TL;DR PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, lets unauthenticated attackers run code on servers that use PHP. PHP fixed both flaws on October 21, 2026, but PHP also ships insid…

TL;DR Full technical details and a working exploit are now public for CVE-2026-43501, a Linux kernel IPv6 vulnerability rated CVSS 9.8 by the kernel’s CVE team. The out-of-bounds write sits …

Researchers have engineered a reliable exploit against critical memory safety protections. Specifically, cybersecurity analysts at VulnCheck defeated Address Space Layout Randomization (ASLR) on m…

TL;DR Storybook has patched CVE-2026-114125, a CVSS 9.4 Storybook dev server vulnerability that lets a malicious website change files in a developer’s project. Under further conditions, the …

TL;DR Microsoft has released an out-of-band .NET security update for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. It fixes CVE-2026-111497, a Brotli decompression buffer overflow, and CVE-2…

TL;DR The Apache Camel project disclosed eight Apache Camel vulnerabilities across components such as camel-saxon, camel-aws2-s3 and camel-keycloak. The most severe, CVE-2026-90885, is a high-seve…

TL;DR On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab…

Imagine discovering that a lock used by millions of buildings has a hidden weakness. The lock has existed for years, thousands of people…

The developers of the popular open-source Bitcoin client Electrum have issued an urgent advisory. Specifically, maintainers urge all cryptocurrency users to upgrade immediately to version 4.8.3. A…

By Tejas Saubhage · Oct 26, 2026

A critical flaw within Google’s Brotli compression algorithm has sent shockwaves through the software industry. Specifically, the Brotli CVE-2026-111497 vulnerability permits unauthenticated…

1. Vulnerability Description

An analysis of the PHP2Shell incident, its potential security implications, and the lessons organisations can learn about vulnerability…

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.

TL;DR A full write-up and exploit are now public for CVE-2026-23074, a Linux kernel privilege escalation flaw in the teql traffic-control scheduler. The use-after-free dates back to Linux 2.6.12, …

What could a feature that fetches information possibly have in common with one that saves files?

PHP2Shell isn’t a WordPress bug or a Drupal bug — it’s in PHP itself, and a “Hello World” app running on an affected version is vulnerable…

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

SQL injection UNION attack, determining the number of columns returned by the query

Forescout found 12,976 exposed refrigeration services in 99 countries, warning that attackers could alter temperatures and spoil food, medicines and supplies.