Secure Blink

PHP2Shell: two critical PHP runtime bugs (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) allow unauthenticated RCE. 22.6M+ instances exposed. Public PoCs exist, and patching your app won’t fix it. Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart every worker. 🧵

An external actor used offensive agentic techniques to reach internal tools this October. The exposed data is limited. The open questions are not. Exposed: user IDs, full names, email addresses, organization role labels. Not reported as accessed: clear-text passwords, MFA secrets, session tokens, investigation content. The scope is “based on evidence to date.” Who is behind it, and how many customers were hit? Details: secureblink.com/threat-feeds… #Exploit #Chainalysis #Hack #ArtificialIntelligence #AgenticWallet #Threatfeed #SecureBlink

Binance says no private key leaked. It lost about $6.3B in roughly 20 minutes anyway. Wallets on 10+ chains signed for the attacker. Binance hasn't said how. 🔍 Details: secureblink.com/threat-feeds… #Binance #NorthKorea #CryptoSecurity #Blockchain #buyingcontent #Hack #Bitcoin #Threatfeed #SecureBlink

Sony says no passwords leaked in the So-net breach. It also says 54,401 mailbox passwords did. Customers who left by February 2026 aren't in the data. Customers who left in March are. Sony hasn't said why. 🔍 Details: secureblink.com/threat-feeds… #Japan #databreaches #hack #exploit #NTT #CyberAttack

Warp: ~1% of users, an unnamed vendor, "agent traces." Its docs list two very different data types under that label. Warp has not said which. secureblink.com/threat-feeds… #AIAgent #Exploits #Coding #ArtificialIntelligence #Threatfeed #SecureBlink

525,000 people. One test environment. Copenhagen University says hackers reached a system with CPR IDs, phones and personal emails. Then a second disclosure: ~20,000 ID card PINs. One detail in that update shows what the test system really held. 🧵 Details: secureblink.com/threat-feeds… #Denmark #databreaches #hack #UniversityofCopenhagen #CyberAttack #Threatfeed #SecureBlink

One vendor credential. 2,250+ Microsoft 365 tenants probed. Microsoft says ARTEX, an AI pentest framework, sped it up. Confirmed victims are far fewer. Details: secureblink.com/threat-feeds… #SupplyChain #Attacksurface #Microsoft365 #Chinese #Hack #Threatfeed #SecureBlink

A group says it holds 8.63 million #RajasthanPolice emails. 🔍 The "70,000 records" headline hides five different units: mailboxes, addresses, ID records, phone numbers and gigabytes. Police are probing. Nobody has confirmed a breach. Details: secureblink.com/threat-feeds… #RajasthanNews #Scarlettgroup #Police #Cyberattack #Hack #Databreach #Threatfeed #SecureBlink

MAIN POST An Indian certificate authority's private keys were recovered in milliseconds. Eight of them were smaller than 256. 🔍 Chrome blocked them within 2 hours. Mozilla within 5. But some clients never check. Details: secureblink.com/threat-feeds… #Cyberattack #Encryption #eMudhra #PKI #Hack #Threatfeed #SecureBlink

Full breakdown with detection steps and CERT-EU, CISA and NSA guidance 👇 secureblink.com/threat-feeds… #PHP2Shell #CyberSecurity #infosec

Can’t patch today? - session.upload_progress.enabled=0 - Harden memory_limit and post_max_size - Put a WAF or virtual patch in front - Isolate end-of-life PHP (8.1 and older gets no php.net fix) Then hunt for php-fpm or apache spawning shells.

1,062,060 Texans. A utility that learned about its own breach from a hacking forum. 👀 CenterPoint Energy’s SEC filing blames an “external facing system.” The hacker’s version is far more specific. Which one holds up? 🧵 One more detail. No CVE. No exploit. No malware. Nothing to patch, nothing for a scanner to flag. Full ThreatFeed: secureblink.com/threat-feeds… #DataBreach #CyberSecurity #APISecurity #Hack #Threatfeed #SecureBlink