Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ep. 90 - SafePay Claimed 590 Victims in 49 Countries Without Needing a Single Zero-Day

Oct 22, 2026 By SafeBreach In SafeBreach
SafePay doesn’t need a zero-day. It logs in. The FBI, CISA, the US Secret Service and German and UK police just issued joint advisory AA26-293A on the ransomware crew, and its front door is your VPN. Tova Dvorin and Adrian Culley break down SafePay’s three initial-access routes, the five known CVEs across Cisco ASA, Veeam and SonicWall, its FileZilla, Mimikatz and ShareFinder.ps1 tool chain, and four controls to validate before a stolen password is used.
View Video
Corelight

Uncovering the eMudhra incident: A Zeek detection

Oct 22, 2026 By Johanna Amann, Open Source Architect In Corelight
This week, two big vulnerabilities are in the news. The first one is the PHP2Shell vulnerability, for which a Zeek detector was published yesterday. The second, equally important, vulnerability is the compromise of some intermediate certificates of the eMudhra Certificate Authority (CA).
Read Post
aikido

Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

Oct 22, 2026 By Sooraj Shah In Aikido
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code. Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.
Read Post
indusface

PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Pre-Auth RCE in PHP Core Puts Web Servers at Risk

Oct 22, 2026 By Pavithra Hanchagaiah In Indusface
Two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an unauthenticated attacker run commands on servers that use an affected PHP build to handle web requests. PHP released fixes on October 21, 2026, a day after details leaked online. Public proof-of-concept code followed within hours, and exploitation attempts were seen as early as October 17. AppTrana customers have been protected against PHP2Shell.
Read Post
Arctic Wolf

PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution

Oct 22, 2026 By Arctic Wolf Labs In Arctic Wolf
On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to by researchers as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical Severity) and can allow an unauthenticated attacker to execute code with the privileges of the affected PHP worker process.
Read Post
Feroot

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Why Patching Alone Isn't Enough

Oct 22, 2026 By Feroot In Feroot
Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, allow attackers to execute code on vulnerable web servers without authentication. PHP released fixes on October 21, 2026, including versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. But patching your servers is only part of the response. Organizations must also understand what their websites delivered to customers during the exposure window, including scripts served by third-party vendors whose infrastructure may have been vulnerable.
Read Post
gitguardian

Responding to php2shell PHP Vulnerability When You Don't Know What Secrets Are Deployed

Oct 22, 2026 By Cybersecurity research team In GitGuardian
On Oct. 21, 2026, PHP fixed a vulnerability named php2shell by Calif. Pre-auth RCE under default configurations, confirmed on common CMS, webmail, e-commerce, file sharing, and database administration applications. A PHP server also stores and uses credentials, so this is a secret theft vector.
Read Post
nucleus

PHP2Shell Critical RCE Flaws: Exploited Within Hours of Disclosure

Oct 22, 2026 By Ryan Cribelar In Nucleus
Last updated: October 22, 2026. This story is still developing, and we'll update this post as new details are confirmed. Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are putting a large share of the web at risk. The vulnerabilities, collectively named PHP2Shell, both carry a CVSS score of 9.2, and both allow remote code execution (RCE). Security teams should treat these vulnerabilities urgently and respond accordingly.
Read Post
vanta

PHP2Shell: The Critical PHP Vulnerabilities and The Vendor Blast Radius

Oct 22, 2026 By Vanta In Vanta
Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.
Read Post
salt security

Bridging the Patch Gap: Stopping PHP2Shell and Zero-Days Before WAF Signatures Exist

Oct 22, 2026 By Nick Rago In Salt Security
On October 21, 2026, two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were publicly disclosed. Both are rated 9.2 and both allow remote code execution on vulnerable servers. Government portals, public services, and commercial sites across multiple countries went offline as a precaution while teams rushed to patch. But the flaws were known on October 20, and the patch didn’t ship until the 21st.
Read Post
securonix

TRUST#GRAFT: JavaScript Attack Targets WordPress Admins with PHP Backdoor

Oct 22, 2026 By Akshay Gaikwad, Aaron Beardslee In Securonix
The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access.
Read Post
armo

PHP2Shell: What Security Teams Need to Know About CVE-2026-109618 and CVE-2026-109619

Oct 22, 2026 By Ben Hirschberg In ARMO
On October 21, 2026, the PHP project shipped emergency releases for two critical memory-safety bugs in the PHP core itself: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2. Both are reachable before any application code runs, which means a “Hello World” PHP page is as exposed as a full WordPress install. And both were being probed in the wild before the fix was public.
Read Post
cato networks

Cato CTRL Threat Brief: Cato AI native SASE delivers PHP2Shell protection at machine speed

Oct 22, 2026 By Dr. Guy Waizel In Cato Networks
On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities known as PHP2Shell that can enable unauthenticated remote code execution. Cato’s self-evolving CVE mitigation agent helped turn the investigation into concrete research output by creating a proof of concept and generating an IPS signature in minutes. The agent connects vulnerability analysis, controlled lab testing and protection generation.
Read Post
astra

PHP2Shell: Two Critical PHP Vulnerabilities, How They Work, and What to Do About Them

Oct 22, 2026 By Shikhil Sharma In Astra
PHP powers roughly 70% of websites on the internet. WordPress, Drupal, Joomla, and thousands of custom applications run on it. At Astra, we’ve spent years protecting these applications with firewalls, malware scanning, and vulnerability detection. So when vulnerabilities show up in PHP’s core engine, it’s worth paying attention. On October 21, 2026, two critical PHP vulnerabilities were publicly disclosed under the name PHP2Shell.
Read Post
astra

Beyond the PHP Patch: How Security Leaders Are Responding to a Week of Critical Incidents

Oct 22, 2026 By Priya In Astra
From PHP vulnerabilities to supply-chain compromises, security teams are being forced to make difficult decisions about patching, exposure, and business continuity. Here’s the response from security leaders on critical incidents and the learnings on the front lines. Some days in cybersecurity are busier than others, and then there are days when everything seems to go wrong at once…like October 21.
Read Post
mend

Compromised LiteLLM 1.107.0 on PyPI Ships a Credential Stealer and Code Loader

Oct 21, 2026 By Alina Podoba In Mend
On October 21, 2026, a malicious release of litellm, the Python library and proxy for calling LLM provider APIs, was published to PyPI as version 1.107.0. All seven compiled wheels carried three extra files that install straight into the root of site-packages: a.pth hook that runs a credential stealer every time Python starts, and a sitecustomize.py that starts a background loader built to fetch and run remote Python code every hour. The package has had more than 92 million downloads over the past month.
Read Post
mend

PHP2Shell: the fix is a runtime upgrade, not a code change

Oct 21, 2026 By Alina Podoba In Mend
On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to close two critical remote code execution flaws in the PHP runtime. Both are rated CVSS v4.0 9.2. Together they go by the name “PHP2Shell.” The flaws sit in PHP itself, not in any application built on it. A secure codebase running on an affected PHP build is still exposed. That makes this an inventory problem first and a patching problem second.
Read Post
appknox

Appknox MCP: Find, Fix and Verify Mobile App Vulnerabilities Without Leaving Your IDE

Oct 21, 2026 By Dhruv Pandya In Appknox
Appknox MCP agent connects your AI coding agent to your Appknox scan results and KnoxIQ analysis. Your agent triages findings by exploitability, fixes the code in your repo and verifies each fix with a re-scan, inside Claude Code, Cursor, GitHub Copilot, Codex or Windsurf. Your AI coding agent already writes features, refactors code and fixes bugs. It can't see your security findings. So when a scan flags a vulnerability in your mobile app, the fix still starts by hand.
Read Post
astra

CVE-2026-94244: Missing Authorization in Wallet System for WooCommerce

Oct 21, 2026 By Ephrim Holyson In Astra
Vulnerability: Missing Authorization Leading to Store-Wide Customer Data Exposure via Exported Wallet Transaction File Vulnerable Version: < 2.8.0 Patched Version: 2.8.0 CVE: CVE-2026-94244 CVSS: 4.3 (Medium) AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE: CWE-862 (Missing Authorization) → CWE-200 (Sensitive Information Disclosure) On 02/09/2026, a security researcher at Astra Security found a Missing Authorization vulnerability in Wallet System for WooCommerce, a popular WordPress plugin by WP Swings that
Read Post
reach security

Cloudflare Responds to Critical PHP RCE Vulnerabilities: Why WAF Enforcement Matters

Oct 21, 2026 By Rohan Kar In Reach Security
Two critical PHP vulnerabilities have been disclosed, potentially exposing millions of web servers to remote code execution. Cloudflare has already responded by deploying emergency WAF protections. For Reach customers using Cloudflare WAF, Reach Drift automatically detected the new rules and confirmed they were enabled and configured to block malicious traffic.
Read Post
Arctic Wolf

Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure

Oct 21, 2026 By Arctic Wolf Labs In Arctic Wolf
On Tuesday, October 20, threat actors gained advance visibility into two critical PHP vulnerabilities after details leaked ahead of the planned disclosure, accelerating the race between defenders and attackers. The flaws are tracked as Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. Both carry a 9.2 rating on the Common Vulnerability Scoring System (CVSS) version 4.0 scale.
Read Post
Snyk

AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered

Oct 21, 2026 By Snyk Team In Snyk
On October 14th, the afternoon before the AI Security Summit (AISS) flagship event in San Francisco, Snyk hosted The AI Security Panel: Unfiltered. Yahoo Finance's Deirdre Bosa moderated four people who see AI security from very different seats.
Read Post
detectify

Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Oct 21, 2026 By Detectify In Detectify
On October 20, 2026, the PHP security team issued an advance security advisory regarding two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting core PHP source code. Both vulnerabilities carry a critical-severity CVSS v4.0 score of 9.2 and could potentially allow unauthenticated remote code execution (RCE) on affected servers. The official patched PHP releases are now available.
Read Post
Corelight

Building "php2shell" detections before coordinated disclosure

Oct 21, 2026 By Ben Reardon : Corelight Labs, Lead Security Researcher In Corelight
We recently collaborated with OpenAI, PHP, and a number of other organizations to respond to a pair of serious remote code execution vulnerabilities in PHP that are likely to impact the majority of the world's public web servers. PHP underpins a large part of the web, powering content management systems, online stores, and business applications. Its security matters to vital services that millions of people and organizations rely on daily.
Read Post
cloudflare

Cloudflare deploys protections against php2shell vulnerability

Oct 21, 2026 By Managed Rules In Cloudflare
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.
Read Post
aikido

What you need to know about PHP2shell. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Oct 21, 2026 By Willem Delbare In Aikido
Two critical remote code execution vulnerabilities have been found in PHP itself. Treat all versions as affected. ‍The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 21, 2026, at 16:00 CEST / 10:00 EDT / 07:00 PT. If you run PHP anywhere in your stack, please stay tuned for workarounds and patches. Be prepared to take action.
Read Post
CrowdStrike

CrowdStrike Protects Customers from Threats Delivered via PHP2Shell

Oct 21, 2026 By Amit Serper In CrowdStrike
Two critical memory-corruption remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell, have been disclosed in core PHP, the underlying engine powering a vast portion of the web. The CrowdStrike Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of both vulnerabilities.
Read Post
tanium

PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619

Oct 21, 2026 By Guardian Research Team In Tanium
If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed this week, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), let an unauthenticated attacker run code on a server with nothing more than a crafted web request. Both carry a CVSS v4.0 score of 9.2, every earlier release is affected, and exploitation in the wild has been reported. The patch is the easy part.
Read Post
bitsight

CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Two Critical PHP Remote Code Execution Flaws

Oct 21, 2026 By João Cruz In BitSight
The PHP security team has announced an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both bugs are described as remote code execution issues, meaning an attacker could get their own commands running on a vulnerable server. The route to disclosure was messy.
Read Post
kovrr

Cyber Risk Register vs. Vulnerability Register

Oct 20, 2026 By Kovrr In Kovrr
The two registers hold different objects, run on different clocks and answer to different people. Where they are treated as one list at different levels of detail, items get counted twice and others fall between them. ‍ A vulnerability register holds findings on assets and numbers in the thousands. A cyber risk register holds loss scenarios and numbers in the tens. Neither is a summary of the other. ‍
Read Post
5 PQC Remediation Platforms That Take Programs From Discovery to Done

5 PQC Remediation Platforms That Take Programs From Discovery to Done

Oct 20, 2026 By SecuritySenses In SecuritySenses
Post-quantum cryptography programs can no longer stop at finding vulnerable encryption. Discovery is necessary, but discovery alone does not make an enterprise quantum-safe. Organizations still need to determine which cryptographic risks matter most, decide what should be migrated first, coordinate changes across application and infrastructure owners, select appropriate remediation strategies, validate that each fix worked, and maintain visibility as cryptography continues to change.
Read Post
bright security

Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding

Oct 19, 2026 By Bright Security
Built on an evolutionary engine first released in 2018, STAR Fuzzer by Bright Security finds crashes, memory exhaustion and memory-safety bugs in security-critical code without a running application. In its first open source research run, it found High or Critical issues in 45% of the projects tested, and in its first month of availability it produced ten published findings in eight projects, including the Crystal standard library, htop and RIOT OS.
Read Post
cloudflare

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

Oct 19, 2026 By Cloudflare Access In Cloudflare
The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any emergency patch, admins had to weigh cutting off or disrupting their users’ access with the risk of delaying a critical security update.
Read Post
nucleus

There's Something Missing in the Discussion About AI in Vulnerability Management

Oct 19, 2026 By John Morton In Nucleus
The platform determines what is known. AI helps determine what it means. Technology solution providers across virtually every industry are racing to add AI, in some fashion, to their offerings. Vulnerability management providers aren’t immune, either. They’re racing just as fast as the rest of them, sometimes faster. These vendors are embedding copilots, assistants, and agents powered by technologies like Anthropic Claude, OpenAI GPT, and Google Gemini.
Read Post
netwrix

What is remote code execution (RCE)? How AI speeds up exploitation and how to limit the damage

Oct 19, 2026 By Jarosław Bogalecki In Netwrix
Remote code execution (RCE) lets an attacker run commands on a system they don't own, usually through a flaw in a web application, CMS, VPN portal, or API. A successful exploit inherits the permissions of the vulnerable service, and many services run with far more access than they need. AI shortens the time from a disclosed flaw to a working exploit and lets attackers test thousands of exposed systems at once. A remote code execution flaw turns a vulnerable server into someone else's computer.
Read Post
aikido

Your CVE is reachable. But is it exploitable?

Oct 18, 2026 By Dania Durnas In Aikido
Any SCA tool worth its salt has reachability analysis these days. When a dependency has a known vulnerability, these tools can tell you whether your code calls the affected function. This is pretty much non-negotiable because it helps teams focus their security efforts instead of sifting through noise. Every other step in prioritizing dependency CVEs builds on it. But just because the vulnerable function is reachable doesn’t mean it’s exploitable.
Read Post
jfrog

Anthropic's Free OSS Scanner: What It Means For Your Team

Oct 16, 2026 By Tal Zarfati In JFrog
On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos. It scans codebases, identifies vulnerabilities, proposes patches, and sends reports directly to maintainers. As you read this, it has already identified real, high-severity issues in production software used by millions.
Read Post
kovrr

Mapping AI Interaction Monitoring to the OWASP Top 10 for LLMs

Oct 15, 2026 By Kovrr In Kovrr
Interaction monitoring covers four of the ten risks in the 2025 Top 10 for LLMs and generative AI applications well, three partially and three not at all. The split is not arbitrary, and the line it follows tells a buyer more than the coverage count does. ‍ Monitoring observes systems being used. Several entries on the list describe defects in how a system was built, which no amount of observation at the point of use will surface.
Read Post
seal security

AI found the flaws. You don't need 1,000 contractors to fix them.

Oct 15, 2026 By Itamar Sher In Seal Security
On October 14, 2026, Bank of America's CEO said the bank brought in 1,000 contractors to patch software flaws surfaced by frontier AI models, including Anthropic's Mythos. "We put on 1,000 contractors to help us do the patching work in the second quarter," Brian Moynihan told CNBC. Those contractors work on top of the 3,000 people the bank already has in that area (ITPro, The Next Web). That is what the new normal looks like.
Read Post
Snyk

VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?

Oct 15, 2026 By Ryan McMorrow In Snyk
Can AI agents fix vulnerable dependencies without breaking the build? The fix itself is rarely the mystery. Over six months in 2026, Snyk Open Source recorded 459 million vulnerability findings across ~300,000 organizations. 94% of these vulnerabilities had a known fixed version, yet only about 10% had been resolved.
Read Post
Snyk

Introducing Evo Agentic AppSec: Security That Keeps Up With AI Development

Oct 15, 2026 By Brendan Hann In Snyk
AI is changing how software gets built. Coding agents produce more code than teams can review, and current models introduce several times more vulnerabilities per line than human developers. Many of those flaws involve business logic, access control, and authentication, areas where pattern-based scanners have limited visibility.
Read Post
seal security

Between a Rock and a Hard Place: When Dependency Cooldowns and CVE Policies Deadlock the Build

Oct 15, 2026 By Lev Pachmanov In Seal Security
On a recent call, a security lead walked us through two rules his team enforces on every build. Both are sensible. Together, they left his developers with a red pipeline and no version of a library they were allowed to use. The first rule is a cooldown. A new open source release cannot enter the build until it has been public for a set number of days. The second rule blocks any library version with a known high or critical vulnerability.
Read Post
seemplicity

CTEM Mobilization: Turning Validated Risk Into Fixes

Oct 15, 2026 By Kevin Swan In Seemplicity
Mobilization is the fifth and final stage of continuous threat exposure management (CTEM). It turns validated, prioritized exposures into action by assigning clear owners, delivering context-rich work into the tools teams already use, choosing the fastest safe response, tracking SLAs, and verifying that fixes worked. It’s often the hardest stage because security teams find exposures but IT, engineering, and cloud teams fix them.
Read Post
veracode

CISO Risk Intel Brief: Record Patch Volume, Edge Zero-Days, and AI-Accelerated Supply Chain Pressure

Oct 14, 2026 By Andrea Mazzarini In Veracode
This briefing examines material developments across the most recent seven-day period and the preceding thirty days. It is written for executive and board consumption and focuses on residual risk, control effectiveness, material exposure, and the practical implications for application security programs, software supply chain integrity, edge and identity systems, and the accelerating role of AI in both attack and defense.
Read Post

Ep. 87 - Citrix NetScaler Zero-Days: Code Execution on Your Edge Box, No Login, No Special Config

Oct 14, 2026 By SafeBreach In SafeBreach
Two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild before a patch existed, and 88771 hits every configuration with no login required. Tova Dvorin and Adrian Culley break down Citrix bulletin CTX697096 and all eight CVEs, why this is NetScaler’s third CISA KEV entry in five weeks, and why patching won’t tell you whether you were already breached.
View Video
Corelight

CVE-2026-70111: How Corelight uncovered a 0-Day affecting Microsoft Distributed File System

Oct 13, 2026 By Travis Green & Labs Team In Corelight
In the process of fuzzing MS-RPC and Distributed File System (DFS) APIs, we discovered a one-packet mechanism set to crash an entire Windows server, which the Microsoft Security Response Center (MSRC) later assigned as CVE-2026-70111.
Read Post
detectify

How to detect non-CVE vulnerabilities that standard scanners miss

Oct 12, 2026 By Detectify In Detectify
If your application security program only tracks known Common Vulnerabilities and Exposures (CVEs), you’re probably missing a large share of your real risk. Across the Detectify platform, 75% of the vulnerabilities in our test catalog and 99% of those we discover in customers’ assets are non-CVE vulnerabilities. That makes public disclosures a poor measure of coverage on a modern attack surface. Below, we look at why so many vulnerabilities never get a CVE and how Detectify finds both kinds.
Read Post
seemplicity

Seemplicity + Miggo: Runtime Detection, Closed Risk

Oct 11, 2026 By Kevin Swan In Seemplicity
Most application-layer attacks slip past EDR, WAFs, and CNAPP because none of them watch what an app actually does at runtime. Miggo’s ADR platform does, detecting behavioral deviations agentlessly via DeepTracing and eBPF. With the new integration, those runtime detections flow directly into Seemplicity, where they’re correlated with cloud, code, and identity findings, deduplicated, and routed to the right owner.
Read Post
cycognito

Emerging Threat: (CVE-2026-107406) NetScaler ADC and Gateway Remote Code Execution via SAML

Oct 11, 2026 By Igal Zeifman In CyCognito
CVE-2026-107406 is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway, classified as CWE-119. Successful exploitation leads to remote code execution or denial of service. The vulnerability carries a CVSS v4.0 base score of 9.5 (Critical). Attack vector is network, and neither privileges nor user interaction are required.
Read Post
manageengine

5 patch essentials: The SMB benchmark for patch management

Oct 10, 2026 By Mahanya V In ManageEngine
If you're the entire IT team at your company, you probably wear more hats than your title suggests. Between helpdesk tickets, network maintenance, and strategic projects, patch management often gets pushed to the background—and it probably wins your attention only after an incident or an audit. The problem is, threats don't wait for a quiet day. New vulnerabilities are piling up and exploit windows are shorter than ever.
Read Post

Ep. 85 - FortiBleed: The Campaign With No CVE That Locks You Out of Your Own Firewall

Oct 9, 2026 By SafeBreach In SafeBreach
The FBI and US Secret Service just dropped joint advisory JCSA 2026-1601 on FortiBleed—and there is no CVE to patch. Tova Dvorin and Adrian Culley walk the full chain: credential stuffing against internet-facing FortiGate SSL VPNs, legacy SHA-256 admin hashes cracked on rented GPUs, fake vendor-style admin accounts, and attackers deleting your accounts to lock you out of your own firewall. Plus the INC/Lynx ransomware link, what the 86,000 figure really means, and the question that matters: would a new admin on your edge device at 3am fire anything?
View Video
seemplicity

How to Build the Business Case for ASPM Software

Oct 8, 2026 By Jessica Amado In Seemplicity
Start with what the current backlog already costs: analyst hours spent on triage, developer time lost to duplicate tickets, slow MTTR, and manual reporting. Then tie each benefit of ASPM software to one of those costs, such as fewer tickets per fix or faster remediation. Compare pricing models on your real numbers, including integration upkeep, and propose a measurable pilot on five to ten high-value applications. Most AppSec teams don’t need to be sold on ASPM software.
Read Post
sentrium

Critical Bookly IDOR Leads to Booking Disclosure and Deletion (CVE-2026-93399)

Oct 8, 2026 By Theklis Stefani In Sentrium
During independent security research conducted as part of the Wordfence Bug Bounty Program, we identified an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in Bookly, a WordPress appointment booking plugin used to manage online scheduling, services, staff availability and customer appointments.
Read Post
nucleus

Risk Acceptance Has a Shelf Life: Notes from the Aviation ISAC Cybersecurity Summit

Oct 8, 2026 By Adam Dudley In Nucleus
The first Aviation ISAC summit, a little over a decade ago, was about forty people in a room in Miami, hosted by the Health ISAC. This year’s conference in Vancouver hosted more than five hundred: airlines, airports, OEMs, suppliers, and government, all in one place for three days. Many in the audience were new to the conference. One of the opening speakers asked first-timers to raise their hands, and a lot of hands went up around the room.
Read Post
Featured Post
What happens when a patch can't wait until next Tuesday?

What happens when a patch can't wait until next Tuesday?

Oct 8, 2026 By Katie Barnett, Director of Cyber Security, Toro Solutions In SecuritySenses
Most organisations patch on a schedule. For the majority of vulnerabilities, that makes sense. Updates need testing, maintenance windows need planning and nobody wants to cause an outage while trying to fix a security problem. But what happens when something can't wait? That's the bit I think organisations need to be looking at more closely, particularly as AI starts to change how quickly vulnerabilities can be found and analysed.
Read Post
Snyk

Autonomous Attacks Are Already Here. The Defense Has to Match Their Speed.

Oct 7, 2026 By Snyk Team In Snyk
Last week, Snyk CTO Manoj Nair sat down with Alon Krifcher, Head of Applied AI from Anthropic, for a live discussion on the coming wave of autonomous attacks. Manoj kept landing on one thing: the AI Hurricane has already arrived, and what's left is deciding whether your defense runs at the same speed as the threat.
Read Post
Snyk

Frontier models found the vulnerabilities. Only the attacker found the chains.

Oct 7, 2026 By Nuno Loureiro In Snyk
Attackers don't read your repository; they hit your URL, and chain together whatever they find. In an era where offensive AI runs against live applications at machine speed, your security tooling needs to go beyond finding vulnerabilities to prove exploitability, including whether they can be combined into a breach.
Read Post
cycognito

Emerging Threat: (CVE-2026-21589) Atlassian Data Center Arbitrary File Access via Path Traversal

Oct 7, 2026 By Igal Zeifman In CyCognito
CVE-2026-21589 is an arbitrary file access flaw affecting most of Atlassian’s self-hosted Data Center product line. CISA classifies it as CWE-552, files or directories accessible to external parties. An unauthenticated remote attacker can read specific files inside the web application root directory. The vulnerability carries a CVSS v4.0 base score of 9.3 (Critical). Attack vector is network, attack complexity is low, and neither privileges nor user interaction are required.
Read Post
datadog

How we replaced our host vulnerability scanner with the Datadog Agent

Oct 7, 2026 By Datadog In Datadog
A year ago, Datadog’s cloud environment had grown to support tens of thousands of users across the globe. As our host fleet expanded alongside that user growth, we saw that our original system for vulnerability scanning was becoming less effective at reaching and assessing every host.
Read Post
nakivo

Critical Security Risks in vSphere Active Directory Integration

Oct 7, 2026 By NAKIVO Team In NAKIVO
Microsoft Active Directory is widely used for authentication, and many software solutions can integrate with it to rely on a single authentication system. VMware vSphere components, including vCenter Server and ESXi hosts, also support Active Directory integration, which simplifies account and access management. However, this convenience introduces specific security risks that administrators need to understand and mitigate.
Read Post
seal security

Lost in Translation: A Native Heap Overflow in Unmaintained Jansi (CVE-2026-8484)

Oct 6, 2026 By Lev Pachmanov In Seal Security
Jansi is the small Java package that makes colored console output work everywhere, including the Windows terminals that never understood ANSI escape codes. You may not have heard of it, but if you build Java, you almost certainly have it on disk: the Apache Maven 3.9.16 distribution puts jansi-2.4.3.jar in its lib/ directory, and Maven's pom.xml declares it as a dependency.
Read Post
cycognito

Emerging Threat: (CVE-2026-94483) Next.js Server-Side Request Forgery via Image Optimization

Oct 5, 2026 By Igal Zeifman In CyCognito
CVE-2026-94483 is a server-side request forgery flaw in the Image Optimization feature of Next.js, the React framework maintained by Vercel. It is classified as CWE-918. Image Optimization fetches a remote image on the server and re-encodes it. Before fetching, it checks the requested URL against the images.remotePatterns allow-list. The flaw is that the allow-list check and the fetch resolve DNS separately, so a host that passes the check can resolve to a different address by the time the fetch happens.
Read Post
seemplicity

How to Choose an Application Security Solution

Oct 4, 2026 By Jessica Amado In Seemplicity
Most teams need a combination of application security tools rather than a single one. Common categories are SAST, DAST, IAST/RASP, SCA, API and container security, and ASPM, and each covers a different stage of development. When you evaluate options, look for coverage that matches your stack, integration with developer workflows, accurate findings, risk-based prioritization, and actionable remediation guidance.
Read Post
cycognito

Emerging Threat: (CVE-2026-84411) MikroTik RouterOS Unauthenticated Root RCE via Web Management

Oct 4, 2026 By Igal Zeifman In CyCognito
CVE-2026-84411 is an integer underflow in the web management service of MikroTik RouterOS, classified as CWE-191. The flaw sits in the service’s HTTP request body handling and is reachable before authentication. A single crafted request lets an unauthenticated network attacker execute arbitrary code as root, or crash the device. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical).
Read Post
jfrog

The Year the Vulnerability Backlog Changed Shape

Oct 2, 2026 By Paul Davis In JFrog
As we enter the AI era, few among us have found themselves so entrenched in the throes of the shifting landscape as CISOs. With the threat landscape shifting, they are up against increasing rates of vulnerabilities and exploits alongside rapidly scaling demands for ever more secure environments. As CISOs, with our role as the protectors of an organization, we are expected to deliver guidance and security visibility. This is not a vision of the future, it’s today’s reality.
Read Post
seemplicity

From Agent Discovery to Agentic Exposure Response: Reco + Seemplicity

Oct 1, 2026 By Kevin Swan In Seemplicity
Copilots and assistants shipped into apps you own, agents reaching in through MCP servers and OAuth tool grants, and the service accounts and tokens they all run as. Almost none of it went through a review. This Reco + Seemplicity integration closes the gap between finding an exposed agent and fixing it. Reco discovers every agent operating across your apps, what data it reaches, and what actions it takes.
Read Post
Snyk

Why AI Coding Agents Keep Writing Broken Access Control

Oct 1, 2026 By Brendan Hann In Snyk
AI coding agents produce authorization logic that compiles, passes review, and enforces the wrong policy. Broken access control ranks first in the OWASP Top 10:2025, where 100% of applications tested showed some form of it, across 1,839,701 recorded occurrences, the highest count of any category on the list. One part of that category is also the part that pattern-based scanning was never built to reach.
Read Post
indusface

Next.js CVE-2026-94545: Critical ImageResponse Vulnerability Enables RCE via SVG

Oct 1, 2026 By Bhargavi Pallati In Indusface
A critical remote code execution vulnerability was disclosed in Next.js on September 22, 2026, and an out-of-band security update was released to fix it. CVE-2026-94545 is a remote code execution vulnerability in next/og, the feature Next.js applications use to generate images on demand. The GitHub advisory rates it 9.5 on CVSS v4.0. An unauthenticated attacker can reach it over the network, and the root cause is an upstream SVG-escaping vulnerability that applications inherit without realizing it.
Read Post
indusface

WordPress CVE-2026-87902: Unauthenticated RCE Exploited Within Hours

Oct 1, 2026 By Bhargavi Pallati In Indusface
WordPress patched CVE-2026-87902 on September 22, 2026. Attackers were exploiting it the same day. Within hours of disclosure, attackers progressed from reconnaissance to active exploitation attempts, including attempts to write malicious PHP files to disk. The vulnerability is critical, with a CVSS v4.0 score of 9.2. Unauthenticated attackers can exploit it remotely. A public scanning template is already in circulation, and CISA has added the vulnerability to its KEV catalog.
Read Post
astra

Zero-Day Attack Prevention: Catching Unknown Vulnerabilities Before Threat Actors Do

Oct 1, 2026 By Keshav Malik In Astra
On September 1, 2026, OpenAI announced that its Astra model had reached the Critical tier for cyber capability under the company’s Preparedness Framework, a first for its systems. While working through an internal benchmark of 20 recently disclosed vulnerabilities in Google’s V8 engine, the model found two zero-days that no one had asked it to look for and used them in a working exploit chain. OpenAI is disclosing both flaws and restricting the capability to vetted testers.
Read Post
cycognito

Emerging Threat: (CVE-2026-86858) ServiceNow AI Platform Unauthenticated Privilege Escalation via GraphQL

Oct 1, 2026 By Igal Zeifman In CyCognito
CVE-2026-86858 is an improper access control flaw in the ServiceNow AI Platform, classified as CWE-284. ServiceNow describes it as an unauthenticated privilege escalation reachable through GraphQL. In certain circumstances an unauthenticated user can create, modify, or delete instance data beyond what was intended. The vulnerability carries a CVSS v4.0 base score of 8.7 (High). Attack vector is network, attack complexity is low, and neither privileges nor user interaction are required.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.