Vulnerabilities
9 storiesThreat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
Two critical PHP flaws with working exploits threaten roughly 70% of websites; enterprises running any PHP-based CMS or API layer should treat patching as a P0 incident.
Unit 42 (Palo Alto)9/10GitLab warns of new max severity code execution vulnerability
GitLab discloses a CVSS 10 regex-compiler RCE affecting self-managed instances — any European enterprise using GitLab as its DevOps backbone faces potential full server takeover and supply-chain contamination.
BleepingComputer9/10Widespread PHP Flaw May Cause Many Site Outages Today
Krebs reports working exploits are circulating for the critical PHP flaws, with nearly 70% of websites needing updates—expect widespread 404 errors as admins race to patch before attackers can seize server control.
Krebs on Security9/10Two critical RCEs in PHP core
Two critical RCE flaws in PHP core threaten the vast ecosystem of PHP-powered web applications; Snort detection rules are already available, but patching the runtime across containerised and legacy deployments should be treated as an emergency.
Cisco Talos9/10[NEU] [hoch] Splunk SOAR: Mehrere Schwachstellen
BSI flags high-severity Splunk SOAR vulnerabilities enabling privilege escalation, XSS, and security bypass—compromising the automation platform that many SOCs depend on for incident response.
CERT-Bund (BSI)9/10HPE patches eight max severity RCE and auth bypass AOS flaws
HPE disclosed 72 ArubaOS vulnerabilities including eight CVSS-10 auth-bypass and RCE flaws — enterprises running Aruba switching or wireless infrastructure face unauthenticated remote takeover risk until patched.
BleepingComputer9/10[NEU] [hoch] Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
BSI flags a high-severity Oracle Java SE, GraalVM, and OpenJDK vulnerability letting remote unauthenticated attackers bypass security controls—enterprises should fast-track JDK updates across all runtime environments.
CERT-Bund (BSI)8/10CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
CISA warns that attackers are chaining four Plex Media Server flaws for full server compromise — a reminder that shadow-IT media services on corporate networks create exploitable blind spots.
BleepingComputer8/10[UPDATE] [hoch] NoMachine: Mehrere Schwachstellen
BSI rates multiple NoMachine flaws as high severity — RCE, privilege escalation, and security bypass threaten any enterprise using it for remote desktop access, especially in hybrid-work setups.
CERT-Bund (BSI)7/10
Threat Intel
6 storiesMicrosoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
Microsoft attributes the ConnectWise supply-chain breach to a Chinese state group deploying ARTEX AI agents — marking one of the first documented cases of nation-state adversaries using autonomous exploitation tooling at scale.
The Record9/10ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
Wiz tracks Storm-0940 deploying ARTEX, an AI-driven attack agent, against software vendors' identity infrastructure — Okta, Entra ID, and Cognito — with detailed log artefacts published for defender action.
Wiz Blog9/10PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Active exploitation of PHP2Shell CVEs against a European government entity—augmented by agentic AI for post-exploitation—marks the first documented campaign where AI materially accelerated attacker operations on EU critical infrastructure.
THN (Feedburner)9/10Bring Your Own Vulnerable Driver: What Detection Teams Should Actually Hunt
SentinelOne breaks BYOVD-based EDR-killer attacks into four huntable behaviour stages, giving detection teams a practical framework to catch driver abuse before ransomware payloads deploy.
SentinelOne Blog8/10Decades-Old Windows Utility Powers Modern ClickFix Attack
Attackers chain SEO-poisoned Google results, fake CAPTCHAs, and the legacy Windows 'finger.exe' LOLBin to deliver the Lumma infostealer — a reminder that dormant OS utilities remain live attack surface.
Dark Reading8/10Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Over 300 Tor exit relays were hijacked to man-in-the-middle SSH connections and steal passwords—a stark reminder to enforce key-based authentication and never rely on Tor for transport confidentiality.
THN (Feedburner)8/10
Research
4 storiesSigned, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication
SpecterOps researchers demonstrated that NTLM relay attacks can bypass LDAP and SMB signing through re-authentication on attacker-owned connections — undermining a mitigation many enterprises have relied on for years until Microsoft's recent fix.
SpecterOps9/10Structural cryptanalysis of classic McEliece: Assessment of claims, costs and evidence
Fresh cryptanalytic progress against Classic McEliece — including subexponential distinguishers — prompts a reassessment of this NIST post-quantum finalist's real-world security margins.
arXiv Crypto & Security9/10SPECTER: Covert Data Exfiltration from Air-Gapped Systems via USB Power Modulation
SPECTER demonstrates post-compromise data exfiltration from air-gapped networks by modulating USB port power states — extending the known catalogue of covert channels that defenders of classified or OT-segregated environments must account for.
arXiv Crypto & Security9/10Possible new Cellebrite iPhone Radio Zero-Day
A leaked Cellebrite document describes a new 'Advanced Unlocks' capability reportedly exploiting an iPhone radio-stack zero-day — a potential game-changer for mobile-device security assumptions in executive-protection and sensitive-enterprise contexts.
Schneier on Security9/10
AI Security
4 storiesExposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Researchers exposed 'Phantom,' an agentic AI framework used by INC and Gentlemen ransomware affiliates to automate full intrusion chains — marking a significant escalation in adversary automation capability.
THN (Feedburner)9/10KNOX: Hardware-assisted Regulatory Sandbox for Generative Models
Researchers propose using hardware enclaves to build technically enforceable regulatory sandboxes for generative AI — filling a gap the EU AI Act leaves open on implementation specifics.
arXiv Crypto & Security8/10Penumbra: Sample-Efficient Adversarial Search for Regulatory Obligations
Penumbra uses adversarial search to find regulatory obligation violations by AI agents that leave no lexical trace — targeting omissions in finance, healthcare, and legal workflows.
arXiv Crypto & Security8/10Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents
Researchers show that popular coding agents' context-compaction step destroys provenance metadata, letting injected instructions survive as trusted memory — a new supply-chain vector for AI-assisted development.
arXiv Crypto & Security8/10
DevSecOps
3 storiesNo Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild
Empirical analysis of 78K SBOMs reveals most lack dependency edges entirely, meaning vulnerability reachability and impact analysis built on them are unreliable—a critical gap as CRA mandates approach.
arXiv Crypto & Security9/10The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass
Sonatype demonstrates that re-encoded versions of distrusted eMudhra certificates bypass Java's blocked.certs fingerprint check — a systemic weakness that undermines certificate revocation for enterprise Java stacks.
Sonatype Blog9/10A Protected Browser Doesn't Mean Your Enterprise Is Remediated
Sonatype warns that browser-only revocations after the eMudhra CA incident leave server-side trust stores, CI/CD pipelines, and embedded systems still chaining to compromised roots — a blind spot most enterprises have not yet addressed.
Sonatype Blog8/10
Regulatory
1 storyCloud
1 storyCompliance
1 storyBoardroom Brief
What this week's reporting means for the board, in one line per story.
- No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild
Most software bills of materials in circulation lack the dependency data needed for reliable vulnerability analysis, creating blind spots in supply-chain risk management ahead of CRA deadlines.
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
Two critical PHP vulnerabilities with active exploits threaten most of the web; immediate enterprise-wide patching is required to prevent server takeover.
- Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese state group used AI-driven automation to compromise ConnectWise at scale — enterprises relying on remote management software face elevated supply-chain risk.
- GitLab warns of new max severity code execution vulnerability
A maximum-severity vulnerability in GitLab could allow attackers to execute code on servers hosting our source code and CI/CD pipelines.
- Widespread PHP Flaw May Cause Many Site Outages Today
Working exploits for PHP vulnerabilities affecting 70% of websites are circulating—full server compromise is possible without immediate patching.
- ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
A nation-state-linked group is using an AI-powered attack tool against the identity systems that protect enterprise cloud access — detection and hardening are urgent.
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass
Java's certificate revocation mechanism can be trivially bypassed, leaving enterprise applications potentially trusting certificates from a distrusted authority.
- Two critical RCEs in PHP core
Critical vulnerabilities in the PHP web-application runtime require emergency patching across the organisation's web infrastructure to prevent remote compromise.
- EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU's new Cyber Resilience Act does not guarantee patches for IoT devices past a manufacturer-chosen support window — procurement policies must fill the gap.
- Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication
A newly disclosed technique bypassed NTLM relay protections that enterprises have trusted for years — the fix is available but NTLM phase-out should be accelerated.
- Structural cryptanalysis of classic McEliece: Assessment of claims, costs and evidence
Recent academic advances may weaken a leading post-quantum encryption candidate, potentially affecting long-term crypto-migration strategies.
- SPECTER: Covert Data Exfiltration from Air-Gapped Systems via USB Power Modulation
Researchers demonstrated a new way to steal data from isolated networks via USB power modulation, challenging assumptions about air-gap security.
- Possible new Cellebrite iPhone Radio Zero-Day
A leaked document suggests a new iPhone zero-day exploiting the radio chip — review whether your executive mobile-security posture accounts for this class of threat.
- [NEU] [hoch] Splunk SOAR: Mehrere Schwachstellen
High-severity Splunk SOAR vulnerabilities could let attackers manipulate the automated incident-response platform that protects the organisation.
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Adversaries used AI-assisted tools to exploit and rapidly compromise a European government entity—expect regulators and auditors to cite this case when scrutinising your patch management posture.
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Ransomware groups are using autonomous AI to execute complete attacks at machine speed, fundamentally changing the defender's time advantage.
- HPE patches eight max severity RCE and auth bypass AOS flaws
Eight maximum-severity flaws in HPE Aruba network equipment allow unauthenticated takeover — immediate patching is required across all affected infrastructure.
- KNOX: Hardware-assisted Regulatory Sandbox for Generative Models
A research-backed approach to building the regulatory sandboxes the EU AI Act requires could accelerate compliance timelines for enterprises deploying high-risk AI.
- Penumbra: Sample-Efficient Adversarial Search for Regulatory Obligations
AI agents can violate regulations by omission with no visible trace — targeted adversarial testing is needed before deploying agents in regulated sectors.
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated
Revoking a compromised certificate authority in browsers alone leaves servers and build systems exposed — a broader trust-store audit is needed.
- [NEU] [hoch] Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
A high-severity Java vulnerability affects virtually every enterprise running JVM workloads—fast-track patching reduces risk of data compromise.
- [UPDATE] [hoch] Google Cloud Platform (GKE containerd): Mehrere Schwachstellen
Critical container-runtime flaws in Google's managed Kubernetes service require immediate patching to prevent workload compromise.
- Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents
AI coding assistants may unknowingly carry forward attacker-injected instructions through a newly discovered trust gap in their memory management.
- 23andMe successor settles with California for $6 million over cybersecurity failings
A $6M settlement proves cybersecurity liabilities transfer to successor companies — factor this into acquisition decisions.
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Unmanaged media-server software on corporate networks is being actively exploited as an entry point by threat actors.
- Decades-Old Windows Utility Powers Modern ClickFix Attack
Attackers are weaponising decades-old built-in Windows tools to bypass modern defences, underscoring the need for endpoint hardening beyond patching.
- Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers compromised 300+ Tor nodes to steal SSH passwords, underscoring the need for key-based authentication across the enterprise.
- [UPDATE] [hoch] NoMachine: Mehrere Schwachstellen
Remote-access tool vulnerabilities rated high severity could allow attackers to gain direct control of employee workstations.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.