4 casos · pág. 1/1
Fortinet published PSIRT advisory FG-IR-26-186 for CVE-2026-109618, a flaw in PHP that can lead to remote code execution (RCE). PHP uses longjmp() to abort request handling on out-of-memory (OOM) errors. Some contexts do not account for this and leave request memory uninitialized before an allocation. Fortinet says it is still investigati…
This SentinelOne weekly roundup (Week 43, 2026) covers several separate stories. The most significant is a suspected Chinese state-aligned actor using ARTEX, a Go-based multi-agent LLM penetration testing framework, to compromise ConnectWise Cloud Backup and pivot into downstream Microsoft 365 tenants. The actor reportedly reached privile…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
Unknown threat actors breached the TeamUpdraft website on 17-18 October 2026 and likely accessed its customer database, which holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack observed an attacker holding valid UpdraftCentral dashboard keys issuing signed commands to install backdoor plugins on connected …
