Find what you’re looking for
Browse everything
6,838 results in Threat Reports
16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads
A critical buffer-overflow vulnerability (CVE-2026-97631, CVSS 9.5) discovered in EDK II's PXE network-boot driver has existed undetected for 16 years since a November 2010 commit. Disclosed on October 22, 2026 by TianoCore after an accidental early exposure via a public GitHub pull request, the flaw allows an adjacent-network attacker to crash or hijack firmware execution before Secure Boot activates—requiring no credentials and no prior access. Every server relying on PXE boot and built on EDK II—spanning AMI, Insyde, Phoenix, and Microsoft Project Mu firmware—is potentially affected. Red Hat, SUSE, and Debian have confirmed vulnerable packages with no patched release yet available. With no stable patched EDK II release yet shipped and patch-derived exploit research already possible, data-center operators face an unmitigated firmware-layer attack surface. The incident echoes PixieFail (2024) and underscores a systemic pattern: supply-chain firmware components accumulate critical flaws that propagate silently across entire server ecosystems, making network-layer controls and boot-time traffic monitoring essential compensating measures while vendors work through patch delivery cycles.
CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release
Within 24 hours of Oracle releasing its October 2026 Critical Patch Update, threat actors began actively probing CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Thin Client Framework servlet. Discovered by Horizon3.ai researchers and disclosed to Oracle on July 24, 2026, the flaw allows any attacker with network access to chain SQL execution as the APPS database user into full operating-system command execution on the EBS application host—potentially exposing financial, payroll, HR, and procurement records. Threat intelligence firm Defused Cyber confirmed live exploit probes against honeypot decoys on October 27, 2026, just one day after the patch dropped. This incident continues a pattern of rapid weaponization of Oracle EBS vulnerabilities. Two prior critical flaws in the same product—CVE-2025-61882, exploited by the Cl0p ransomware group, and CVE-2026-46817—both carried CVSS 9.8 scores and were actively exploited in the wild, underscoring that EBS environments are high-value, repeat targets requiring accelerated patch cycles and compensating network controls.
ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign
In late October 2026, a newly identified ClickFix social engineering campaign was observed targeting both macOS and Windows users via a fake Cloudflare verification page hosted on the domain js-static[.]cfd. The attack chain lures victims into manually executing a malicious command copied from the spoofed page, a hallmark of ClickFix-style delivery. The campaign fingerprints the victim's OS and serves platform-specific payloads. Although the final-stage malware was not retrieved due to infrastructure errors (403 Forbidden on Windows and DNS non-resolution on macOS), the staging infrastructure and URL chain were fully documented, revealing a multi-step victim-profiling and geo-tracking mechanism prior to payload delivery. ClickFix campaigns are accelerating in 2026, with threat actors increasingly abusing trusted brand impersonation—particularly Cloudflare—to bypass user skepticism. The manual-execution lure circumvents many automated endpoint defenses, making user-targeted social engineering one of the fastest-growing initial access vectors across enterprise and SMB environments alike.
php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE
In October 2025, two pre-authentication remote code execution vulnerabilities in PHP core—CVE-2026-109618 and CVE-2026-109619, collectively dubbed php2shell—were disclosed ahead of coordinated release. Discovered by researcher Calif, the flaws exploit dangling session pointer conditions and serializer issues to achieve unauthenticated RCE against Apache mod_php and PHP-FPM deployments respectively. Exploitation is technically feasible but highly conditional, requiring precise heap layout control, ASLR bypass via information leak, and version-specific offsets. High-value targets include edge appliances with PHP management interfaces such as Palo Alto PAN-OS and Citrix NetScaler, where even DMZ-resident RCE yields meaningful attacker leverage. Php2shell highlights a persistent and underappreciated risk pattern: low-severity findings such as exposed phpinfo pages aggregate into critical exploitation preconditions. As AI-assisted exploit development accelerates N-day weaponization timelines, organizations must reassess how informational disclosures compound with memory corruption vulnerabilities to enable targeted, high-impact intrusions against network perimeter appliances.
PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE
On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities—CVE-2026-109618 and CVE-2026-109619—collectively tracked as PHP2Shell, enabling unauthenticated remote code execution (RCE) against any server running a vulnerable PHP version. CVE-2026-109618 exploits an out-of-memory condition during request parsing to corrupt heap memory before application code executes, while CVE-2026-109619 leverages stale serializer state via a use-after-free to forge malicious objects in session data. Both flaws affect all server APIs including mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Bishop Fox researchers confirmed full unauthenticated RCE against stock Apache mod_php Docker images with ASLR enabled. Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP2Shell represents a systemic risk because the vulnerability resides in PHP's core runtime engine rather than any application layer, meaning no specific feature, plugin, or misconfiguration is required for exposure. With public proof-of-concept exploits already circulating and Bishop Fox confirming reproducible RCE in lab conditions, organizations running unpatched PHP face immediate, low-barrier compromise risk across their entire web-serving infrastructure.
PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure
In late October 2026, CISA added two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell—to its Known Exploited Vulnerabilities Catalog after confirmed in-the-wild remote code execution (RCE) was recorded against unpatched Apache mod_php installations. Exploitation began four days before patches were released on October 21, 2026, with attackers targeting over 5.1 million internet-exposed PHP hosts. Honeypot evidence confirmed successful RCE against PHP 8.4.26 by October 24, prompting CISA to mandate Federal Civilian Executive Branch agencies to patch by October 30, 2026. PHP powers roughly 70% of all websites, making the attack surface extraordinarily broad. The PHP2Shell disclosures underscore a dangerous trend: vulnerability details and partial proof-of-concept code leaked before patches were available, compressing the remediation window for defenders. As attackers increasingly exploit web application RCE flaws at scale within days of disclosure, organizations running PHP-dependent workloads in cloud and hybrid environments face elevated risk of initial compromise and downstream lateral movement if network segmentation and egress controls are absent.
Apple CoreGraphics Zero-Day CVE-2026-86950: What the Backport Patches Mean for Enterprise Mobile Security
In October 2026, Apple backported emergency security patches for CVE-2026-86950, a CoreGraphics out-of-bounds write zero-day, to older iPhone and iPad models including the iPhone XS, XR, and several iPad generations. Originally patched in September 2026 for current iOS 26 and macOS Tahoe devices, the vulnerability was discovered by Meta Product Security and confirmed exploited in highly targeted, extremely sophisticated attacks against specific individuals running iOS versions prior to iOS 27. Successful exploitation allows arbitrary code execution via a maliciously crafted file, enabling full device compromise. This marks Apple's second zero-day patched in active exploitation campaigns in 2026, following CVE-2026-20700 in dyld patched in February. This incident underscores the persistent threat posed by zero-day exploits targeting mobile OS graphics and rendering frameworks, often weaponized in nation-state or mercenary spyware campaigns. The pattern of 'extremely sophisticated' language from Apple, combined with Meta's discovery role, signals continued interest from advanced threat actors in iOS as a high-value espionage platform, mirroring trends seen with Pegasus and similar commercial spyware toolchains.
Tailworm 2026: How Eleven Tailscale SSH Flaws Put Root Access One Hop Away
In October 2026, Cyberdione Labs disclosed eleven vulnerabilities—collectively named Tailworm—affecting Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. The most critical flaw resides in Tailscale's embedded SSH server, which runs as root, and allows an authorized device with a single SSH policy rule to exploit Unix-socket forwarding race conditions to gain full root code execution on target servers, capture enrollment keys, and delete arbitrary files. Additional flaws enable credential theft via cloud metadata through misconfigured app connectors, unauthenticated denial-of-service against the headscale control plane, and client memory exhaustion via malicious DERP relay responses. Tailscale confirmed the findings are serious and committed to shipping patches by end of day October 27, 2026. The Tailworm disclosure arrives as enterprises increasingly rely on software-defined mesh VPNs to connect hybrid and multi-cloud workloads, expanding the blast radius of privilege-escalation flaws. The attack chain—authorized user to root in a single hop—mirrors a broader industry trend where identity-permissioned access replaces perimeter controls without compensating runtime segmentation, making zero-trust policy enforcement and east-west traffic controls more urgent than ever.
When Trust Breaks at the Root: The eMudhra CA Compromise and What It Means for Your Encrypted Infrastructure
In October 2026, Microsoft released out-of-band Windows updates (KB5134133 and KB5134125) to remove trust in certificates tied to a critical compromise of eMudhra certificate authority infrastructure. Researchers discovered that eight eMudhra intermediate CA private keys, all generated in April 2025, were so cryptographically weak—with values smaller than 256—that they could be recovered almost instantly by any attacker testing only 256 possible numbers. The compromised keys spanned six TLS and two code-signing intermediate CAs, enabling potential forgery of trusted certificates for any website or signed software in the eMudhra chain. Microsoft removed seven root and cross-sign certificates from the Windows trust list, with Mozilla, Google, and Apple taking parallel action across their ecosystems. This incident underscores the cascading risk when foundational PKI trust anchors are weakened by poor key generation practices. As enterprises increasingly rely on certificate-based authentication, TLS inspection, and code integrity verification, a single compromised CA hierarchy can silently invalidate trust across millions of endpoints, cloud workloads, and encrypted network paths—making proactive CTL hygiene and real-time certificate monitoring non-negotiable components of modern zero trust architecture.
Magecart Hijacks Convertr Analytics Script: How One Compromised SDK Exposed Shoppers Across Dozens of Brazilian Fashion Brands
In October 2026, a Brazilian Magecart-affiliated threat group compromised Convertr, a Brazilian e-commerce platform processing over R$2 billion in annual sales, by exploiting CVE-2026-8467—an unauthenticated remote code execution vulnerability in an outdated Plausible Community Edition analytics installation. Beginning October 24, attackers injected a payment card skimmer into the shared Plausible tracker script loaded by checkout pages across all Convertr-powered merchants. The skimmer harvested card numbers, expiration dates, CVV codes, cardholder names, and Brazilian CPF tax IDs before exfiltrating them to attacker-controlled infrastructure. Convertr removed the malicious code and patched Plausible by October 27, but all shoppers transacting during the exposure window were advised to cancel their cards immediately. This incident exemplifies the accelerating Magecart supply-chain skimming trend, where a single compromised shared script propagates theft across an entire merchant ecosystem simultaneously. As e-commerce platforms consolidate checkout infrastructure, attackers gain outsized returns by targeting the shared layer rather than individual stores—a tactic that evades merchant-level security controls entirely.
How a Privileged Pod Became a Full Cloud Takeover: Inside the Konnectivity SSRF Tenant Isolation Bypass
In a responsible-disclosure penetration test of a major cloud provider, researchers demonstrated a complete tenant isolation bypass starting from a standard cloud tenant account. The attack chain began with a privileged Kubernetes pod escape on a managed k0s cluster, pivoted through a Server-Side Request Forgery (SSRF) primitive in the Konnectivity service to achieve remote code execution on the control plane, escalated to root via a known OverlayFS capability bug (Ubuntu 22.04, kernel 5.15), and then traversed a flat overlay network to compromise managed Kafka instances via exposed JMX/RMI, Redis instances via credential-leaking exporters, PostgreSQL clusters via unauthenticated etcd access, and ultimately the entire SaltStack management plane through SQL injection in a custom pillar extension—granting full control of all tenant resources, VDS, S3, and databases. All vulnerabilities were responsibly disclosed and fully remediated before publication. This incident is directly relevant now because it dismantles the widely held assumption that cloud breaches originate exclusively from tenant misconfigurations. As enterprises accelerate multi-cloud adoption and place increasing trust in managed Kubernetes, database, and messaging services, provider-side logic flaws, flat internal networks, and unauthenticated management APIs represent systemic, cross-tenant blast-radius risks that no customer-side control can mitigate alone.
Byod Ransomware Cripples UNM Health: 36,000 Systems Compromised, Surgeries Suspended
In late October 2026, the University of New Mexico Health Sciences Center suffered a ransomware attack claimed by a newly emerged threat group called Byod. The attackers reported compromising 36,000 systems across UNM's campus and hospital environments, including Active Directory forests, Microsoft Entra tenants, and Oracle databases, while exfiltrating patient records, SSNs, HR and payroll data, and Cerner EHR rosters. The attack forced ambulance diversions, suspension of outpatient surgeries, class cancellations, and temporary halts to new patient admissions. UNM's IT teams, working with external partners, restored critical systems within roughly 24 hours, determining the attack impacted end-user devices but did not penetrate core servers. This incident underscores a growing pattern of ransomware groups targeting academic medical centers, where converged IT and clinical networks create expansive attack surfaces. The Byod group's self-styled 'ethical hacker' framing—offering free decryption keys to healthcare facilities while retaining stolen data—signals an evolving ransomware playbook designed to maximize pressure while evading moral condemnation, a tactic security teams and executives must prepare for.