vulnerabilities

Cloudflare leads cyber stock rally as PHP flaws hit sites

Cybersecurity and software stocks rallied on Wednesday, October 21, after two critical flaws in the PHP programming language led governments, hospitals and businesses across Europe to take their websites offline. Cloudflare climbed more than 6%. Datadog, Okta, Zscaler and CrowdStrike…

PHP issues emergency patches for critical PHP2Shell flaws

On Wednesday, October 21, PHP's maintainers put out unscheduled security updates for two critical flaws in the language's core engine. Together the bugs are called PHP2Shell, and they let an attacker without an account run code on web servers. BleepingComputer…

You're all caught up

You've seen all the main stories from the past 2 days.

Citrix NetScaler zero-day attacks escalate to mass exploitation

Two critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway products have escalated from targeted espionage operations into widespread, opportunistic attacks, as threat actors race to exploit tens of thousands of unpatched devices worldwide.

Citi CEO Fraser calls Anthropic’s Mythos ‘not a good day’ for global cybersecurity

When Anthropic released its Mythos AI model to approved users in April, the ripple effects were immediate and far-reaching. The model, capable of identifying and exploiting zero-day vulnerabilities in every major operating system and web browser, has since triggered a…

Microsoft patches perfect-10 Entra ID flaw exploited in wild

Microsoft disclosed on Thursday a maximum-severity vulnerability in its Entra ID cloud identity service that attackers had already been exploiting, though the company says it has fully mitigated the flaw server-side and no customer action is required.

Critical Fastjson flaw actively exploited with no patch

A critical remote code execution vulnerability in Alibaba's Fastjson library is under active exploitation, with no fix available for the affected 1.x branch and attackers already hitting production systems across the United States.

Two 15-year-old Linux kernel flaws prompt urgent patching

Two high-severity vulnerabilities that together lay dormant in the Linux kernel for more than 15 years were publicly disclosed this week, prompting urgent patching across major distributions and cloud providers. Both were demonstrated through Google Alphabet Inc. bug bounty programs…