Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit BlueTeam

Reddit ThreatIntel

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

auth0-php

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

CVE-2026-34236 identifies a cryptographic weakness in the Auth0-PHP SDK, specifically versions from 8.0.0 up to but not including 8.19.0. The vulnerability stems from insufficient entropy used during the encryption of session cookies. Entropy is critical in cryptographic operations to ensure keys are unpredictable and resistant to brute-force attacks. In this case, the low entropy reduces the keyspace, allowing threat actors to feasibly brute-force the encryption key protecting session cookies. Successful exploitation enables attackers to forge valid session cookies, effectively bypassing authentication controls and impersonating legitimate users. This compromises both confidentiality and integrity of user sessions. The vulnerability does not impact availability and does not require user interaction, but it does require network access to the affected application. The CVSS v3.1 score is 8.2, reflecting high severity due to the potential for complete session takeover with relatively low privileges. The issue has been addressed in Auth0-PHP version 8.19.0, which increases entropy in the encryption process to prevent brute-force attacks. No public exploits have been reported yet, but the vulnerability poses a significant risk to any web applications using the affected SDK versions for authentication and session management.

Detailed information about CVE-2026-34236: CWE-331: Insufficient Entropy in auth0 auth0-PHP affecting auth0 auth0-PHP. Get real-time updates, technical details,

CVE-2026-34236: CWE-331: Insufficient Entropy in auth0 auth0-PHP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-34236: CWE-331: Insufficient Entropy in auth0 auth0-PHP

Threats Tagged 'cve-2026-34236'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-34236'

Lead Pen Test Professional