Daily
The Press Corner
A short résumé of each security publication from the daily scan, with the topic and a link to the original. The scan runs every day at 01:15 UTC. If that run misses, the next hourly pass picks it up. Last scan Oct 23, 2026.
English. 1–15 of 66
PHP2Shell exposes the weakness in coordinated vulnerability disclosure
Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure.
PHP2Shell exploit bypasses protections designed to stop remote code execution
“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting CVE-2026-114625 in VeloCloud Orchestrator, allowing logged-in users to gain full operator privileges.
Security teams urged to center defense on the flaw profile attackers target most
Attackers are increasingly focusing on a limited range of critical vulnerabilities to run attacks with flaws packaged into exploits within as little as three days. Rapid7’s latest Quarterly Threat Landscape report found the number of newly exploited vulnerabilities in Q3 of 2026 was 43, up 19% year on year.
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence.
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
This vulnerability allows network-adjacent attackers to tamper with CMS AuthEnvelopedData messages on affected installations of OpenSSL. An attacker must first obtain the ability to modify CMS AuthEnvelopedData messages in order to exploit this vulnerability.
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability.
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability.
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that…
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
P7 DarkSword adds on-device keychain and crypto wallet data theft to the iOS exploit kit, alongside two-way C2 communication.