CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

Smart TVs can harbor unpatched security flaws and track what you watch

Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers between January and September. Televisions represented 22.7% of vulnerability observations, followed by smart plugs at 22.4% linked with a known software flaw. Top vulnerable…

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

php2shell one week later: Why one exploit doesn’t work everywhere

php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the exception: one tuned exploit can reach every device that runs it.Key takeawaysThe five vulnerable PHP sites we exposed to the internet were not compromised, and public proofs-of-concept (PoCs…

PHP2Shell plus Fragnesia: A dangerous new route from web server to root

The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild. Identified as CVE-2026-46300, it could allow attackers to run malicious code…