4 casos · pág. 1/1
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…
Check Point Research reports active exploitation of two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Details leaked ahead of planned disclosure, and screenshots of a PHP2Shell attack tool are circulating. Since the leak, 10% of organizations worldwide have been "impacted", meanin…
Microsoft assesses that the China-aligned actor Storm-0940 used the agentic AI penetration testing framework ARTEX to compromise the Microsoft 365 tenants of ConnectWise, then pivoted to its downstream customers. The campaign began in September 2026 and targeted hundreds of organizations worldwide across aerospace and defense, energy, fin…
Microsoft attributed the recent supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned actor. The actor used ARTEX, a Go-based agentic AI penetration testing framework, to automate reconnaissance, password spraying and OAuth application abuse at "machine speed" against hundreds of organiza…
