Update, 30 October: CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26. On October 28 it added the Linux kernel flaw CVE-2026-46300, and CISA's KEV entry says that flaw can be chained with both PHP bugs to implant PHP webshells and run commands as root. Dream Research, which calls the kernel flaw Fragnesia, reports a campaign that did exactly that: a custom PHP2Shell exploit plus Fragnesia rooted 25 Palo Alto Networks P

What this means for your clients: in our sandbox we built the last vulnerable and first fixed PHP 8.5 releases and sent the advisory's own trigger to both under Apache mod_php. On the vulnerable build the Zend memory manager flagged its own heap as corrupted and the worker aborted. On the fixed build the same input was handled cleanly and the worker stayed up. That is strong evidence the update works, not proof against every attack path, so patch now. Update, Oct 24, 2026: We

Update, 30 October: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26. Dream Research reports a campaign that chained a custom PHP2Shell exploit with the Linux kernel flaw CVE-2026-46300, which it calls Fragnesia, and rooted 25 Palo Alto Networks PAN-OS firewall and management servers. Dream says the attacker targeted the PAN-OS 12.1 and 12.2 branches running PHP 8.0.30, and that the exploit was built for PAN-OS and was not a copy of

On May 31, 2023, Progress released a security advisory for their MOVEit Transfer application detailing a SQL injection vulnerability leading to remote code execution. Customers were urged to update to the latest version. This vulnerability, CVE-2023-34362, was believed to have been exploited in the wild as a 0-day dating back at least 30 days. Threat intelligence reports suggested that exploitation activity could be traced back to 2021. The attacks were attributed to the cl0p

The cyber threat landscape is a constantly evolving space where new vulnerabilities are discovered and old ones are patched up. However, the cat-and-mouse game between attackers and defenders often leads to gaps in security, which can be ruthlessly exploited. A recent example of this is the discovery of a critical heap-based buffer overflow vulnerability in Fortinet FortiOS and FortiProxy SSL-VPN devices, dubbed CVE-2023-27997. This post aims to delve into the details of this

The vulnerability CVE-2023-27350 enables remote actors to sidestep authentication and execute remote code on several versions of PaperCut installations, including: Version 8.0.0 up to 19.2.7 Version 20.0.0 up to 20.1.6 Version 21.0.0 up to 21.2.10 Version 22.0.0 up to 22.0.8 The susceptibility arises from inadequate access controls in the SetupCompleted Java class in PaperCut servers affected by CVE-2023-27350. This flaw enables malicious entities to circumvent user authentic