-
CRIT · wtf: PHP finally made it into the control room. Unfortunately.
CISA added the two PHP2Shell engine flaws (CVSS 9.2, unauthenticated RCE) to KEV on Monday. Exploitation attempts began before the Oct 21 patches, and Siemens, Schneider Electric and others confirm affected industrial products.
Tactical: Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Check Siemens, Schneider, ABB, Rockwell and Johnson Controls advisories for your OT gear.
Strategic: PHP sits deep in OT and appliance stacks you do not patch yourself. Inventory vendor-bundled runtimes and press suppliers for patch timelines, because KEV deadlines will arrive before many OT fixes do.
Reporting: The Hacker News, SecurityWeek, SecurityWeek, The Register Security, CISA Advisories, Industrial Cyber, The Register
-
CRIT · wtf: Microseconds to crack the key, which is roughly how long trust lasts now.
Researchers found that eight eMudhra intermediates (six TLS, two code signing) used trivially weak, recoverable private keys. Mozilla blocked them and Go removed trust in 1.27.3 and 1.26.10. Anyone holding the keys can impersonate any domain.
Tactical: Update Go to 1.27.3 or 1.26.10 and rebuild binaries. Refresh OS and container CA bundles and revocation lists, and hunt for certs chaining to eMudhra intermediates.
Strategic: Linux has no uniform revocation, so distrust depends on runtimes and images you rebuild. Teams need a fast path to push CA distrust across fleets, containers and embedded devices, not just browsers.
Reporting: Lobsters, Lobsters
-
CRIT · wtf: Your CI logs are now the attacker's clipboard.
An automated campaign uses stolen GitHub tokens to plant workflows that print repository secrets into Actions logs. The attackers download the logs, then delete the runs. It has succeeded against private repos and GitHub Enterprise.
Tactical: Search audit logs for unexpected workflow commits and deleted runs. Rotate Actions secrets, revoke stale tokens, and require review for workflow file changes.
Strategic: Any token with write access can exfiltrate every CI secret. Move to short-lived OIDC federation, scope tokens tightly, and treat workflow edits as privileged changes that need review.
Reporting: Dark Reading, The Hacker News
-
HIGH · wtf: The compression library nobody inventoried just became everybody's sprint.
CVE-2026-111497 is a Brotli decoder buffer overflow found by OpenAI Codex Security. Crafted compressed data can crash or corrupt memory. Researchers built working exploits, including one via FFmpeg images, but no in-the-wild attacks are reported.
Tactical: Patch Node.js, .NET 8 to 11, Python, Bun, Envoy and Istio. Rebuild containers and restart services, and block untrusted Brotli-encoded input at the edge until done.
Strategic: AI bug-finding is producing emergencies in ubiquitous libraries faster than teams can triage. Invest in deep SBOMs and exploitability analysis so you can tell loud from dangerous.
Reporting: CyberScoop, The Register Security, The Hacker News, SecurityWeek
-
HIGH · wtf: Turns out the agent reads the README. Every README.
Forever Security says its product blocked a customer's coding agent from installing malicious npm package function-color. The prompt came from an AGENTS.md file in the Downloads folder the agent used as its working directory. How the file got there is unknown.
Tactical: Never launch coding agents from Downloads or home directories. Require approval for package installs and config changes, and scan for unexpected AGENTS.md or CLAUDE.md files.
Strategic: Instruction files are now an attack surface. Treat any directory an agent reads as untrusted input, and enforce install allowlists and endpoint controls rather than trusting model judgment.
Reporting: Rogue AI Tracker, The Hacker News