Skip to content

Threat Research

Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 19 Oct to 25 Oct 2026

This weekly cybersecurity report covers 19 to 25 October 2026, a week in which the thing attackers wanted was usually access to someone else’s AI. A master key leaked in May let attackers ship a credential-stealing LiteLLM release on 21 October. An intruder at the cloud platform Railway reached environment variables in up to 100,000… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 19 Oct to 25 Oct 2026

Weekly Report New Hacking Techniques and Critical CVEs cover

Weekly Report: New Hacking Techniques and Critical CVEs 19 Oct to 25 Oct 2026

CISA added 8 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between 19 and 25 October 2026, 6 on 20 October and 2 on 23 October. All eight are confirmed exploited in the wild, two carry a CVSS base score of 9.0 or above from their CNA, and four have public exploit code, all of… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 19 Oct to 25 Oct 2026

How to Be Ready for the Next PHP2Shell: A Day-Zero Vulnerability Programme

PHP2Shell Was Not the First. The Next One Is Already in Someone’s Queue

PHP2Shell took six days to go from a leaked CVE number to CISA’s exploited list. The fix shipped ten hours after the first exploit tooling was seen scanning. A week later, FireCompass research across 1,000,000+ assets found that 65 percent of organisations still had at least one exposed application, and that nearly half of those… Read More »PHP2Shell Was Not the First. The Next One Is Already in Someone’s Queue

PHP2Shell Vulnerability Analysis: CVE-2026-109618 and CVE-2026-109619 Exposure and Remediation Guide

PHP2Shell (CVE-2026-109618, CVE-2026-109619): The Complete Guide to Exposure, Exploitation, Remediation, and Verification

Executive summary PHP2Shell is the name given to two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. Either one allows an unauthenticated attacker to execute code on the web server with the PHP process’s privileges, before the application has run a single line. Because the flaws sit in… Read More »PHP2Shell (CVE-2026-109618, CVE-2026-109619): The Complete Guide to Exposure, Exploitation, Remediation, and Verification

API Penetration Testing in 2026: Why Scanners Miss What Attackers Exploit Cover

API Penetration Testing in 2026: Why Scanners Miss What Attackers Exploit

API penetration testing that stops at scanning misses the flaws attackers actually exploit: broken authorization, forgotten endpoints, and chained attack paths. Here is what makes APIs exploitable, why traditional testing misses it, and how agentic AI pentesting finds and proves it. By FireCompass Security Team | Updated September 2026 | 10 min read #1 On… Read More »API Penetration Testing in 2026: Why Scanners Miss What Attackers Exploit

Use Cases
Technology
About
Partner
Resources

FireCompass – An EC Council Ecosystem Company.
©2025 . All Rights Reserved.

Firecompass ranked #1 AI on HackerOne. Read more →