/
vendors:CrowdStrike × criticity:critical × limpar

Resultados

2 casos · pág. 1/1

infosecurity-magazine.com · critical

Storm-0940 uses ARTEX agentic AI framework to compromise ConnectWise Microsoft 365 tenants and target downstream customers

Microsoft assesses that the China-aligned actor Storm-0940 used the agentic AI penetration testing framework ARTEX to compromise the Microsoft 365 tenants of ConnectWise, then pivoted to its downstream customers. The campaign began in September 2026 and targeted hundreds of organizations worldwide across aerospace and defense, energy, fin…

theregister.com · · 27 fontes · 37 atualizações critical

PHP2Shell: PHP patches critical unauthenticated RCE flaws CVE-2026-109618 and CVE-2026-109619; broad exploitation attempts, UK government services offline, wide vendor and government response

The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…