CVE-2026-122192 is a vulnerability in Firecracker versions 0.23.0 through 1.16.1 that allows a root user in a guest VM to read or modify memory of the Firecracker process on the host. This occurs when restoring VMs from snapshots using the File memory backend with a balloon or virtio-mem device, due to a failed memory remapping operation that leaves stale host virtual address references. The issue is fixed in Firecracker versions 1.16.2 and 1.17.0 and later. AWS Lambda and other AWS services are not affected. No customer action is required for AWS-managed services.
This is a research dashboard providing dated evidence and detailed case studies on global cyber incidents across multiple sectors including critical infrastructure, finance, healthcare, and AI. It compiles 18 incident dossiers with evidence classifications, source links, and tools for infrastructure dependency analysis and emergency preparedness. The dashboard is a static snapshot as of November 2, 2026, and is not a live alerting service.
Two serious vulnerabilities were found in the Rust zip crate, a widely used library for handling ZIP files. The first (RUSTSEC-2026-0367) allows privilege escalation by preserving dangerous file permission bits (setuid, setgid, sticky bit) when extracting archives, potentially enabling attackers to plant setuid-root files. The second (CVE-2026-115905) is a critical remote code execution flaw caused by inconsistent handling of file names between the central directory and local headers in ZIP archives, allowing arbitrary file overwrite and execution. Both vulnerabilities are fixed in version 9.0.5 of the zip crate. The advisory emphasizes that patching alone is insufficient and advocates architectural security using deny-by-default sandboxes to contain untrusted code and limit the impact of such vulnerabilities.
JNISleuth-MCP is an open-source tool designed to assist analysts in unpacking and analyzing stripped Android native (.so) malware libraries. It automates the recovery of JNI RegisterNatives bindings, deobfuscates ARM64 OLLVM indirect branches, and bypasses anti-Frida tracing techniques using a stealth Dobby agent. The tool integrates with reverse engineering platforms like Ghidra and IDA Pro to provide unified cross-boundary analysis from Java to native code, facilitating malware triage and research.
CVE-2026-111497, known as Node2Shell, HTTP2Shell, or Broccoli2Shell, is a remote code execution vulnerability in the Brotli decoder used by official, unmodified Node.js builds. A malformed Brotli compressed request body can trigger an out-of-bounds write, resulting in a shell on the target system. This has been reproduced on x86-64 systems against multiple Node.js targets including plain node:http, official slim images, Express 5.3.0, and Koa 3. The vulnerability arises from improper handling of block switches in Brotli streams, leading to memory corruption and arbitrary code execution. A public scanner is actively mapping Brotli-capable hosts, indicating reconnaissance activity preceding exploitation.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
This is a research survey investigating burnout, cognitive workload, and alert fatigue among security operations personnel such as SOC analysts, incident responders, and threat hunters. The survey is anonymous and voluntary, aiming to gather data on workplace factors contributing to these issues in security operations centers. There is no indication of a security vulnerability or threat in this content.
This content describes a free, comprehensive, and open-source exploit development curriculum covering C programming, x86-64 assembly, reverse engineering, and advanced exploitation techniques. It is intended as an educational resource for beginners and security researchers to learn exploit development from the ground up. The curriculum is not a vulnerability or exploit itself but a learning tool.
This content describes a technical walkthrough and approach to scaling security alert automation using agents and ChatOps, specifically integrating AWS GuardDuty findings with Slack for distributed alert triage. It addresses challenges in mapping alerts to human owners, especially for host and infrastructure events lacking direct user identity in the alert payload. The approach uses an AI agent to automate investigation steps, owner identification, and alert response workflows, reducing manual effort and improving scalability. This is a security automation methodology rather than a vulnerability or exploit.
Rockstar Games has suffered multiple confirmed security compromises from 2018 through 2026, involving diverse attack vectors rather than zero-day exploits. These include MFA fatigue attacks, exploitation of hardcoded credentials in collaboration tools, stolen OAuth tokens from third-party SaaS vendors, and reverse-engineered P2P network vulnerabilities leading to remote code execution. The most severe incident in August 2026 involved exfiltration of a playable GTA VI development build and extensive gameplay data due to failures in internal segmentation and data loss prevention. The attacks highlight systemic weaknesses in identity management, token security, and internal network controls.
This content is an invitation to a Reddit Ask Me Anything (AMA) session hosted by IBM Security experts Jeff Crume and Guido Crucq. They discuss cybersecurity trends and findings from the Cost of a Data Breach Report, which analyzes real-world data breaches. No specific vulnerability, exploit, or active breach details are provided.
Polish dental software vendor FELG Dent suffered a data breach involving patient records and received a ransom demand. An attacker exploited insecure API endpoints to access sensitive patient and staff data, including personal identifiers and medical information. FELG estimates about 2 million patient records were affected. The attacker claims to hold about 10% of the database and threatens to sell it on a dark web forum after failed ransom negotiations. FELG has notified Polish authorities and is assisting affected dental practices with breach notifications under GDPR.
A critical remote code execution (RCE) vulnerability chain has been demonstrated affecting OpenBao and HashiCorp Vault. OpenBao has released patches in versions 2.6.3 and 2.7.0 to fully mitigate the issue. However, HashiCorp Vault remains exposed due to a lack of coordinated disclosure and official mitigation. The exploit requires only unauthenticated access and a specific Raft snapshot policy to achieve full server compromise. This is the second RCE ever found in Vault's codebase and is considered highly plausible in real-world environments.
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
This writeup describes a vulnerability chain starting from leaked account credentials leading to remote code execution (RCE) on a web server. The attacker discovered exposed functions without rate limiting that allowed enumeration of valid accounts and credential leakage. Using the leaked credentials, the attacker gained account access and found a file upload feature that accepted .shtml files. Leveraging Server-Side Includes (SSI) support, the attacker executed server-side commands and bypassed firewall restrictions to achieve RCE. The vulnerabilities were responsibly disclosed and patched.
CyberCodex v3.2 is an open-source Python CLI tool designed to aggregate cyber threat intelligence (CTI) from 22 public sources without requiring API keys. It provides live enrichment of indicators of compromise (IOCs) and hashes, vulnerability prioritization using MITRE CVE data combined with exploitation probability scores, and telemetry on infostealers and breaches. The tool also includes offline encyclopedic data on advanced persistent threat (APT) operations and actor profiles, supporting multiple languages and exporting data in Markdown or JSON formats.
CyberCodex v3.2 is an open-source, zero-dependency command-line interface (CLI) tool that aggregates 22 free threat intelligence, infostealer telemetry, and OSINT feeds. It enables security teams to perform domain and credential exposure checks, infrastructure and DNS telemetry, and offline cyber warfare correlation with detection rule generation. The tool integrates data from sources such as HaveIBeenPwned, Hudson Rock, Shodan InternetDB, RIPE BGP, EPSS, and CISA KEV, providing a unified interface without requiring API keys or external dependencies.
CVE-2026-79417 is a local denial-of-service vulnerability in Argus Monitor caused by an exposed IOCTL that allows unprivileged users to disable the x86 MONITOR and MWAIT instructions. Exploiting this vulnerability requires leveraging a time-of-check to time-of-use (TOCTOU) bug related to the SeLocateProcessImageName function. Successful exploitation triggers a HYPERVISOR_ERROR bugcheck, impacting Hyper-V and other kernel components that rely on these instructions.