PHP2Shell Zero-Day Exploits Force Immediate Patch for Millions of Sites
Two critical PHP flaws, PHP2Shell, allow remote code execution on PHP 8.2.x and 8.3.x sites. Immediate patching and configuration hardening are mandatory.
vulnerability
11 stories
Claude Code Extension Compromise Exposes VS Code Users to Persistent SSH Backdoor
The Anthropic Claude Code VS Code extension was tampered with to add a persistent SSH backdoor, affecting up to 5,000 users via the Cursor marketplace.
PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites
Two PHP core memory-safety flaws allow remote code execution on 69% of web servers, prompting emergency patches and site outages.
Tailscale Releases Urgent Patches After Uncoordinated Disclosure of Tailworm Vulnerabilities
Tailscale issued critical updates for Tailworm bugs after a public disclosure, affecting versions 0.18.0 through 0.20.0.
CVE-2026-111497: Brotli Decoder Out-of-Bounds Write Enables RCE Across Multiple Platforms
CVE-2026-111497 is an out-of-bounds write in Brotli’s decoder that can lead to remote code execution. Inventory – Identify all systems that use Brotli.
PHP2Shell RCE Exposes Web Apps – Immediate Patch Required
A remote code execution flaw in PHP2Shell allows attackers to run arbitrary commands on vulnerable servers. Apply the vendor patch before exploitation.
GitLab Integer Overflow RCE Affects All Self-Managed Releases Since 2014
A CVSS 10.0 flaw in GitLab’s regex engine lets unauthenticated users run code on self-managed servers from 7.0 onward. Immediate patching is required.
Cisco Secure Email Gateway Vulnerability Enables Remote File Write
A critical flaw in Cisco Secure Email Gateway allows unauthenticated senders to write files to the appliance OS, enabling root execution.
Microsoft Patch Tuesday 2026: 1,417 Vulnerabilities, Including Exploited Shell Bypass and Exchange RCE
Microsoft released 1,417 patches on Oct 13, 2026, including an exploited Windows Shell bypass and a high-complexity Exchange RCE.
LG Smart TV root takeover via local-network pre-auth chain
LG Smart TVs running webOS 7.5.7-25 are vulnerable to a local-network root takeover chain that requires no PIN or user interaction.
Unpatched LMCache Vulnerability Exposes AI Servers to Remote Code Execution
An unpatched LMCache vulnerability leaves AI inference servers vulnerable to unauthenticated remote code execution via insecure Python deserialization.