PHP2Shell (CVE-2026-109618, CVE-2026-109619) is a critical unauthenticated PHP RCE. What the two bugs are, how to patch, and what ELLIO's sensors recorded on disclosure day.

Gallery of websites shut down by the October 2026 PHP vulnerabilities.

PHP's phprequeststartup() function reaches two consecutive calls in main/main.c. Line 1942 calls phphashenvironment(). Line 1943 calls zendactivatemodules().

October 21, 2026 If your website runs on PHP, check your version today. The PHP security team released emergency fixes this morning for two critical vulnerabilities, and attack tools are already circulating online. The fix: update to PHP 8.5.12, 8.4.27, 8.3.36…

No scheduled tasks. No registry keys. Just a RAT hidden behind 200 spaces in the tools developers use every day, with a Python stager…

Describing the story behind how critical security vulnerabilities were found and fixed.

Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious implant as a legitimate file. A custom file extension may be used to support phishing scen…

Over the past X months, Eye Research has been actively disabling the vulnerable update mechanism used by the popular download client PopCorn Time. This involved executing code on systems running the vulnerable software. This is the story on how we got here…

Forever caught live malware on a customer's machine attempting a new kind of attack: a file planted in the Downloads folder that turns your own AI coding agent against you. Here's how it works on Codex and Claude Code, and why the vector stays open.

Sébastien Féry told RuntimeWire that FoxIO reported the flaw through the channel in Bun's security policy and "never heard back." Bun shipped HTTP/3 security fixes Thursday in a release that doesn't mention FoxIO or the report.

Banks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks.

Cyber attacks now hit hospitals, power grids, banks and government agencies, and the tools on both sides are changing fast. Here’s a quick look at three trends I’m watching. 1. AI is changing both offense and defenseSecurity teams use AI to find and patch…

Diving into EMFI characterization on the new STM32H5 MCU. Learn how to map, analyze faults, and compare custom injection coils.

Introducing pathrunner, a modular, cloud-native offensive security framework that automates the exploitation of AWS IAM privilege escalation paths.

CVE-2026-110355: Unauthenticated SSTI in Imperia CMS 11.5.4 and earlier enables remote code execution via SiteActive's TEMPLATE parameter when PHP is available.

Over the past X months, Eye Research has been actively disabling the vulnerable update mechanism used by the popular download client PopCorn Time. This involved executing code on systems running the vulnerable software. This is the story on how we got here…

Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.

TCL 50C721 (RTD1319 / Mali-G31) root toolkit — autonomous CVE-2022-22706 exploit chain

According to CrowdStrike's report and other media coverage, hackers are using LLM-based penetration testing harnesses to hack web applications. In this article, I analyzed three open-source harnesses