Threat intelBrief2 min read
Push Security found registration pages promising free AI subscriptions and other rewards, then routing visitors into two phishing-as-a-service platforms that grab tokens, passwords and session cookies.
ResearchBrief2 min read
Kela says the cluster has used more than 300 fake domains, 248 of them impersonating 189 US financial institutions, and that a repeat visit gets a closed-hosting notice instead of the login page.
ResearchBrief2 min read
PortSwigger's Gareth Heyes says he tested eight popular SVG sanitizers and got past six, with one technique running JavaScript in Firefox from a harmless-looking XML body.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read
Honeypots recorded a confirmed remote code execution against an Apache mod_php install running PHP 8.4.26, according to a Perplexity researcher whose findings a second researcher corroborated.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.21 min read
CISA added two critical PHP vulnerabilities tracked as PHP2Shell to its Known Exploited Vulnerabilities Catalog and told federal civilian agencies to patch by Thursday.
VulnerabilitiesBrief1 min read
The Internet Storm Center returned to Infocon Green after raising its alert level for a PHP vulnerability, saying patches are out but working exploit code may follow.
Threat intelBrief2 min read
Semperis says the Iranian government-linked group, quiet for three months, resumed data theft in May and later hid a Tornado second-stage server on Namecheap shared hosting, its first US-based C&C since 2016.
