Latest web security news, vulnerabilities, CVEs, and threat intelligence collected periodically from external sources.
Discover how over 1,000 WordPress sites have been infiltrated by sophisticated JavaScript backdoors, allowing attackers persistent access. Learn about the intricate methods used and how to protect your site.
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet, and why this particular security flaw is so serious? PHP is a programming language widely used to build websites and web applications. It powers a significant share of the web. PHP2Shell is serious because it can allow…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online – Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog . Collabora Online – Built-in CODE Server is an app for Nextcloud that lets you open, edit and collaborate on documents, spreadsheets and presentations directly in your browser, without needing Microsoft Office installed on your comp…
CVEs: CVE-2026-110447
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek .
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10. Why this matters PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many o…
CVEs: CVE-2026-109618, CVE-2026-109619
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild. Image: Shutterstock.com, Sashkin. The flaws at issue are present in PHP , the programming language that powers sites running on a large number of web publishing systems, including Drupal , Magento , Joomla and WordPress . Earlier today, PHP releas…
Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both "Does this request look malicious?" and "What happened when the application handled it?" Response rules can then block the origin’s response before it reaches the requester. These are valuable protections because the latest frontier models are uncovering vulnerabilities buried deep in widely used softw…
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell . The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. Cloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation , OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewal…
CVEs: CVE-2026-109618, CVE-2026-109619
Executive Summary PHP2Shell is two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) that can allow unauthenticated remote code execution on PHP installations serving web requests. Researchers have also demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens, and API keys. Cloudflare has already reported attack traffic, including attempts to evade its protections. Updating is the only complete fix: prioritize internet-facing deployments, starting with Apache mod_php, and assign an owner and remediation deadlin…
CVEs: CVE-2026-109618, CVE-2026-109619
Improper use of wildcard subdomains in CORS configurations is leading to cross-origin data theft and privilege escalation.
Attackers are increasingly targeting undocumented and untracked APIs to perform unauthorized data access via BOLA.
A new method for bypassing Web Application Firewalls uses HTTP chunked encoding to hide malicious payloads from inspection engines.
A vulnerability in OIDC middleware allows attackers to hijack user sessions by exploiting weak state parameter validation.
New JavaScript supply chain attacks are using fake TypeScript definition files to deliver malware during the build process.
Discover how cybercriminals are targeting web browsers to hijack sessions, steal data, and bypass security measures. Join our expert-led webinar on September 29 to learn actionable strategies for securing your enterprise's web edge.
Discover the top 6 browser-based cyber attacks targeting users in 2025. Learn why these attacks are surging, how they work, and what security teams can do to mitigate risks effectively.
Discover how browser extensions can enhance productivity while posing significant security risks like data exfiltration and AitM attacks. Learn how to gain visibility, enforce policies, and block risky add-ons in real time to safeguard your organization.
Explore how cybercriminals like Scattered Spider are targeting enterprise browsers, contributing to over 80% of security incidents. Learn about the evolving threat landscape, mitigation strategies, and the importance of browser security in modern cybersecurity frameworks.
Google addresses authentication failures affecting Clever and ClassLink logins on ChromeOS devices. Discover the latest workarounds, causes, and steps to resolve these issues for seamless access.
CVEs: CVE-2025-54309, CVE-2025-6558, CVE-2025-2776, CVE-2025-2775, CVE-2025-6554
Discover how Brave Browser 1.81 is enhancing user privacy by blocking Microsoft Clarity's screenshot feature. Learn about the latest updates and their impact on cybersecurity.
Discover why Arch Linux users are being advised to delete Firefox forks from the Arch User Repository due to recent malware threats. Learn how to protect your system and stay secure.
Google has released a critical security update for Chrome to address multiple vulnerabilities, including an actively exploited zero-day flaw. Learn more about the implications and how to stay protected.
CVEs: CVE-2023-1234, CVE-2023-1235, CVE-2023-1236, CVE-2023-1237, CVE-2023-1238
Discover the significance of Let's Encrypt issuing certificates for IP addresses. Learn about the benefits, risks, and best practices to stay secure online.
CVEs: CVE-2025-6554
Learn about the recently patched Google Chrome zero-day vulnerability CVE-2025-2783, exploited by TaxOff to deploy the Trinper backdoor. Discover the details and impact of this security flaw.
CVEs: CVE-2025-2783
CVEs: CVE-2025-5419
Google quickly patches a high-severity Chrome zero-day vulnerability exploited in recent cyber attacks. Learn about the threat, the fix, and how to stay secure.