KEVWire

npx add-mcp 'https://kevwire.com/mcp'

KEVWire / Security intelligence

Intelligence brief

The intelligence wire

8317 matching records

PHP Memory Corruption Vulnerability

The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered. Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers. Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches. Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. The disruption put the National Security Agency and Europe's cybersecurity agency on alert. State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately. What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory." "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said. The cybersecurity firm Wiz wrote in a blog post: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." Read more below. What is PHP? You've probably never heard of PHP, even though you've interacted with it for decades. PHP, which stands for Hypertext Preprocessor, is a programming language used by roughly 70% of websites whose server-side language is known. It has been around since the 1990s to help build websites, taking data and generating content sent to a browser. It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content. What was the PHP vulnera

CISA federal due Oct 29, 2026 Federal due date within 7 daysNot your organization's SLA.

PHP Stale Internal Request-State Vulnerability

The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered. Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers. Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches. Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. The disruption put the National Security Agency and Europe's cybersecurity agency on alert. State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately. What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory." "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said. The cybersecurity firm Wiz wrote in a blog post: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." Read more below. What is PHP? You've probably never heard of PHP, even though you've interacted with it for decades. PHP, which stands for Hypertext Preprocessor, is a programming language used by roughly 70% of websites whose server-side language is known. It has been around since the 1990s to help build websites, taking data and generating content sent to a browser. It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content. What was the PHP vulnera

CISA federal due Oct 29, 2026 Federal due date within 7 daysNot your organization's SLA.

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

The websites you use every day may have been vulnerable to hackers for years because of hidden flaws in their code that AI only recently discovered. Why it matters: The code, called PHP, powers millions of websites, and the vulnerabilities could allow hackers to steal sensitive data like your passwords or take control of affected servers. Driving the news: A potential attack exploiting flaws in PHP emerged on Wednesday, which prompted governments and companies to temporarily take their websites offline while they installed security patches. Dozens of websites in the U.S., U.K., and around the world were briefly taken offline to make the fix. The disruption put the National Security Agency and Europe's cybersecurity agency on alert. State of play: Security patches were released to fix the issues on Oct. 21, 2026. Cybersecurity firms urged anyone using PHP to install the security updates immediately. What they're saying: OpenAI's technology helped find the bugs, and the company called the discovery "one of the most impactful security issues in recent memory." "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said. The cybersecurity firm Wiz wrote in a blog post: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." Read more below. What is PHP? You've probably never heard of PHP, even though you've interacted with it for decades. PHP, which stands for Hypertext Preprocessor, is a programming language used by roughly 70% of websites whose server-side language is known. It has been around since the 1990s to help build websites, taking data and generating content sent to a browser. It's still used today for a variety of websites, including Wikipedia, WordPress blogs and shopping websites. How it works: HTML determines what a website displays. PHP works behind the scenes to collect information and generate content. What was the PHP vulnera

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched...

CISA federal due Jun 1, 2026 Federal due date passedNot your organization's SLA.

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

CISA federal due Oct 23, 2026 Federal due date passedNot your organization's SLA.

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.

CISA federal due Oct 26, 2026 Federal due date passedNot your organization's SLA.

Ahsay AhsayCBS Command Injection Vulnerability

A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

CISA federal due Oct 17, 2026 Federal due date passedNot your organization's SLA.

Ahsay AhsayCBS Improper Authentication Vulnerability

A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.

CISA federal due Oct 17, 2026 Federal due date passedNot your organization's SLA.

Apple Multiple Products Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

CISA federal due Oct 13, 2026 Federal due date passedNot your organization's SLA.

Arista VeloCloud Orchestrator SQL Injection Vulnerability

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CISA federal due Oct 26, 2026 Federal due date passedNot your organization's SLA.

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

CISA federal due Oct 19, 2026 Federal due date passedNot your organization's SLA.

Siemens Software Center Uncontrolled Search Path Element Vulnerability

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

CISA federal due Nov 3, 2026 Federal due date scheduledNot your organization's SLA.

Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

CISA federal due Oct 16, 2026 Federal due date passedNot your organization's SLA.

Citrix NetScaler Improper Input Validation Vulnerability

Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)

CISA federal due Sep 30, 2026 Federal due date passedNot your organization's SLA.

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Security alert: Multiple vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771, CVE-2026-88772, and others) (updated). Original Japanese title: 注意喚起: NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)

CISA federal due Sep 30, 2026 Federal due date passedNot your organization's SLA.

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

CISA federal due Nov 3, 2026 Federal due date scheduledNot your organization's SLA.

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

CISA federal due Oct 23, 2026 Federal due date passedNot your organization's SLA.

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

CISA federal due Nov 3, 2026 Federal due date scheduledNot your organization's SLA.

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

CISA federal due Oct 23, 2026 Federal due date passedNot your organization's SLA.

Fortinet Multiple Products Path Traversal Vulnerability

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

CISA federal due Oct 19, 2026 Federal due date passedNot your organization's SLA.

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Multiple Atlassian products (Bitbucket Data Center,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

CISA federal due Oct 18, 2026 Federal due date passedNot your organization's SLA.

Palo Alto Networks PAN-OS Code Injection Vulnerability

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

CISA federal due Oct 17, 2026 Federal due date passedNot your organization's SLA.

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

CISA federal due Oct 17, 2026 Federal due date passedNot your organization's SLA.

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

CISA federal due Oct 16, 2026 Federal due date passedNot your organization's SLA.

ProFTPD Improper Access Control Vulnerability

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CISA federal due Oct 11, 2026 Federal due date passedNot your organization's SLA.

Missing records are not an all-clear. Read the coverage and methodology.