6 casos · pág. 1/1
PHP released an emergency update for two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow remote code execution, denial of service and data exposure, and are reportedly already being exploited in the wild. Nearly 70 percent of websites are said to need updating, and Reuters reports that government website…
The LiteLLM release 1.107.0 (a widely used open source LLM proxy) was trojanized on PyPI on 21 October 2026 and carries a credential stealer plus a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) drop three extra files in site-packages, two of which run whenever any Python process starts, even one that never impor…
Unknown attackers compromised the release process of LiteLLM, the open source AI gateway developed by BerriAI, and distributed malicious version 1.107.0 through PyPI and Docker registries (Docker Hub and GHCR). The package carries an infostealer targeting cloud and AI credentials and a RAT that can execute arbitrary code. PyPI quarantined…
Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
The PHP security team released emergency fixes on October 21, 2026 at 14:00 UTC for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials a…
