2026🛡️ Security

Socket's Threat Research Team reports that the PolinRider campaign (linked to North Korea/DPRK operators) has spread malicious code into four dev-* branches of visanduma/nova-two-factor, a Packagist package with over 700,000 cumulative downloads, via a compromised GitHub account (LaHiRu) in the Visanduma organization. The post details the campaign's tradecraft — hiding payloads in .woff2 font files, using VS Code's "runOn": "folderOpen" task trigger, and a new technique inserting obfuscated JavaScript directly into index.php executed via PHP's shell_exec — and explains how Packagist/Go modules resolving code straight from Git repos lets planted source code reach downstream users without stolen registry credentials. It provides IOCs (package versions, wallet address, IPs, file hashes) and frames PolinRider as a slow, persistent Git-collaboration-based intrusion campaign primarily aimed at cryptocurrency theft.

socket.devarticleAdded 21 Sep 2026, published 17 Sep 2026🛡️ Security

Socket announces its PHP/Composer supply-chain security support is moving to Beta with generally available reachability analysis, which distinguishes exploitable vulnerabilities from unreachable ones in dependency trees. The post details real attacks Socket tracked moving into the PHP/Packagist ecosystem, including the Mini Shai-Hulud worm jumping from npm via a malicious Intercom PHP package, a malicious postinstall hook found across 700+ GitHub repos, a Famous Chollima-linked backdoored Laravel package, and Packagist packages disguised as Laravel utilities/CMS themes deploying RATs and trojanized jQuery.

socket.devarticlePublished and added 22 Aug 2026🛡️ Security

Aikido describes how its CC-BY-licensed Intel malware feed now powers default-on malicious-package blocking in Composer 2.10+ for Packagist, using Composer's dependency policy framework to strip flagged versions from resolution at update/require/create-project/install time. It also covers Packagist's newly mandatory stable version immutability (preventing git re-tagging attacks like the recent Laravel-Lang compromise), Private Packagist's enforcement of current Composer clients, and planned features (minimum release age, organizational ownership with mandatory MFA, staged releases), framed alongside similar moves by npm, PyPI, crates.io and RubyGems.

aikido.devarticleAdded 3 Sep 2026, published 26 Jun 2026🛡️ Security