Organisations and businesses are urgently updating systems after critical vulnerabilities were discovered in the PHP programming language. The flaws, dubbed php2shell, allow unauthenticated attackers to remotely execute code on affected servers. The UK government took 32 services offline as a precaution, while Cloudflare reported millions of exploitation attempts. Cybersecurity experts warn that the full impact…
Security researchers at Calif discovered two critical bugs in the PHP programming language, designated as CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The PHP Foundation released patches on Wednesday after a coordinated disclosure period, prompting millions of systems to update to prevent unauthorized access. Amazon detected exploitation attempts a week before the official…
CISA offers free vulnerability and web application scanning to eligible public and private organizations. The service monitors internet-accessible assets and provides weekly reports with urgent alerts for critical findings. Web application scanning includes monthly reports on vulnerabilities and misconfigurations. Eligible entities can enroll by sending an email to a designated CISA address. CISA states that…
> A critical flaw in the code behind most websites and a breach at one of the nation’s largest lab companies landed in the same week. Here’s what physicians should check, ask and tell patients now. Two cybersecurity stories broke this week, and both reach into the independent physician practice.
The U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including a set of flaws in Plex Media Server known as Plex2Shell. Security researchers reported that threat actors are chaining these issues to deploy cryptocurrency miners and proxy malware without authentication. CISA also flagged a DLL sideloading bug in…
The Cybersecurity and Infrastructure Security Agency released six new advisories on 10/20/2026. These documents address current security issues, vulnerabilities, and exploits affecting industrial control systems. The advisories cover products from HMS Networks, WAGO, Moxa, and Hitachi Energy. CISA encourages users and administrators to review the technical details and recommended mitigations provided in the releases. Read…
Two U.S. senators stated that a new report on spyware delivery via targeted ads highlights the need for stronger industry security. The Citizen Lab at the University of Toronto and Confiant published findings on a technique called AdFection that uses ads to install spyware. Senators Ron Wyden and Cory Booker argued that the report proves…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The specific flaw is CVE-2026-114625, an SQL injection vulnerability in Arista VeloCloud Orchestrator. This addition aligns with Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities listed in…
Cybersecurity policy currently focuses on securing systems, but data remains vulnerable when it is processed or moved. The article argues that encryption fails to protect readable data during active use, leaving sensitive information exposed to theft. A proposed solution called vaultless, keyless pseudonymization replaces sensitive values with realistic substitutes to reduce their value if stolen….
A vulnerability in several versions of Siemens SIMATIC WinCC allows authenticated users with database access to execute commands on the host system. The flaw, tracked as CVE-2026-59241, stems from insufficient restriction of permissions assigned to a database role. Siemens has released updates for WinCC V8.0 and V8.1, but no fix is currently available for V7.5….