Exploited bugs, new critical vulnerabilities, and what defenders should check.
ExploitedCVE-2026-109618CVSS 9.22 min read
Honeypots recorded a confirmed remote code execution against an Apache mod_php install running PHP 8.4.26, according to a Perplexity researcher whose findings a second researcher corroborated.
ExploitedCVE-2026-109618CVSS 9.22 min read
A researcher says attackers ran shell commands on honeypots running PHP 8.4.26, the first reported confirmation of code execution from the PHP2Shell bugs.
ExploitedCVE-2026-111497CVSS 9.22 min read
A buffer overflow in Google's Brotli C decoder can corrupt memory and expose data. Node.js, .NET and Python packages have shipped fixes, and proof-of-concept exploits are public.
ExploitedCVE-2026-109618CVSS 9.21 min read
CISA added two critical PHP vulnerabilities tracked as PHP2Shell to its Known Exploited Vulnerabilities Catalog and told federal civilian agencies to patch by Thursday.
ExploitedCVE-2026-96652CVSS 5.32 min read
The agency's Tuesday update covers four Plex Media Server vulnerabilities grouped as Plex2Shell, alongside Siemens and SiteGuard flaws, and sets a federal remediation deadline.
Brief2 min read
Google promoted Chrome 156 to the stable channel with patches for 353 vulnerabilities, including six rated critical, and said none were known to be exploited in the wild.
Brief2 min read
Chrome now flags lower-confidence "suspicious" sites, scrubs copied commands for analysis, and asks before connecting over unencrypted HTTP.
CVE-2026-76466CVSS 9.82 min read
Cisco's October round covers Expressway Series, IOS XR, Snort 3 and Unified Communications, plus a local privilege escalation in Secure Client's Secure Firewall Posture module.
CVE-2026-76299CVSS 9.91 min read
Splunk fixed 16 CVEs in Enterprise and 15 in SOAR, including critical access control and data exposure bugs, while SolarWinds patched a high-severity authorization flaw in Observability.
ExploitedCVE-2026-21589CVSS 9.32 min read
SecurityWeek counted 162 high-severity and 14 critical-severity entries across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management.
Brief1 min read
V12 said the default client in the x402 SDKs set no spending limit until releases on August 18 added one, so an agent that auto-signed payments could approve its full balance of a supported token.
Brief1 min read
The Internet Storm Center returned to Infocon Green after raising its alert level for a PHP vulnerability, saying patches are out but working exploit code may follow.
