PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
October 21, 2026
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass
Application Security
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94 minutes before detection.
Public Exploit Released for Critical FortiSIEM Flaw CVE-2026-106173
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 unauthenticated path traversal flaw in Fortinet FortiSIEM that leads to code execution.
OpenCode Silently Patched Critical RCE Flaw With No CVE
Pillar Security says OpenCode fixed a critical MCP OAuth remote code execution flaw in version 1.18.33 without a CVE or advisory, hiding it from scanners.
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
Attackers who breached TeamUpdraft used stolen UpdraftCentral keys to plant backdoor plugins on WordPress sites, Patchstack found; fixed releases are out.
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Siemens confirmed attackers exploited CVE-2026-110936 in Software Center, bundling a signed copy with malicious DLLs in the ROMULUS ClickFix campaign.
Laravel TokenGuard Flaw Lets Attackers Log In as Any User
Laravel disclosed a critical TokenGuard authentication bypass rated CVSS 9.2 that affects MySQL and MariaDB apps, plus a moderate data-loss flaw; patches exist.
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no exploitation is confirmed.
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and Cummins.
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping a cryptominer and proxy tool.
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
October 21, 2026
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94
Public Exploit Released for Critical FortiSIEM Flaw CVE-2026-106173
October 21, 2026
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 unauthenticated path traversal flaw in Fortinet FortiSIEM that leads to code
OpenCode Silently Patched Critical RCE Flaw With No CVE
October 21, 2026
Pillar Security says OpenCode fixed a critical MCP OAuth remote code execution flaw in version 1.18.33 without a CVE or
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
October 20, 2026
Attackers who breached TeamUpdraft used stolen UpdraftCentral keys to plant backdoor plugins on WordPress sites, Patchstack found; fixed releases are
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
October 20, 2026
Siemens confirmed attackers exploited CVE-2026-110936 in Software Center, bundling a signed copy with malicious DLLs in the ROMULUS ClickFix campaign.
Laravel TokenGuard Flaw Lets Attackers Log In as Any User
October 20, 2026
Laravel disclosed a critical TokenGuard authentication bypass rated CVSS 9.2 that affects MySQL and MariaDB apps, plus a moderate data-loss
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
October 20, 2026
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
October 20, 2026
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
October 19, 2026
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.