4 casos · pág. 1/1
Two critical PHP flaws dubbed PHP2Shell, each rated 9.2 out of 10, are due to be fixed in a PHP release at 14:00 UTC on October 21, 2026. PHP has not said which versions or components are affected and has offered no workaround of its own. No exploitation has been reported, and the flaws were absent from CISA's KEV catalog when last checke…
CISA added exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. They include four Plex Media Server flaws collectively named Plex2Shell, which researcher Zach Main says can be chained for unauthenticated remote code execution. Researcher boredhackerblog reports that threat actors are weaponizing them to deploy c…
Researcher Quentin Kaiser disclosed on October 16 an unauthenticated memory-corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It lets an attacker within radio range execute code as root on affected routers, with no Wi-Fi password or pairing step. Kaiser demonstrated working exploits against Belgian ISP gateways: th…
NGINX released versions 1.30.6 (stable) and 1.31.7 (mainline) on October 14 to fix five vulnerabilities, one of which has been present in every release since May 2005. Three are memory-corruption bugs that F5 says could crash a worker process or possibly allow code execution. A fourth is a TLS session-ticket flaw that may let a forged ses…
