Critical PHP2Shell Flaws Leaked; CISA Warns of Actively Exploited Bugs

Critical PHP2Shell RCE Flaws (CVE-2026-109618, CVE-2026-109619)

Two critical remote code execution (RCE) vulnerabilities in PHP, collectively named "PHP2Shell," were prematurely disclosed before a scheduled patch release. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect a vast range of PHP versions from 5.4 onwards, placing a majority of the web at risk. Security researchers have reproduced the exploit, and Cloudflare has already detected initial attack attempts in the wild. Organizations are urged to prepare for immediate patching as soon as the official fixes are released to mitigate the threat of widespread server compromise.

PHPRCEZero-DayWeb SecurityVulnerability Disclosure

Critical PHP2Shell RCE Flaws Leaked Ahead of Coordinated Patch

CISA Adds Six Flaws to KEV Catalog, Including Plex2Shell Chain

CISA KEV Catalog Updated with Six Actively Exploited Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are under active attack. The update includes four flaws in Plex Media Server, collectively known as "Plex2Shell," which attackers are chaining for unauthenticated RCE to deploy malware. Vulnerabilities in Siemens Software Center and EG Secure Solutions SiteGuard Server Edition were also added. Federal agencies are mandated to patch these flaws by early November 2026.

CISAKEVPlexSSRFDLL Sideloading +1 more

4 min read

CISA Adds Six Flaws to KEV Catalog, Including Plex2Shell Chain

Lazarus APT Uses AI and Post-Quantum Crypto in New Campaign

Lazarus Group's "Operation FlashHole" Targets South Korea

The North Korean Lazarus APT group has launched a sophisticated cyberespionage campaign named "Operation FlashHole," targeting South Korean entities since July 2025. Researchers at Kaspersky revealed the campaign uses AI-generated content for spear-phishing lures, abuses legitimate South Korean software for initial access, and deploys new malware. Most notably, the group is using post-quantum cryptography (ML-KEM-1024) to encrypt its command-and-control communications, demonstrating a significant advancement in future-proofing its operations against decryption.

Lazarus GroupAPTCyber EspionageSouth KoreaPost-Quantum Cryptography +1 more

Lazarus APT Uses AI and Post-Quantum Crypto in New Campaign

Advisory Warns of Prolific SafePay Ransomware Targeting Critical Infrastructure

CISA, FBI Warn of Active SafePay Ransomware Attacks

CISA, the FBI, and international partners issued a joint advisory on the SafePay ransomware group, one of the most active operations of 2026. Since August 2024, the group has compromised approximately 600 organizations, including critical infrastructure sectors, across the Americas, Europe, and Australia. The advisory details the gang's common TTPs, which include credential theft, exploiting known vulnerabilities, and phishing. Agencies urge organizations to implement MFA, patch vulnerabilities, and maintain offline backups to defend against this widespread threat.

RansomwareSafePayCISAFBICritical Infrastructure +1 more

Weak eMudhra Certificate Keys Force Emergency Browser Blocks

eMudhra Certificate Compromise Due to Weak Private Keys

A major internet security incident occurred after eight intermediate certificates from Indian Certificate Authority (CA) eMudhra were discovered to have critically weak private keys. The flaw, caused by insufficient randomness during key generation, allowed private keys to be recovered almost instantly. In one case, the private key was a single digit. This vulnerability enabled potential man-in-the-middle attacks and certificate forgery, forcing major browser vendors like Mozilla, Google, and Apple to issue emergency updates to distrust and revoke the compromised certificates, protecting users from potential impersonation attacks.

eMudhraCertificate AuthorityPKITLSHTTPS +2 more

4 min read

Weak eMudhra Certificate Keys Force Emergency Browser Blocks

Arizona's IMS Care Center Discloses Breach of Patient Data

MEDIUM

IMS Care Center Discloses Patient Data Breach from Email System

IMS Care Center, a large physician-owned medical group in Arizona, has disclosed a data breach affecting its patients. The incident, which occurred in June 2026, involved unauthorized access to the company's corporate email system. An investigation completed in late September determined that sensitive patient information, including names, addresses, Social Security numbers, and medical data, was potentially exposed. The healthcare provider is now notifying affected individuals and offering complimentary credit monitoring services.

Data BreachHealthcarePHIPIIHIPAA +1 more

3 min read

Arizona's IMS Care Center Discloses Breach of Patient Data

Critical RCE Vulnerabilities in PHP Affect Millions of Web Servers

PHP Critical RCE Flaws: CVE-2026-109618 & CVE-2026-109619

Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP, a ubiquitous server-side scripting language. Both vulnerabilities carry a CVSS 4.0 score of 9.2, indicating a high risk of exploitation. According to Palo Alto Networks' Cortex Xpanse, over 22.6 million internet-exposed instances are potentially vulnerable. Proof-of-concept (PoC) exploit code is reportedly available, and at least one European government has taken its website offline as a precautionary measure. Immediate patching is strongly recommended for all organizations using PHP to prevent potential server compromise, data theft, or malware deployment.

PHPRCEVulnerabilityWeb SecurityPatch Management +2 more

4 min read

Critical RCE Vulnerabilities in PHP Affect Millions of Web Servers

Updated Articles (2)

Ransomware Attacks Reached a Record High in August 2026

Updated: October 21, 2026

Ransomware Attacks Hit Record High, NCC Group Reports

Update:

A new report from Nord Security reveals a significant escalation in ransomware activity during Q3 2026, with 2,894 attacks documented between July and September. This marks a 50% year-over-year increase and an 8.6% rise from Q2. The surge is primarily attributed to fierce competition between the two most dominant ransomware groups, The Gentlemen (383 attacks) and Qilin (363 attacks), who together accounted for over 25% of all incidents. This rivalry is driving innovation in TTPs and increasing operational tempo, suggesting a new phase of heightened activity in the ransomware landscape.

September 24, 2026

RansomwareNCC GroupQilinClopThreat Report +2 more

Ransomware Attacks Reached a Record High in August 2026

ConnectWise Shuts Down Cloud Services After Supply Chain Attack