MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
This page shows only the headline and the short summary. The full text is published by the original source.
Key Takeaways: A messy week for PHP: how PHP2Shell was disclosed On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These two vulnerabilities together came to be known as “PHP2Shell.” That evening, Calif, one of the research […] The post Censys takes census of the Internet like no one else appe…
Google’s new frontier model scored 88.2% on SEC-bench Pro and is rolling out first to vetted cyber defenders via its Fairwind Program. The post Google Says Gemini 4 Carbon Leads in Finding, Exploiting and Fixing Vulnerabilities appeared first on SecurityWeek.
During its own research, CERT Polska has found 2 XSS vulnerabilities (CVE-2026-66911 and CVE-2026-66912) in Zimbra Collaboration software.
Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk. Two of those h…
