Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
PHP2Shell Risk Assessment and Response: Find, Contain, Patch
A source-grounded guide to finding PHP deployments, assessing PHP2Shell risk, and prioritizing verified remediation without assuming every system is vulnerable.
PHP’s New RCE Risk Hinges on a Rare Session Configuration
CVE-2026-115560 affects a narrow combination of PHP session settings. Here’s how to check exposure, apply the temporary mitigation, and distinguish it from PHP2Shell.
PHP2Shell Attacks Began Four Days Before Security Patches
Amazon observed PHP2Shell targeting four days before patches. See what the timeline means for AI cybersecurity threats, exposure reviews, and incident response.
When Vulnerability Became the Word: A Better Way to Read Cyber Risk
AI-assisted discovery is changing the volume and speed of vulnerability reporting. Learn why threats, vulnerabilities, and assets must be assessed together—and why remediation and resilience matter more than raw counts.
PHP2Shell Disclosure Leak Triggers Emergency Patching
A leaked disclosure accelerated emergency patches for two critical PHP vulnerabilities in 2026. Here’s what operators should know about exposure and response.
PHP2Shell: prioritize the runtime update, not a workaround
Two critical PHP flaws can enable unauthenticated remote code execution. What the emergency releases fix, and what operators should do while patching.
AI cybersecurity threats: How ClickFix turns AI tool searches into malware routes
ClickFix attackers exploit fake AI installers, poisoned search results and trusted chatbot experiences. Learn how the campaigns work and how to reduce risk.
eMudhra’s Weak CA Keys: What Security Teams Need to Check
Eight eMudhra intermediate certificates were revoked after researchers demonstrated access to their weak private keys. What browser blocks, software fixes, and chain-level checks do—and do not—tell you.
PHP Schedules Emergency Security Updates for October 21
PHP plans emergency security updates on October 21, 2026, for two vulnerabilities. Here is what PHP has confirmed and how administrators can prepare.
eMudhra Certificate-Key Compromise: What Trust Stores Changed
A focused account of the reported eMudhra certificate-key compromise, platform trust responses, and what remains unknown.
F5 NGINX Security Updates: CVE Triage and Configuration Checks
Triage F5’s out-of-band NGINX security updates by product, version, and vulnerable configuration, then apply fixes and verify mitigations.
Copyright Takedown Reports as Clues to Possible Website Compromises
Copyright takedown data can help investigators identify suspicious activity on institutional websites, but it is a lead to verify—not proof of compromise.