In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
This content describes an advanced hunting pack for Microsoft Defender XDR designed to detect exposure to PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across Windows and Linux endpoints. The hunting queries identify active PHP processes, PHP engine DLLs, and web server activity to surface devices potentially running vulnerable PHP versions. The pack focuses on onboarded endpoints with a 30-day event lookback and does not cover dormant or unmanaged devices. It is intended to supplement existing IOC hunting methods by providing targeted detection of PHP2Shell exposure.
In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.
In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.
This issue affects Apache Abdera: all versions.
Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
DarkCore is a newly discovered Remote Access Trojan (RAT) that facilitates credential theft, hidden desktop access, and session hijacking through a dedicated browser. It reuses stolen session cookies to access services like Gmail, WhatsApp, and MediaFire, routing traffic through victims' IP addresses to appear legitimate. The malware is distributed with a deceptive PDF-themed shortcut that downloads both a decoy document and a malicious executable. Operators can control infected machines via hidden virtual network computing (HVNC) and extend functionality through additional modules. The RAT communicates with a hardcoded command and control server and disguises itself using legitimate Windows process names. No official patch or remediation guidance is currently available.
A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, allow remote code execution on vulnerable systems. Attackers began exploiting these flaws four days before official patches were released on October 21, 2026. The PHP security team accelerated the patch release after some exploit details leaked online. Multiple unsuccessful exploitation attempts were detected before public disclosure, but since patch release, the vulnerabilities are broadly exploited in the wild. The PHP team and UK NCSC strongly urge immediate patching or taking servers offline until patched. The vulnerabilities affect PHP installations widely used across the internet, including popular CMS platforms. The vendor advisory states that applying official patches is the only permanent mitigation.
AWS Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) starting on October 17, 2026, four days before the public disclosure and patch release on October 21, 2026. Multiple actors used anonymized infrastructure to target honeypots and real systems, with proof-of-concept exploits appearing immediately after the embargo lifted. Fixed PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address these vulnerabilities, with backports available for versions 7.4 through 8.1. The event highlights the shrinking window between patch release and exploitation and the need for proactive detection and investigation starting before public disclosure.
The PyPI package '1h1' version 1.0.0 is identified as malicious. During installation, it downloads and executes malware, indicating clear malicious intent including potential infostealing. This package is associated with typosquatting tactics to deceive users into installing it.
The aanthropic package on PyPI version 1.0.0 is identified as malicious. During installation, it downloads and executes malware, indicating clear malicious intent. This package is associated with a typosquatting campaign designed to trick users into installing harmful software.
CVE-2026-115246 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the file patdocmsg.php. The vulnerability arises from improper handling of the 'Query' argument, allowing remote attackers to execute script code. The issue has been publicly disclosed and exploit code is available. The project has been notified but has not issued a response or fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
Indurex, an Amsterdam-based industrial cybersecurity company, has raised $8 million to fund research and development and expand its commercial operations in Europe and the Middle East. The company develops the SafeGuard AI platform, which analyzes data from industrial control systems and safety instruments to identify anomalies and configuration changes that may require operator attention. Indurex aims to address gaps in conventional operational technology (OT) security tools by integrating engineering, process, safety, and cybersecurity data for better contextual alert assessment. The funding will support expansion into additional markets including the United States and Asia-Pacific.
Shadow AI refers to the unauthorized and ungoverned use of AI tools and models within enterprise environments, spanning from simple chatbots to complex autonomous agents and local AI models. This phenomenon has grown significantly, creating blind spots in security and increasing risks such as data loss, operational disruption, and regulatory fines. Shadow AI incidents have more than doubled recently, with associated breach costs exceeding the global average. Enterprises face challenges detecting and controlling shadow AI due to its diverse forms and rapid adoption outpacing governance. Mitigation involves employee training, establishing AI usage policies, and integrating shadow AI management into exposure management programs.