General cybersecurity news and analysis
PHP has warned of a new vulnerability, CVE-2026-115560, that could allow remote code execution in certain web applications with a specific, uncommon setup. The company will address the issue in its next regular release, rather than issuing an emergency fix, as the risk is considered unlikely to affect most users.
A critical flaw in the x402 SDK could let hackers drain the entire token balance of AI agents with a single, cleverly crafted API request, making it essential to update to the patched version released on August 18. This shocking vulnerability was just one of 25 flaws discovered in the x402 codebase, with three rated critical.
A vulnerability in the Pillow image library, tracked as CVE-2026-112900, allows attackers to execute remote code by exploiting a weakness in EPS image filename verification, affecting versions from 2.6.0 to 12.3.0. This flaw was fixed in Pillow 13.0.0, released on October 16.
Tribal governments are taking a crucial step towards digital sovereignty by investing in network infrastructure, recognizing that a strong foundation is essential for all other IT investments to succeed. By building a solid network, tribes can unlock self-determination in the digital age and pave the way for advanced capabilities like AI and cybersecurity.
The AI Cyber Defense Act aims to safeguard American AI progress by directing NIST to develop standards and best practices that prevent distillation attacks, a growing threat from adversaries like China. This bipartisan bill takes a proactive stance against AI theft, giving the US a critical edge in building essential safeguards.
eMudhra is exiting the global SSL/TLS certificate business due to concerns over certificate security, specifically the discovery of eight weak intermediate CA certificates with private keys that could be easily compromised. The company will replace affected customers' certificates with free ones from partner providers.
A critical GitLab flaw, tracked as CVE-2026-110264, allows unauthenticated users to execute arbitrary code on the server, posing a severe threat to organizations running self-managed infrastructure. This vulnerability has been affecting GitLab releases for a staggering 12 years, from version 7.0 to the current 19.x branches.
eMudhra is exiting the global SSL/TLS certificate business, citing intense scrutiny, rising costs, and competition from free providers, despite the division only accounting for 1 percent of its global revenue. The move allows the company to focus on more profitable ventures.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
As data moves across clouds, vendors, and AI systems, encryption's limitations leave hospitals, banks, and government agencies vulnerable - and that's a problem, since they can't operate with permanently unreadable data. Encryption protects data at rest and in transit, but fails when data is processed, leaving it exposed when it matters most.
Critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been patched in the latest PHP updates, and experts warn that immediate action is required to prevent remote code execution attacks. All PHP users should update to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to safeguard against these threats.
eMudhra's certificate business has been axed after a shocking security lapse: the private keys of eight intermediate certificates were compromised due to laughably weak randomness, allowing researchers to easily compute them in seconds. The normally gargantuan private numbers were instead ridiculously tiny, with one being just the number 4.
Federal agencies are struggling to keep up with AI access security challenges as AI systems become more autonomous and operate at unprecedented speeds, leaving many unsupervised and vulnerable to exploitation. Agents can now process data and act at scale, creating a new tempo of risk that outpaces human capabilities.
Microsoft is giving you a lifeline: a temporary workaround to keep your Exchange Online EWS apps running until the final shutdown on April 1, 2027, after which the Exchange Web Services API will be blocked by default.
Don't wait - update your PHP security measures now to avoid a potentially disastrous vulnerability that allows unauthenticated remote code execution. A simple application update won't cut it, as the fix requires updating PHP itself and restarting related services.
A critical flaw in OpenCode's MCP sign-in flow, rated 9.8/10 in severity, allows malicious MCP servers to execute code, posing a significant threat to users. This vulnerability was privately reported on August 29 and publicly disclosed on October 19, with a fix released in version 1.18.33 on September 28.
A security audit of a major US pharmacy retailer uncovered a shocking lapse in security: a Cisco edge firewall with an administrator password that was simply "password". This alarming oversight was discovered by Dahvid Schloss, a penetration-testing specialist, during a routine review of the company's network configurations.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
A single malicious connection can crash many HTTP/3 servers due to flaws in QPACK header compression, which allows attackers to send a small batch of compressed headers that expand into a much larger set, overwhelming the server's memory. This vulnerability can be exploited with a relatively simple attack, and experts warn that the impact could be significant.
A critical flaw in Node.js's Brotli decoder could let hackers execute remote code - but fortunately, a patch has been released to fix this vulnerability. The update tackles an out-of-bounds write issue that occurs when decompressing maliciously crafted Brotli data.
The alarming truth is that while nearly every organization has made the cloud transition, most are still struggling to keep up with security - a whopping 93% of organizations now run production workloads in the cloud, yet only 40% have an advanced or optimized cloud security strategy in place. Misconfiguration, a preventable threat, is a gaping hole sitting in many accounts, waiting to be exploited.
A routine key generation event turned into a security stumble for eMudhra when a flaw produced a second set of easily guessable private keys, putting certificate security at risk. The mishap occurred during a Key Generation Ceremony on April 30, 2025, despite using secure FIPS 140-2 Level 3 Hardware Security Modules.
A recent disclosure of two PHP vulnerabilities has sent shockwaves through the web community, with researchers warning that every PHP version from the last decade is affected by at least one bug. This urgent alert prompted PHP maintainers to expedite a patch release to prevent widespread exploitation.
Google Chrome is supercharging its scam defenses with a powerful new detection system, powered by Gemini, that can spot suspicious sites and alert users before they fall victim to malicious activity. This enhanced protection will evaluate multiple signals, including brand authenticity and page intent, to help keep users safe online.
A critical GitLab flaw, rated 10.0 on the CVSS scale, leaves self-managed servers vulnerable to unauthenticated code execution, affecting every release since 2014. This severe vulnerability can allow attackers to run arbitrary code under certain conditions, making swift patching a top priority.
CISO burnout isn't just a personal issue, it's a red flag exposing deeper organizational flaws that demand a structural fix, not just a wellness program. Sustainability must be baked into an organization's DNA, not left to individual coping mechanisms.