TL;DR On October 21, 2026, the PHP team released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix two critical PHP RCE vulnerabilities. Both CVE-2026-109618 and CVE-2026-109619 score CVSS v4.0 9.2 and…

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a …

TL;DR Attackers are now exploiting PHP2Shell, a pair of critical PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Amazon saw the first attempt on October 17, four da…

A Home Media Server Turns Into a Botnet Node An ordinary home media server can become a tool for cryptocurrency mining and for hidden relaying of other people’s traffic. Researchers found a …

TL;DR QNAP says the QNAP PHP2Shell vulnerabilities affect QTS, QuTS hero, QuTScloud and several QNAP apps. The two flaws, CVE-2026-109618 and CVE-2026-109619, let unauthenticated attackers run cod…

TL;DR Trend Micro’s Zero Day Initiative (ZDI) posted details of several unpatched Linux kernel vulnerabilities to the public kernel mailing list on October 22, 2026. Two KSMBD flaws carry a …

TL;DR Horizon3 has published a technical deep dive and proof-of-concept exploit for CVE-2026-106173, a critical FortiSIEM vulnerability rated CVSS 9.4. The flaw lets an unauthenticated attacker wr…

The Zero Day Initiative (ZDI) team at Trend Micro recently experienced an operational mishap. Specifically, researchers inadvertently copied several confidential vulnerability reports to the publi…

Challenge Link: https://tryhackme.com/room/domino

TL;DR On October 23, 2026, the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload progress. It can lead to remote code execution, but only in a rare setup. …

Remote Code Execution (RCE) vulnerabilities in core programming language runtimes are rare gems. When CVE-2026-109618 dropped, it…

The PHP Foundation recently published a security disclosure detailing a remote code execution risk. Specifically, maintainers registered the issue as CVE-2026-115560 across national vulnerability …

How a PHP bug can give an attacker control of your server

Cybersecurity firm Aikido Security recently published an urgent advisory regarding an expanding decompression flaw. Initially tracked as Node2Shell (CVE-2026-111497), the threat now jeopardizes nu…

TL;DR Canada’s Cyber Centre updated its Fortinet advisory on October 23, 2026, to warn that CVE-2026-106173 “is being exploited in the wild.” This FortiSIEM vulnerability, rated …

TL;DR PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, lets unauthenticated attackers run code on servers that use PHP. PHP fixed both flaws on October 21, 2026, but PHP also ships insid…

Researchers have engineered a reliable exploit against critical memory safety protections. Specifically, cybersecurity analysts at VulnCheck defeated Address Space Layout Randomization (ASLR) on m…

TL;DR On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab…

A Forgotten Backdoor on Millions of PCs An abandoned build of Popcorn Time kept a dangerous mechanism on millions of computers for years. Through it, anyone could quietly run code with top system …

A critical flaw within Google’s Brotli compression algorithm has sent shockwaves through the software industry. Specifically, the Brotli CVE-2026-111497 vulnerability permits unauthenticated…