Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 125 stories in 24 hours
Threat Intelligence
👉 Malware, zero-days, exploits
152stories this week
9today
the last seven days
Most fromThe Hacker News, BleepingComputer, Help Net Security, Bitdefender
In the news hereGoogle17Microsoft11Linux6GitHub5Lazarus2Qilin2APT411APT29 (Cozy Bear)1
MyCyberWay trainingSomeone will report this email. Know exactly what to do next.See the Analyst curriculum
-
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
BleepingComputer+11 sources
-
Patch or go offline, say UK, US and EU agencies as two AI-discovered flaws in PHP, the language behind most websites, allow unauthenticated remote code execution…
Computer Weekly
-
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
Unit 42
-
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the…
The Hacker News
-
PHP and Wiz Research disclosed today two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. Wiz used a mix of models to identify and help remediate these vulnerabilities. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack…
Google Cloud+11 sources
-
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately. “These findings…
Help Net Security+11 sources
-
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
Unit 42+11 sources
-
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.
CyberScoop+1 source
-
A Google search for Amazon business led to a ClickFix lure that dropped multiple malicious payloads onto the victim machine, including versions of Lumma Stealer and NetSupport Client RMM.
Huntress
-
The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities.
SecurityWeek
-
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.
WIRED+1 source
-
A flaw in Signal’s calling library could let another participant keep hearing you after you hang up. Update your app to get the latest fixes.
Malwarebytes
