Archive | CyberPulse

NCSC UK چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۵:۳۰

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

Vulnerabilities & Zero-Day

Source

Malwarebytes Blog چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۵:۰۷

Signal bug could let someone keep listening after you hang up

A flaw in Signal’s calling library could let another participant keep hearing you after you hang up. Update your app to get the latest fixes.

Vulnerabilities & Zero-Day

Source

SOCRadar چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۴:۰۸

PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Flaws, Affected Versions, and How to Fix Them

PHP2Shell: two critical PHP RCE flaws (CVSS 9.2). Affected and fixed versions, why workarounds fail, detection signals, and a free exposure checker.

Vulnerabilities & Zero-Day

Source

Infosecurity Magazine چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۳:۵۰

Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches

Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches

Vulnerabilities & Zero-Day

Source

Security Affairs چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۳:۴۳

PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws

PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC, […]

Vulnerabilities & Zero-Day

Source

Tenable Blog چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۲:۳۱

php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure.Change logUpdate October 26: CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV catalog. Added details on a regression in PHP 8.4.27 and 8.5.12 and on PHP's October 23 session upload progress advisory. Added a note o…

Malware & Threats Vulnerabilities & Zero-Day Data Breach

Source

Fortinet PSIRT چهارشنبه ۲۹ مهر ۱۴۰۵ · ۱۰:۳۰

PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this con…

Vulnerabilities & Zero-Day

Source

Ars Technica - Technology Lab چهارشنبه ۲۹ مهر ۱۴۰۵ · ۰۵:۴۲

PHP warns it plans to release 2 emergency patches imminently

Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.

Vulnerabilities & Zero-Day

Source

CERT-FR چهارشنبه ۲۹ مهر ۱۴۰۵ · ۰۳:۳۰

[Màj] Multiples vulnérabilités dans PHP (21 octobre 2026)

**[Mise à jour du 26 octobre 2026]** Le 23 octobre 2026, PHP a publié un avis de sécurité concernant la vulnérabilité CVE-2026-115560. Celle-ci permet une exécution de code arbitraire à distance. L'éditeur estime que les conditions d'exploitation exigent une combinaison d'options de configuration...

Vulnerabilities & Zero-Day

Source

Wordfence Blog چهارشنبه ۲۹ مهر ۱۴۰۵ · ۰۲:۰۹

PSA: Upcoming Critical PHP Security Release

PHP has released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities announced in this advance notice. WordPress updates won’t apply this fix, so check your PHP version and update now. See our new advisory for details. The post PSA: Upcoming Critical PHP Security Release appeared first on Wordfence.

Vulnerabilities & Zero-Day

Source

Tenable Blog چهارشنبه ۲۹ مهر ۱۴۰۵ · ۰۱:۲۸

Oracle October 2026 Critical Patch Update Addresses 1209 CVEs

Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates.Key TakeawaysThe October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295 security updates112 issues (8.6% of all patches) were assigned a critical severity ratingOracle Fusion Middleware received the highest number of patches at 206, accounting for 15.9% of all patchesBackgro…

Vulnerabilities & Zero-Day Supply Chain Security Databases

Source

AWS Security Bulletins چهارشنبه ۲۹ مهر ۱۴۰۵ · ۰۰:۰۹

CVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications

Bulletin ID: 2026-141-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:30 PM PDT Description: CICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository. We identified CVE-2026-112407, an incorrect privilege assignment in the IAM policy of AWS CICD-tool…

Vulnerabilities & Zero-Day Cloud Computing DevOps & Infrastructure

Source

Unit 42 (Palo Alto) چهارشنبه ۲۹ مهر ۱۴۰۵ · ۰۰:۰۰

Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)

Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42.

Malware & Threats Vulnerabilities & Zero-Day Ransomware

Source

AWS Security Bulletins سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۲۳:۴۹

CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew

Bulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT Description: Kiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine. We identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subage…

Vulnerabilities & Zero-Day Cloud Computing Open Source

Source

Qualys Blog سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۲۲:۳۸

The Real Jump Scare Isn’t the Attacker; It’s The Vulnerabilities You’re Focusing On

Key Takeaways Teams are remediating more than ever, but exposure from the vulnerabilities that matter is still rising faster than they can keep up with. Mean time to exploitation is about −7 days. Mean time to remediate sits around +30 days. Qualys research: closures rose from 73M (2022) to 473M (2025) – 6× – while […]

Vulnerabilities & Zero-Day

Source

Wordfence Blog سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۲۲:۰۲

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer. The post Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator appeared first on Wordfence.

Vulnerabilities & Zero-Day

Source

CERT/CC Vulnerability Notes سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۲۱:۳۹

VU#645818: Xerj Console API authentication bypass leads to unauthorized credential minting

Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. This allows the attacker to maintain access and potentially escalate privileges within the Xerj ecosystem, even if…

Vulnerabilities & Zero-Day Open Source App & Web Security

Source

CyberInsider سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۲۰:۰۵

Signal fixes critical flaw that could keep audio active after hangup

Signal has fixed a vulnerability in its RingRTC calling library that could let a malicious call participant interfere with hangup, potentially leaving audio, and possibly video, active after the other person tries to end the call. Tracked as CVE-2026-113380, the issue affects RingRTC versions before 2.72.0. The flaw has been assigned a critical CVSS v4.0 … The post Signal fixes critical flaw that could keep audio act…

Vulnerabilities & Zero-Day

Source

The Register - Security سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۲۰:۰۰

Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

From October 26, only high and critical cases stay private as project seeks help sharing the workload

Vulnerabilities & Zero-Day

Source

Cisco Talos سه‌شنبه ۲۸ مهر ۱۴۰۵ · ۱۹:۰۱

There's only so much code: the rise in vulnerability numbers

The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?

Vulnerabilities & Zero-Day

Source