Intel Exchange

Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.

A high-severity out-of-bounds write vulnerability in the Brotli decompression library bundled with Node.js and Bun allows remote code execution via malformed compressed input.

Unauthenticated remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in the wild to deploy webshells and steal credentials.

The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.

GitLab has released urgent patches for a critical CVSS 10.0 integer overflow vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that allows for remote code execution.

Private keys for eight eMudhra intermediate CAs were compromised due to flawed key generation, allowing attackers to impersonate websites and services for clients not enforcing Certificate Transparency.

Adversaries are actively exploiting CVE-2026-109618 (PHP2Shell) to achieve remote code execution on Apache/PHP servers by bypassing ASLR through a four-stage multipart request chain.

Suspected Lazarus Group operators are utilizing agentic AI for post-exploitation after compromising global PHP infrastructure via PHP2Shell vulnerabilities.

Two critical remote code execution vulnerabilities in PHP, collectively dubbed php2shell, were leaked online prior to patching, affecting a wide range of web applications and servers.

China-aligned threat actor Storm-0940 deployed an agentic AI framework named ARTEX to perform reconnaissance, massive password spraying, and OAuth abuse targeting ConnectWise Cloud Backup and M365 tenants.