Be the company hackers skip. Stay protected, stay boring to hackers. Get vulnerability alerts and discuss security with the community: https://xitter.cf/t.co/HwfTWgXatL
Joined August 2025
- Tweets1.5K
- Following42
- Followers869
- Likes726
Pinned Tweet
PHP's emergency fix is out for CVE-2026-109618 and CVE-2026-109619. Read what to patch first 👇
vulntracker.io/blog/php-emer…
🚨 BREAKING: PHP released emergency fixes for PHP2Shell, two critical flaws (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.
PHP rated both CVSS v4.0 9.2.
VulnTracker recommends patching now 👇
vulntracker.io/blog/php-emer…
#PHP #PHP2Shell #CVE #InfoSec
Running PHP 8.1 or older?
PHP no longer ships project updates for these. Source backports exist for 7.4, 8.0 and 8.1, and some distros and LTS vendors backport fixes too. Ask your vendor, or move to a supported branch.
Can't update yet? PHP lists partial mitigations, but says none make an installation safe.
Partial mitigations and what to check first:
vulntracker.io/blog/php-emer…
PHP has released emergency fixes for two critical flaws (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution.
Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says updating is the only safe choice.
Full breakdown 👇
vulntracker.io/blog/php-emer…
#PHP #PHP2Shell #CVE #InfoSec
PHP2Shell countdown: two critical PHP flaws, patch release due at 14:00 UTC.
VulnTracker recommends inventorying every PHP install now, including appliances and control panels, then patching internet-facing systems first.
Details: vulntracker.io/blog/php2shel…
#PHP #PHP2Shell
PHP2Shell: critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Patch release due today, 14:00 UTC.
Know where PHP runs in your stack before it lands. Read 👇
vulntracker.io/blog/php2shel…
#PHP #PHP2Shell #CVE
PHP2Shell: critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Patch release due today, 14:00 UTC.
Know where PHP runs in your stack before it lands. Read 👇
vulntracker.io/blog/php2shel…
#PHP #PHP2Shell #CVE
Siemens Software Center CVE-2026-110936 is now in CISA KEV (Oct 20, due Nov 3).
A DLL sideloading flaw (CWE-427, CVSS v4.0 8.4) in versions below V4.0.9.8. Attackers placed a crafted DLL next to a genuine, signed copy, and ClickFix lures got victims to run PowerShell that installs a remote access trojan.
Hunt for Software Center running from a user AppData folder and launched by msiexec.
VulnTracker recommends updating to V4.0.9.8 or later and restarting the app.
Details: vulntracker.io/cves/CVE-2026…
#Siemens #ClickFix #CISAKEV #InfoSec
Siemens Software Center CVE-2026-110936 is exploited in the wild: a DLL sideloading flaw (CVSS v4.0 8.4) abused in ClickFix attacks to deploy a remote access trojan.
Affects all versions below V4.0.9.8.
VulnTracker recommends updating to V4.0.9.8 or later and restarting the app.
Details: vulntracker.io/cves/CVE-2026…
#Siemens #ClickFix #CVE #InfoSec
Atlassian CVE-2026-21589, step by step:
Oct 5: disclosed (CVSS 9.3), 8 Data Center products
Oct 6: public PoC, exploitation attempts seen
Oct 15: added to CISA KEV
VulnTracker recommends patching now, or taking instances off the public internet and blocking the path at the WAF.
Details: vulntracker.io/cves/CVE-2026…
#Atlassian #CVE #CISAKEV #InfoSec
Langchain-Chatchat CVE-2026-75128 (CVSS 9.8): one unauthenticated request to /tools/call can run OS commands as root.
Affects versions through 0.3.1.3. The shell tool is always registered and the API has no authentication by default.
No fix listed. VulnTracker recommends taking exposed instances off the network or putting authentication in front of them.
Details: vulntracker.io/cves/CVE-2026…
#LangchainChatchat #AI #CVE #InfoSec
Letta CVE-2026-77936 (CVSS 9.8): the default self-hosted setup ships with no authentication.
Letta 0.16.8 and earlier: every API route is open, attackers can run arbitrary Python and manage admin users. The exposed PostgreSQL (default credentials, superuser) allows OS commands.
No fixed version listed. VulnTracker recommends enabling LETTA_SERVER_SECURE and not publishing the database port.
Details: vulntracker.io/cves/CVE-2026…
#Letta #AI #CVE #InfoSec
Google SAM (Agent Mesh) CVE-2026-103091 and CVE-2026-102503, both CVSS 9.3.
A remote attacker can join the mesh or bypass auth and invoke tools on backend MCP servers. Affects 0.1.0-alpha.1 to alpha.8.
VulnTracker recommends upgrading to 0.1.0-alpha.9 or later, which fixes both.
Details: vulntracker.io/cves/CVE-2026…
#GoogleSAM #MCP #AI #CVE #InfoSec
Apache Camel CVE-2026-78162 (CVSS 10.0): an incomplete fix for CVE-2026-43865 leaves camel-hazelcast open to deserialization RCE.
Affects Camel 4.0.0 to 4.18.5 and 4.19.0 to 4.22.1. 4.14.x and earlier get no fix.
VulnTracker recommends upgrading to 4.23.0, 4.22.1 or 4.18.5, and enabling Hazelcast auth and TLS.
Details: vulntracker.io/cves/CVE-2026…
#ApacheCamel #CVE #Java #InfoSec
Fortinet CVE-2025-61624, step by step:
Sept 2024: attackers breach a telecom MSP via FortiManager
Apr 14, 2026: Fortinet discloses the FortiOS flaw (CVSS 6.0)
Oct 14: Unit 42 links it to the PEERSTITCH implant
Oct 16: CISA adds it to KEV
Oct 19: federal deadline
Details
vulntracker.io/cves/CVE-2025…
#Fortinet #FortiOS #CISAKEV #InfoSec
8 exploited CVEs added to CISA KEV this week: Ahsay, BeyondTrust, Cisco, Microsoft, Ivanti, Palo Alto and Fortinet.
Read the full breakdown 👇
vulntracker.io/blog/exploite…
#CISAKEV #CVE #InfoSec
Exploited CVEs Last Week: October 12-18, 2026
Read the full breakdown
vulntracker.io/blog/exploite…
