Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 6:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Multiple crypto-tracing firms say notorious North Korean hackers TraderTraitor may be behind the largest digital heist in history—with billions of crypto likely gone for good.
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run
A complete API penetration test should cover discovery, authentication, authorization across every role and tenant, data exposure, injection, abuse and rate limiting, business logic, and configuration, backed by reproducible evidence and a defined retest. The checklist below is written as buyer requirements: statements a security team can check a vendor's proposal or final report against, not instructions for performing the test yourself. The post API Penetration Testing Checklist: What Enterprise Security Teams Should Require appeared first on Synack .
Information released by Distributed Denial of Secrets is the third such government data disclosure in the last month Data identifying more than 41,000 employees and contractors for the US Department of Homeland Security (DHS) was released on Wednesday in an unprecedented leak that reveals how the agency is organized. The records, which were made public by the transparency non-profit Distributed Denial of Secrets, reference operation names, surveillance programs and information on undercover initiatives. The DHS did not immediately return a message seeking comment. Continue reading...
Latest
Friday, October 30
Shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, cloned public PoCs, and a PAN-OS-focused repackaging (panos\_rce\_poc.py, prce.py) exposed at 130.94.67\[.\]235. File-level detail and hashes in the post.
On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems. Let's start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as DigiNotar , TÜRKTRUST , and TrustWave ), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost instantly by anyone from the public certificates themse
David Gibson says the problem is that details of the flaw were revealed before it was fixed, while Charles MacKinnon notes that we are at the mercy of technology we don’t understand Chris Stokel-Walker may be right ( The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it?, 22 October ), but the real issue lies elsewhere. The bugs in the PHP programming language that were recently found by an AI tool have been present for a long time without anybody noticing and without any harm being done – they are extremely obscure. They were not found by hackers – they were found because an AI tool was used to check the PHP source code, which is a good use of AI. Continue reading...
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run
Assume all environment variables have been decrypted. Disable/rotate all keys.
Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection . Your origin stays private, while web application firewall ( WAF ), caching , bot management , and Workers work just as they do for public origins. In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers. What is generally available today During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group. Point a proxied A or AAAA record at
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Trezor said in a blog post 
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application
Multiple crypto-tracing firms say notorious North Korean hackers TraderTraitor may be behind the largest digital heist in history—with billions of crypto likely gone for good.
I checked the DMARC policies of 226 large European listed companies (Euro Stoxx 50, DAX, CAC 40, IBEX 35, FTSE 100): 48 of them can still be spoofed
I run a small Spanish security site and for the last couple of months I've been measuring, every month, whether the corporate domains of Europe's biggest listed companies are protected against email spoofing. October's edition covers five indices: 266 index seats, 226 unique companies once you remove the overlap. 📊 The headline numbers (public DNS, measured 12 October 2026) 🔴 48 of 226 (21%) have no effective DMARC policy: either no record at all or p=none. Anyone can send mail "from" their corporate domain and the receiver is never asked to block it. 🟡 41 more only send forged mail to spam (quarantine) or only partly. 🟢 137 (61%) publish p=reject. 📉 By index, companies without an effective policy: Euro Stoxx 50: 3 of 50 DAX 40: 7 of 40 CAC 40: 7 of 40 IBEX 35: 11 of 35 FTSE 100: 24 of 100 (8 with no DMARC record at all) 🔎 How it's measured One domain per company: the corporate / investor relations site, not the consumer brand. It was cross-checked against Wikidata, Wikipedia and the IR pages, because Wikidata alone got 12 of them wrong. It reads DMARC, SPF (following includes and redirects) and common DKIM selectors from public DNS, and gives a grade with the same open scoring as the free checker on the site. Each edition is frozen once published, so a later fix doesn't rewrite history. Re-checking a domain today may give a different result, and that's the point of doing it monthly. ⚠️ Limits It only looks at one domain per company. Brand and country domains often differ. DKIM is detected by guessing selectors, so "not found" doesn't mean "not there". It measures what the domain asks for, not what Gmail/Outlook actually enforce. 🚫 No ranking I deliberately don't publish a league table naming the worst companies. There's a search box if you want to look up a specific one, and the aggregate data (CSV, CC BY 4.0) is downloadable. I'd really like feedback on the methodology, especially from people who have pushed an org from p=none to p=reject: what actually blocked you? [https://cyberescudo.com/observatorio?lang=en](https://cyberescudo.com/observatorio?lang=en)
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart
So here's the deal. My antivirus (F-Secure) suddenly flagged the rustc.exe binary on my computer as malicious and to add to that, several other vendors also flag it in Virustotal. [https://www.virustotal.com/gui/file/FC40F1C8B65095A22A48C111AADC279C26A049B7E4161E8B99FFE3EB23873E86](https://www.virustotal.com/gui/file/FC40F1C8B65095A22A48C111AADC279C26A049B7E4161E8B99FFE3EB23873E86) This issue seems to affect only 1.99.0 because 1.99.1 is not flagged. Reproducible: \- Fresh rustup installation (this file or the rustup-init.exe or whatever the name of that was, not flagged by anything) \- Fresh RUSTUP\_HOME/CARGO\_HOME \- Official Rust 1.99.0 downloaded by rustup (\`rustup toolchain install 1.99.0-x86\_64-pc-windows-msvc\`) \- File is detected and flagged as malicious if uploaded to virustotal \- Rust 1.99.1 installs without detection The sha256 hash of the 1.99.0 exe I get is FC40F1C8B65095A22A48C111AADC279C26A049B7E4161E8B99FFE3EB23873E86 **Has someone else encountered this issue that rustc is getting flagged? And importantly, are you all getting the same hash for that specific rustc version?**
We got hit by this one today, thankfully crowstrike alerted us on the reverse shell. XAI / Cursor took down their marketplace as a result but they are trying to hide the real reason why it’s down. https://status.x.ai/
I wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: [https://brotli2bitcoin.com](https://brotli2bitcoin.com) & [https://php2bitcoin.com](https://php2bitcoin.com) with a standard production config -- pop an RCE and find the flag to claim the $1K BTC. And to make it interesting, I setup a live stream showing every single attack attempt happening live [https://www.youtube.com/watch?v=w7\_EJWqRzvw](https://www.youtube.com/watch?v=w7_EJWqRzvw) Good luck! ;)
Thursday, October 29
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
How do you validate SIEM detection rules beyond checking whether they fire? I’m building an open-source SIEM and looking for blue-team feedback
I’ve been developing **FENGARDE**, an open-source SIEM under Apache-2.0, and one challenge I keep coming back to is the difference between a detection rule that technically works and one that is actually useful to a SOC. FENGARDE ingests security events, normalizes them into a common format, applies detection rules, correlates related alerts and presents incidents for investigation. I’m particularly exploring three areas: **AI-agent/MCP security:** detecting suspicious tool-call sequences, credential-access patterns and potentially malicious content in tool arguments. **OT monitoring:** identifying unusual Modbus/TCP activity that deserves investigation. **Incident correlation and evidence:** connecting related alerts and preserving the underlying evidence so analysts can understand why an incident was raised. The rules can be tested by replaying test events through the detection engine. But I don’t consider a passing rule test proof of production readiness. Detection quality also depends on false positives, evasions, missing telemetry and legitimate activity that resembles an attack. **I’d like to hear from people who build or operate detections:** How do you test rules against benign-but-unusual activity? Do you maintain separate datasets for detection coverage, false positives and adversarial evasion? What evidence do you need to trust an alert produced by an unfamiliar SIEM? Which MCP or OT detections would be useful enough to investigate in a real SOC? I’m the developer, so this is also feedback on my own project—not an independent evaluation. Repository: https://github.com/supermhel/fengarde Critical feedback is welcome, especially practical testing methods and failure cases I should add.
October 29 | 24h Recap: VMware audit evasion, concealed infrastructure attacks and thousands of exposed keys
Three developments for security teams: 1. **An exploited VMware flaw carried a low score:** Warp Panda abused an administrator-level logging weakness to reduce visibility during intrusions. Confirm the July fixes are installed and compare hypervisor activity with identity and network telemetry. 2. **Attack infrastructure keeps changing:** Lumen’s Silent Train investigation shows Volt Typhoon rotating compromised devices between operations. Short-lived infrastructure makes static blocklists insufficient; management-system activity and unusual connections need attention too. 3. **Public repositories exposed usable credentials:** Researchers found 26,400 unique credentials on Gitee that worked when tested, including cloud and AI keys. The study also found large differences between scanners, making detector coverage worth checking against the services your organization uses. Read the full recap on CyberRecaps and I wish you a wonderful day!!!
With AI platfforms, #vulnpocalypse, and supply chain attacks security teams and platform engineering teams heads are spinning. The two recent HIGH and CRITICAL CVEs in the rust zip make a great case study for how we can build more resilient, defendable, and secure platforms with Wasm Sandboxes: [https://cosmonic.com/blog/stopping-remote-code-execution-with-a-sandbox/](https://cosmonic.com/blog/stopping-remote-code-execution-with-a-sandbox/)
A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called
A complete API penetration test should cover discovery, authentication, authorization across every role and tenant, data exposure, injection, abuse and rate limiting, business logic, and configuration, backed by reproducible evidence and a defined retest. The checklist below is written as buyer requirements: statements a security team can check a vendor's proposal or final report against, not instructions for performing the test yourself. The post API Penetration Testing Checklist: What Enterprise Security Teams Should Require appeared first on Synack .
What if a VNC server could make your viewer believe it had a \~4 GB framebuffer… while actually allocating only 128 KB? That’s the core of this TightVNC vulnerability. A malicious server can announce a crafted 32768 × 32769 screen at 32bpp, causing the framebuffer size calculation to overflow. The allocation wraps down to 128 KB, but the viewer continues using the original, much larger dimensions when calculating pixel writes. The result is a server-controlled out-of-bounds write in the viewer. It’s a good example of how a relatively small integer-overflow mistake can become a powerful memory-corruption primitive when different parts of the application disagree about the true size of a buffer.
Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and
Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One , Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network . Key insights Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while juggling geopolitical tensions, trade disputes, and contentious domestic events. At the same time, the operational focus shifted aw
A vendor gets a call from one of its biggest MSP partners who needs something the vendor can’t supply. The vendor knows a competitor can, so it points them there. That sounds like a good way to lose a partner, but it wasn’t. They stayed, and they spent even more over the next few years. […] The post The best due diligence on a vendor is who they’ve worked with appeared first on Heimdal Security Blog .
AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems can perform on their own. As these capabilities mature, security operations centers (SOCs) will see major changes in how work is organized, how
26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by
Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said. The feature, which currently supports only npm packages, is available in public preview
Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.
Information released by Distributed Denial of Secrets is the third such government data disclosure in the last month Data identifying more than 41,000 employees and contractors for the US Department of Homeland Security (DHS) was released on Wednesday in an unprecedented leak that reveals how the agency is organized. The records, which were made public by the transparency non-profit Distributed Denial of Secrets, reference operation names, surveillance programs and information on undercover initiatives. The DHS did not immediately return a message seeking comment. Continue reading...
XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077)
Egov.Integrations.MPass.Saml, the [ASP.NET](http://ASP.NET) Core handler that relying parties use to verify MPass SAML 2.0 responses, verified signatures like this in every version before 10.0.4: ``` signedXml.LoadXml(signatureElement); return signedXml.CheckSignature(publicCertificate, verifySignatureOnly: true); ``` CheckSignature confirms that the references in SignedInfo are validly signed. Nothing tied a signed reference to the response root the relying party then reads, so anyone holding one validly signed MPass message could relocate the signed element, put chosen assertion content at the root, and still pass verification. The result is authentication as an arbitrary user. Version 10.0.4 adds the missing check: exactly one reference, and its URI must equal the root element ID. - Weakness: CWE-347 (Improper Verification of Cryptographic Signature) - Attack pattern: CAPEC-475 (Signature Spoofing by Improper Validation) - Affected: 8.0.53 to 8.0.56 and 10.0.2 - Fixed: 10.0.4 and 10.0.5 Serghei Zagaiciuc found and publicly disclosed the flaw. I confirmed the affected range and the fix by decompiling the published packages. I have submitted a CVE ID request through the MITRE CNA of Last Resort form; so far it has a tracking number, CAN-2026-2041077, and no CVE ID has been assigned yet. No exploit is published. - Advisory with the decompiled diff: [https://www.masiutin.net/mpass-saml-xml-signature-wrapping.html](https://www.masiutin.net/mpass-saml-xml-signature-wrapping.html) - Original disclosure: [https://www.linkedin.com/posts/sergheizagaiciuc\_moldova-had-a-major-cybersecurity-blunder-activity-7520870795661897730-j8\_I](https://www.linkedin.com/posts/sergheizagaiciuc_moldova-had-a-major-cybersecurity-blunder-activity-7520870795661897730-j8_I)
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
Wednesday, October 28
The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing
If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: * `classes*.dex` declares `native` methods, but `lib/*.so` has 0 exported `Java_*` symbols and wiped ELF section headers. * `JNI_OnLoad` constructs strings on the stack (`MOVZ`/`MOVK`), uses an OLLVM `CSEL` \+ `BR X8` state machine, and registers JNI handlers dynamically. * Attaching Frida immediately crashes the app due to `/proc/self/maps` or libc prologue checks. I released **JNISleuth-MCP** (Apache 2.0) to automate this part of Android malware triage: [https://github.com/nighthawkk/JNISleuth-MCP](https://github.com/nighthawkk/JNISleuth-MCP) * Recovers static `JNINativeMethod` triplets from `.rodata` / `.data.rel.ro` (with `PT_LOAD` fallback for section-stripped ELFs). * Extracts `MOVZ`/`MOVK` stack strings and XOR-encoded C2 strings from `JNI_OnLoad` / `.init_array`. * Resolves & patches ARM64 OLLVM `CSEL` \+ `BR X8` indirect branches and `.rodata` jump tables. * Includes a C++/NDK **Dobby** agent that hooks `RegisterNatives` mid-function (`+0x10`) and dumps in-memory DEX payloads from `art::DexFileLoader::OpenCommon` without triggering standard Frida detections. * Syncs all 233 `JNIEnv*` vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server. Ships with a synthetic dropper APK (`samples/banker_dropper.apk`) so you can test all features offline.
Inside our inline hooking engine: relocating prologues with iced-x86 (x86-64 + AArch64, deps closed to two crates)
Rebranded GodPotato + PowerShell stager + Impacket env, left open by an operator who stole 68 GB from a Philippine government agency
Toolkit dump from a captured open directory: a renamed GodPotato (two builds and source), an eight-line PowerShell stager that reassembles the payload in memory, a small Python upload receiver, a full unmodified Impacket environment, and the operator's own transfer and access logs. Hashes, named-pipe path, and the base64 command/fragment paths are all in the post.
Tuesday, October 27
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and CVE-2026-109619), leaked ahead of coordinated disclosure. Advisories listing affected versions followed quickly, along with a flood of PoCs, many AI-generated and non-functional. We waited until we had our own data. This post covers what we learned building and testing exploits. In short, php2shell is exploitable but more conditional than some coverage suggests. Our analysis indicates that exploitation is heavily version dependent, and that the precise heap layouts required to exploit under the default display_errors=Off setting make it much more difficult than the non-default display_errors=On scenario. We will delve into why this is the case further into the post. Almost all of the public exploits released for php2shell focus on the dangling “PS” session global variables case, which impacts instances of Apache running mod_php or applications serving PHP code using the “php -S” development server like in the Steal My Bitcoin challenge . Our analysis focused heavily on the mod_php exploitation path. However, we’re starting to see early signs of exploits targeting the second vulnerability with the serializer, which affects PHP-FPM, such as kengwang/php2shell-fpm-exp . We haven’t yet had the opportunity to fully analyze that exploitation path and confirm the published exploit works. This article will focus on explaining why the mod_php exploitation scenario is exploitable, where the real-world risk is, and what organizations can do to be better prepared for events like this in the future.
Jess Asato’s public campaigning for victims of online abuse put her in the crosshairs of Grok’s deepfake scandal. Then the UK member of parliament became a victim of the abuse herself.
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised , creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell : serious vulnerabilities in PHP, the runtime behind a large portion of the Web. Cloudflare worked around the clock as these events unfolded to protect our customers and help protect the Internet. We shipped client updates and multiple mitigations , updated our web application firewall (WAF) with new rules to block attackers from exploiting the PHP vulnerabilities, and introduced a new feature called full transaction detection . As always in situations like this, these new capabilities were made available on all plans, including Free. Put our WAF to the test Protecting systems from vulnerabilities like these is always an ongoing process, not a one-time event. The widespread adoption of AI allows attackers to discover new vectors with unprecedented speed and efficiency, so collecting real-world data to test our assumptions and strengthen defenses is essential. That’s why today we're launching the Cloudflare PHP Capture the Flag challenge , run through our Bug Bounty program . We've put a deliberately vulnerable PHP installation behi
The Internet can feel invisible when everything is working normally. But when connectivity breaks, the many systems it depends upon become evident in an instant. Because Cloudflare’s global network handles more than 20% of the web’s traffic, it offers a unique perspective of how Internet traffic is behaving. When failures in infrastructure, power, policy, or security disrupt access to the Internet, Cloudflare Radar can observe the impact by monitoring traffic to our customers. Each quarter, we review the disruptions detected and annotated on Radar, highlighting what happened, where it happened, and the broader conditions that shaped each event. In this post, we examine the major categories of Internet disruptions observed during the third quarter of 2026, including government-directed shutdowns, power outages and natural disasters. Disruptions at a glance Between July and September, Internet disruptions were largely driven by failures in the systems the Internet depends on. Power grids failed in Cuba, Honduras, Guam, Ukraine, and several other countries. Natural disasters damaged electricity and telecommunications infrastructure from Nepal to Colombia. Government-directed shutdowns remained the most frequent source of disruption, driven largely by exam-related shutdowns in Iraq, while renewed conflict in Ethiopia’s Tigray region showed how quickly connectivity can become part of a broader political and humanitarian crisis. Outages within the United States, Japan, and Portugal — countries with a relatively strong history of Internet resilience — remind us that no country is immune to disruption. In total, Cloudflare Radar recorded 49 disruptions during the quarter. Government-directed shutdowns accounted for 19 incidents, including 18 exam shutdowns in Iraq. Power outages followed with 14 incidents, while natural disasters accounted for five.
We are pleased to share that we have been named winner of Advanced Persistent Threat (APT) Solution of the Year at the Computing Security Awards for ESEC ATP, the Email Security Advanced Threat Protection (ATP) module of the Heimdal platform. Targeted attackers are patient, and many intrusions begin with a single email that looks routine. […] The post Heimdal named Advanced Persistent Threat Solution of the Year at the Computing Security Awards appeared first on Heimdal Security Blog .
Understand cybersecurity megatrends with our rundown of 2026 data breach statistics [with data sourced from original studies published this year]. At Heimdal, we continually monitor specialist blogs, newsfeeds, forums and government websites that report on data breaches. This helps us build a picture of the latest trends in cyber crime, so we can better protect […] The post Data Breach Statistics That Matter in 2026 appeared first on Heimdal Security Blog .
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In fact, it took days before I could find a single story of PHP2Shell being reliably attributed back to a breach. And I don't think we can say the relatively benign outcome was only achieved because we did take it so seriously either; there's a massive trove of sites out there that have been left to rot and would have every opportunity to be pwned by a bug of this magnitude that was readily exploitable , yet here we are. Which is good
Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding system. In the past six months, BigSleep found more vulnerabilities than Fuzzilli (45 versus 37) with a 25% overlap in the specific bugs reported. Since this comparison methodology has a tendency to underestimate overlap, we also performed dedicated experiments to test theoretical overlap in vulnerabilities reported since 2023. These experiments estimated overlap at roughly 60%. Regardless of which value is accurate, a substantial portion of vulnerabilities were discoverable by only LLMs or only fuzzing. While it is extremely promising that LLMs have become able to find so many vulnerabilities so quickly, fuzzing and LLMs are still complementary approaches. We recommend vendors perform both fuzzing and agentic analysis of their code to maximize the number of vulnerabilities that get reported before they impact users.
Monday, October 26
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. After reviewing the feedback from Fireblocks and further analysis of the case, we have determined that this does not constitute a valid vulnerability. Fireblocks clarified that mpc-lib's signing protocols use only non-hardened BIP32 derivation and that a hardened index is handled as a non-hardened one. Effective exploitation would require privileged access, at which point the attacker would already hold the master share, rendering the issue moot. Description Fireblocks is a digital-asset custody and wallet platform that secures the private keys behind cryptocurrency wallets for institutions and exchanges, using multi-party computation (MPC) so that no single machine ever holds a complete key. Fireblocks’ key security pipeline contains two layers: MPC, which splits a single key into shares, and hardened derivation, which mathematically isolates each share from its key hierarchy. Normally, the derivation delta between parent and child keys is formed by hashing the private parent key, a derivation index, and associated metadata. VU#701544.1 A fail-open vulnerability was identified within the BIP32 hardened derivation implementation which fails to reject operations where no parent secret is present. If a parent key is missing, the implementation substitutes the secret parent contribution with a null buffer. Because the buffer becomes a known constant, 0, the delta becomes computable, violatin
On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic , to a tenant isolation issue affecting the GLM-5.3 Workers AI model ( @cf/zai-org/glm-5.3 ) starting on August 27, 2026. We have remediated the issue, and we restored the model on September 9. We have confirmed that no other model hosted on Workers AI was affected. Between August 27 and September 9, a small number of customers using the GLM 5.3 Workers AI model received responses that contained data from other customers' requests made to the same model shortly before theirs. In total, 155 responses were affected, all to prompts longer than 681,280 tokens. After excluding our own testing and the researcher's, the requests we identified are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug. We found no evidence of deliberate exploitation. Today we are publishing this report alongside a post from SGLang, the open-source inference engine that we use, as a coordinated disclosure. This post describes the bug that caused this issue, our response timeline, and the subsequent hardening we have conducted on our production SGLang deployments. We also detail our continued efforts with the upstream maintainers of SGLang to address this and similar bugs. What happened GLM is a text generation model from Z.ai that is built for agentic coding workflows; it is one of the many models available through Workers AI. Gadi Evron submitted a report on September 8 through our HackerOne program stating that very long prompts sent to @cf/zai-org/glm-5.3 on Workers AI sometimes returned text that belonged to other users' sessions. Cloudflare reproduced the issue the next morning and took the model of
Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host memory and deny service. The issue was reported publicly as COVESA/vsomeip issue #1009 and fixed in release 3.7.4 (2026-07-06). Description CVE-2026-91141 vsomeip is a middleware implementation of the Scalable service-Oriented MiddlewarE over IP (SOME/IP) protocol, widely used for service-oriented communication between electronic control units (ECUs) in automotive and other embedded environments. A SOME/IP message begins with a 16-byte header that includes a 32-bit length field declaring the size of the message that follows. A vulnerability was discovered in the handling of this length field on reliable (TCP) endpoints. When a message arrives, vsomeip grows its receive buffer to the size declared in the length field in order to read the incoming message, before confirming that those bytes have actually been received. In the default configuration, no size limit is applied to reliable endpoints, so a peer can declare a message size of up to roughly 4 GB and cause the receiver to allocate that memory. Because a freshly accepted connection reaches this path on its first message, no valid service, credentials, or SOME/IP authentication are required to trigger the allocation. The client endpoint contains the same behavior, where a malicious or compromised server can attack a connecting client. Deployments that explicitly configure a reliable message-size limit are not affected.
Two US senators say the Trump administration is breaking the law by withholding the FISA court decision while it presses Congress to renew America’s most sweeping surveillance program.
TrendAI Vision One is a hugely successful cybersecurity solution. The technology counts tens of thousands of customers worldwide, and has received high marketplace rankings by the likes of Gartner and IDC. Nevertheless, it’s not always right for everyone. If you feel you need a different provider, this guide is for you. We’ve compiled a list […] The post 6 alternatives to TrendAI Vision One appeared first on Heimdal Security Blog .
This post breaks down essential code security terms and tools so that you can build safely from the start.
Sunday, October 25
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
I'm the author. The full technical report, including the artifact links and validation records, is here: [https://papers.lisdex.sh/hermes/report.pdf](https://papers.lisdex.sh/hermes/report.pdf) Happy to answer questions about the analysis.
‘Session cookies’ are a primary target for hackers letting them hijack and use your accounts You’ve had a busy morning of life admin, logging into various accounts to check balances and make payments. At the end of a productive few hours you close your laptop and move on to your next job. What you don’t know is that fraudsters have hijacked your session with the bank and are now able to access your account. You are the victim of cookie theft, which belongs to a type of fraud known as “session hijacking”. Continue reading...
Saturday, October 24
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
Friday, October 23
PHP2Shell demands prompt patching and evidence that remediation worked. Mark Kuhr explains how exploitability validation and experts working with agentic AI help security teams understand exposure and act with confidence. The post PHP2Shell and the Case for Exploitability Validation appeared first on Synack .