Badtech.org

Tracking cybersecurity.

News

PHP emergency fixes address two critical RCE flaws as exploitation attempts were reported

Adam Field

Source: Badtech.org
RadarNews

PHP issued emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution. The fixed release lines cited in the supplied material are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with older branches also described as backported.

CX Today and SecHOT reported that Amazon Web Services observed exploitation attempts starting October 17, before public disclosure, and additional activity afterward. The supplied reporting also describes broad scanning, payload mutation, and activity from multiple actors, while CX Today and SecHOT said CrowdStrike had not confirmed successful exploitation in the wild and assessed reliability as dependent on deployment profile.

The supplied material says patching is the only complete remediation. It also recommends restarting Apache and PHP-FPM workers, rebuilding affected container images, and reviewing logs and activity from at least October 17. PHP is a widely deployed server-side scripting runtime often embedded beneath web applications and CMS platforms, so exposure checks need to include underlying runtime components as well as the application layer.

Sources

Read more

PHP schedules emergency security release for two critical vulnerabilities rated 9.2

The PHP security team has announced an emergency security release scheduled for October 21, 2026, at 14:00 UTC (10:00 AM Eastern), addressing two critical vulnerabilities, each rated CVSS 4.0 9.2. Technical details, affected PHP versions, and patched releases have not yet been disclosed. The PHP team warned that patches could be released ahead of schedule if vulnerability details become public or evidence of active exploitation emerges.

Source: Badtech.orgBy Adam Field

Active exploitation hits SonicWall SMA1000 vulnerability chain with unauthenticated RCE path

Active exploitation is targeting SonicWall SMA1000 appliances through CVE-2026-83548 and CVE-2026-83549, a pre-authentication SSRF flaw and a post-authentication OS command-injection flaw that can be chained to reach unauthenticated remote code execution. Affected models are SMA 6210, SMA 7210 and SMA 8200v on 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier; fixed builds are 12.4.3-03526 and 12.5.0-02952 or later.

Source: Badtech.orgBy Adam Field

Aurora ransomware operator used Cursor Agent in 10 intrusions and targeted ESXi hosts

Gambit Security says an Aurora ransomware operator used Cursor Agent inside 10 victim networks and paired it with tooling to find and encrypt VMware ESXi environments. According to Gambit Security, the operator used Cursor Agent, running Claude Sonnet, during hands-on activity across 10 organizations between April 8 and May 21, 2026. Gambit said the sessions started with credentials or an existing route into the network, then used the agent for internal scanning, VPN or proxy setup, privilege enumeration, NTLM relay attempts and certificate attacks. Gambit also reported that many agent commands failed on the first try and were sometimes retried with refined prompts or scripts.

Source: Badtech.orgBy Adam Field

Microsoft Azure urges network-based compensating controls as patch windows shrink

Microsoft Azure says patch validation and deployment timelines no longer match current exploitation speed and is urging enterprises to add adaptive, network-based compensating controls during remediation. In a Microsoft Azure Blog post, Microsoft argues the usual sequence of disclosure, exposure assessment, testing and patch rollout is increasingly out of step with attacker timelines. Microsoft says organizations may need days or weeks to validate and deploy fixes, while exploitation can emerge within hours. Help Net Security separately reported Rapid7’s assessment that the gap between patch release and weaponization has approached zero.

Source: Badtech.orgBy Adam Field

Search Badtech.org

Enter a title, topic, or keyword.