Find what you’re looking for
Browse everything
6,838 results in Threat Reports
eMudhra's PKI Collapse: How Trivially Weak CA Keys Triggered a 30,000-Certificate Crisis
In October 2026, Indian certificate authority eMudhra announced its exit from the global SSL/TLS certificate business after a researcher discovered that eight of its intermediate CA private keys were trivially guessable—each below the integer value 256 rather than the cryptographically large random numbers required. Disclosed on October 17, 2026 to Apple, Google, Microsoft, Mozilla, and eMudhra, the flaw prompted Chrome and Firefox to distrust the emSign ECC Root CA - G3 root within hours, affecting approximately 30,800 unexpired certificates—99.9% of them issued through InCommon, the Internet2 certificate service serving U.S. higher education institutions. eMudhra acknowledged it never used the weak keys to issue end-entity certificates, and that no systems were breached, but compounding concerns emerged around a 2025 incident in which invalid CRLs were signed with the same flawed keys, raising serious transparency questions. This incident underscores a systemic risk in the public PKI ecosystem: a single trusted CA's key-management failure can cascade to tens of thousands of relying parties overnight. With browser vendors accelerating root-store governance and higher-education institutions now scrambling to replace certificates, organizations must treat CA trustworthiness and certificate lifecycle automation as critical infrastructure concerns, not administrative afterthoughts.
Critical VeloCloud Orchestrator Zero-Day (CVE-2026-114625): Attackers Escalate to Full SD-WAN Control
In October 2026, Arista disclosed an actively exploited critical SQL injection zero-day (CVE-2026-114625, CVSS 9.9) in the VeloCloud Orchestrator (VCO), the central management plane for VeloCloud SD-WAN networks. Any authenticated user—even one holding the lowest read-only customer role—could exploit the flaw to escalate to full operator-level privileges, potentially compromising the orchestrator host, its data, and downstream VeloCloud Edge devices. Fixes were released in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12; cloud-hosted instances were patched by Arista. Two attacker-controlled IPs were observed actively exploiting the vulnerability in the wild before the patch was available. This is the third VCO zero-day exploited since July 2026, signaling a sustained, targeted campaign against SD-WAN management infrastructure. The pattern—unauthenticated flaws followed by an authenticated privilege-escalation bug—suggests attackers are systematically mapping and chaining VCO weaknesses to achieve persistent, high-privilege control over enterprise network fabrics at scale.
PHP2Shell: How Two Critical PHP Engine Flaws Are Being Weaponized Right Now
Two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell), are being actively exploited following the premature leak of technical details ahead of PHP's scheduled October 21, 2026 security release. Because the flaws reside in the PHP runtime itself rather than any single application, every web server running an unpatched PHP version is potentially exposed—spanning popular content management systems including WordPress, Drupal, and Joomla. Threat actors are leveraging public proof-of-concept code to deliver web shells, enabling persistent unauthorized access and downstream lateral movement across compromised infrastructure. PHP2Shell represents a new class of engine-level RCE risk that renders application-layer defenses insufficient on their own. With exploit code already circulating and active scanning campaigns underway, the window for undetected initial compromise is extremely narrow, reinforcing the urgency of both emergency patching and network-layer controls capable of detecting and blocking malicious payloads in transit.
PHP2Shell: Inside the Critical Unauthenticated RCE Flaw Threatening Every PHP Runtime
On October 21, 2026, the PHP project released emergency patches (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) addressing two critical memory-safety vulnerabilities collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2). Discovered through AI-assisted auditing by Calif, Wiz, and OpenAI, the flaws enable unauthenticated remote code execution or sensitive process-memory disclosure—including passwords, tokens, and API keys—against virtually every PHP runtime in use today. On Apache with mod_php, exploitation occurs before any application code runs, rendering application-level controls ineffective. Attack attempts were observed by Cloudflare following a CVE leak on October 20, though no confirmed in-the-wild compromise had been reported as of patch release. PHP2Shell is uniquely dangerous because the vulnerability resides in the PHP runtime itself, not in any specific application, meaning WordPress, Drupal, Laravel, Magento, and thousands of other platforms are simultaneously exposed. With approximately half of internet-facing PHP estimated to run on end-of-life branches (8.1 and older) that will receive no official patch, the attack surface is extraordinarily broad and the remediation window is extended.
TiDB Breach 2026: How FulcrumSec Turned a Vendor's Cloud Into a Customer Data Gold Mine
In October 2026, PingCAP—the company behind the open-source TiDB distributed SQL database—disclosed a breach spanning September 9 to October 7, 2026, perpetrated by the extortion group FulcrumSec. Attackers used stolen service account credentials to access internal cloud management, financial, analytics, and storage systems for nearly a month. While no customer databases were directly compromised, threat actors exfiltrated billing records, API keys, SQL editor histories, Jira tickets, CRM data, source code, and a four-year connection log covering thousands of downstream customers including AirBnB, Booking.com, Baidu, Fujitsu, and major gaming companies. FulcrumSec went further than PingCAP's own disclosure, claiming they replicated the internal service management system and pulled fresh data every six hours for 22 days. This incident underscores a growing class of supply-chain and credential-theft attacks where adversaries bypass hardened customer environments entirely by compromising upstream SaaS and cloud database vendors. As enterprises increasingly delegate data operations to managed service providers, the aggregation of operational telemetry, API tokens, and query histories in vendor environments creates high-value secondary targets that are often outside the scope of customer security controls.
PHP2Shell: How a Zero-Day RCE in PHP Core Was Exploited 4 Days Before Anyone Was Supposed to Know
In October 2026, two critical PHP core vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—were exploited in the wild before their coordinated public disclosure on October 22, 2026. Rated 9.2 on the CVSS scale, the flaws enable pre-authentication remote code execution across all PHP 7.x and 8.x releases, affecting virtually every reachable PHP endpoint. Amazon's MadPot honeypot recorded the first exploitation attempt on October 17, originating from an anonymized IP geolocated to Australia, suggesting threat actors obtained exploit details under embargo. Following an inadvertent early patch release by Chainguard, broad exploitation erupted within hours, with multiple threat actors deploying diverse payloads across millions of internet-facing PHP hosts. The PHP2Shell incident underscores an accelerating trend: AI-assisted patch-diff analysis is dramatically compressing the time between vulnerability disclosure and weaponized exploitation—from days to hours. With PHP powering roughly 70% of the web, including WordPress and Magento, the structural exposure of core runtime components demands that organizations adopt real-time network-layer detection and zero-trust segmentation alongside traditional patching disciplines.
ARTEX AI at Machine Speed: How Storm-0940 Turned ConnectWise Into a Master Key for 2,250+ Targets
In October 2026, Microsoft attributed a sophisticated supply chain attack against ConnectWise's Cloud Backup application to Storm-0940, a China state-aligned threat actor active since at least 2021. The adversary deployed ARTEX, a Go-based agentic AI penetration testing framework, to automate password spraying, OAuth application abuse, and reconnaissance at machine speed—targeting over 2,250 tenants at 2,900 sign-in attempts per minute. Between October 10–14, 2026, attackers generated over 151,000 failed logon events before gaining access on October 15 by compromising ConnectWise cloud application identities, enabling authentication into customer environments without interactive user sign-in. Privileged access was achieved at several organizations within under three hours of initial targeting. This incident marks a critical inflection point in nation-state cyber operations: the weaponization of agentic AI frameworks compresses attack timelines from days to hours, renders traditional detection windows insufficient, and exploits the trust relationships inherent in managed service provider ecosystems—amplifying blast radius across hundreds of downstream organizations simultaneously.
QPACK Zero-Days: How a Single UDP Packet Can Crash Your HTTP/3 Infrastructure
In October 2026, security firm FoxIO disclosed critical QPACK header-compression flaws affecting seven of ten HTTP/3 server stacks tested, releasing working proof-of-concept exploit code. An unauthenticated remote attacker can send a small compressed HTTP header batch that expands up to 4,000-fold in server memory, crashing affected servers with a single UDP connection. Impacted stacks include quic-go (CVE-2025-64702), Cloudflare quiche (CVE-2026-12523), lsquic, Bun, the h3 Rust library, and aioquic. Bun carries the worst-case scenario: a 516 KB payload triggers an integer overflow leading to 100% CPU lock with no recovery. Patches exist for quic-go, Cloudflare quiche, lsquic, and Wireshark, but Bun, h3, and aioquic remain unpatched as of disclosure. This disclosure follows the HTTP/2 "MadeYouReset" denial-of-service research and signals a broader trend of protocol-layer amplification attacks targeting modern cloud-native infrastructure. As HTTP/3 adoption accelerates across CDNs, API gateways, and edge runtimes, unpatched stacks present an immediate availability risk to internet-facing services operating without protocol-aware traffic inspection or egress controls.
Node.js Brotli Decoder RCE (CVE-2026-111497): What Cloud-Native Teams Must Do Now
On October 21, 2026, the Node.js project released security updates for all three supported release lines (22.x, 24.x, 26.x), patching ten vulnerabilities including a high-severity out-of-bounds write in the bundled Brotli decompression library (CVE-2026-111497). The flaw enables potential remote code execution when an attacker supplies malformed Brotli-compressed input to any application using Node.js's native zlib module or the fetch() API. Three additional high-severity CVEs address TLS hostname-check bypasses and DNS null-byte truncation. End-of-life lines (Node.js 20.x and earlier) will not receive patches, leaving a significant portion of deployed infrastructure unprotected. This incident underscores the systemic risk of bundled third-party libraries in widely deployed runtimes. As supply-chain attacks and dependency exploitation become primary threat vectors, organizations running Node.js in cloud-native, microservices, or serverless environments face elevated exposure—particularly where Brotli-compressed traffic flows between internal services or from untrusted external sources.
How a GitHub Token Trapped in AI Gateway Logs Brought Down LiteLLM's Release Pipeline
On October 21, 2026, LiteLLM's release pipeline was compromised, resulting in the publication of malicious package version 1.107.0 to PyPI, Docker Hub, and GHCR. Attackers exploited GitHub CLI OAuth tokens that had been inadvertently logged by Claude Code in LiteLLM's internally exposed AI gateway deployment. Using these stolen credentials, the attacker disabled branch protections, redirected the signing workflow to a lookalike repository, and published a poisoned artifact embedding a credential stealer and a persistent RAT. Within 4.5 hours of exfiltration, attackers began validating stolen AWS credentials and performing LLMjacking reconnaissance against Bedrock and IAM services. This incident underscores an emerging and underappreciated risk: AI coding assistants and LLM gateway proxies can inadvertently log sensitive authentication tokens, creating a new credential-leak surface. As enterprises accelerate AI adoption, supply-chain attacks targeting AI infrastructure tooling are becoming a primary threat vector, demanding stricter secrets hygiene, pipeline integrity controls, and real-time egress monitoring for developer environments.
Railway's 2026 LLMjacking Breach: When PaaS Secrets Become the Attack Surface
In October 2026, Platform-as-a-Service provider Railway disclosed that an unauthorized third party accessed systems storing customer environment variables, potentially obtaining decrypted contents including API keys, database credentials, and private keys. The attacker, identified on-chain as 0xd9773325282874d18cb83f1fe50f14c39750b2ee, drained cryptocurrency wallets whose private keys were stored on Railway before the incident was publicly disclosed. Railway rotated all bucket credentials, invalidated API tokens, and urged customers to rotate all stored secrets. The campaign is assessed to be part of a coordinated series of attacks targeting PaaS platforms to compromise AI inference providers—a technique known as LLMjacking. This incident illustrates the accelerating convergence of cloud credential theft and AI resource abuse. Threat actors are systematically targeting PaaS and cloud environments not merely for data theft but to commandeer AI compute capacity, shift billing costs to victims, and build autonomous offensive AI agents—a trend that fundamentally raises the stakes for any organization hosting AI workloads or secrets in cloud-native environments.
php2shell: CISA Demands Immediate Action on Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619
In October 2026, CISA issued an urgent alert disclosing two critical unauthenticated remote code execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619 and collectively dubbed 'php2shell.' These flaws affect all PHP installations serving web requests across versions 8.1 through 8.4, enabling attackers to execute arbitrary code without any authentication. CISA directed organizations to immediately upgrade to patched releases (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35), take unpatched PHP systems offline, and monitor for PHP worker processes spawning shells or downloading attacker tooling. The breadth of PHP's deployment across web infrastructure makes this a high-severity, wide-blast-radius exposure. The php2shell vulnerabilities underscore an accelerating trend of attackers targeting foundational web runtime components rather than application-layer logic. As exploit weaponization timelines compress from weeks to hours post-disclosure, organizations with large PHP footprints—especially those running legacy or embedded PHP dependencies—face elevated risk of pre-patch compromise through automated scanning campaigns.