What this means for your clients: a common piece of code that unpacks compressed web traffic has a serious flaw, and it hides inside apps and scripts that normal update checks do not see, so someone has to go looking for it. Picture a client's customer portal, built two years ago by a contractor and running on Node.js inside a container nobody has rebuilt since. This week the compression code inside it became a real risk, and your patch dashboard may well miss it. The fla

What this means for your clients: in our sandbox we built the last vulnerable and first fixed PHP 8.5 releases and sent the advisory's own trigger to both under Apache mod_php. On the vulnerable build the Zend memory manager flagged its own heap as corrupted and the worker aborted. On the fixed build the same input was handled cleanly and the worker stayed up. That is strong evidence the update works, not proof against every attack path, so patch now. Update, Oct 24, 2026: We

Update, 30 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26. Dream Research reports a campaign that chained a custom PHP2Shell exploit with the Linux kernel flaw CVE-2026-46300, which it calls Fragnesia, and rooted 25 Palo Alto Networks PAN-OS firewall and management servers. Dream says the attacker targeted the PAN-OS 12.1 and 12.2 branches running PHP 8.0.30, and that the exploit was built for PAN-OS and was not a copy of

The cyber threat landscape is a constantly evolving space where new vulnerabilities are discovered and old ones are patched up. However, the cat-and-mouse game between attackers and defenders often leads to gaps in security, which can be ruthlessly exploited. A recent example of this is the discovery of a critical heap-based buffer overflow vulnerability in Fortinet FortiOS and FortiProxy SSL-VPN devices, dubbed CVE-2023-27997. This post aims to delve into the details of this