CISA added 8 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between 19 and 25 October 2026, 6 on 20 October and 2 on 23 October. All eight are confirmed exploited in the wild, two carry a CVSS base score of 9.0 or above from their CNA, and four have public exploit code, all of… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 19 Oct to 25 Oct 2026
PHP2Shell took six days to go from a leaked CVE number to CISA’s exploited list. The fix shipped ten hours after the first exploit tooling was seen scanning. A week later, FireCompass research across 1,000,000+ assets found that 65 percent of organisations still had at least one exposed application, and that nearly half of those… Read More »PHP2Shell Was Not the First. The Next One Is Already in Someone’s Queue
Executive summary PHP2Shell is the name given to two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. Either one allows an unauthenticated attacker to execute code on the web server with the PHP process’s privileges, before the application has run a single line. Because the flaws sit in… Read More »PHP2Shell (CVE-2026-109618, CVE-2026-109619): The Complete Guide to Exposure, Exploitation, Remediation, and Verification
This weekly cybersecurity report covers 12 to 18 October 2026, a week in which attackers got in through third-party, vendor and unmonitored access rather than through the perimeter. Attackers took over internet-exposed refrigeration controllers in about 700 French supermarkets. Sourcenext, the Japanese software company behind Pocketalk, disclosed that 22.5 million customer records including passwords may… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 12 Oct to 18 Oct 2026
This weekly cybersecurity report covers 12 to 18 October 2026, a week in which attackers got in through third-party, vendor and unmonitored access rather than through the perimeter. Attackers took over internet-exposed refrigeration controllers in about 700 French supermarkets. Sourcenext, the Japanese software company behind Pocketalk, disclosed that 22.5 million customer records including passwords may… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 12 Oct to 18 Oct 2026