https://badtech.org/tag/badtech-radar/Notes on security, vulnerabilities, and the systems we depend on.en-ushttps://badtech.org/php-emergency-fixes-address-two-critical-rce-flaws-as-exploitation-attempts-were-reported/https://badtech.org/php-emergency-fixes-address-two-critical-rce-flaws-as-exploitation-attempts-were-reported/Sat, 24 Oct 2026 13:28:40 +0000PHP issued emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution. The fixed release lines cited in the supplied material are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with older branches also described as backported.RadarNewshttps://badtech.org/php-schedules-emergency-security-release-for-two-critical-vulnerabilities-rated-9-2/https://badtech.org/php-schedules-emergency-security-release-for-two-critical-vulnerabilities-rated-9-2/Wed, 21 Oct 2026 13:09:50 +0000The PHP security team has announced an emergency security release scheduled for October 21, 2026, at 14:00 UTC (10:00 AM Eastern), addressing two critical vulnerabilities, each rated CVSS 4.0 9.2. Technical details, affected PHP versions, and patched releases have not yet been disclosed. The PHP team warned that patches could be released ahead of schedule if vulnerability details become public or evidence of active exploitation emerges.RadarVulnerabilitieshttps://badtech.org/cisco-patches-critical-catalyst-sd-wan-ios-xe-and-secure-firewall-management-center-flaws/https://badtech.org/cisco-patches-critical-catalyst-sd-wan-ios-xe-and-secure-firewall-management-center-flaws/Thu, 06 Aug 2026 20:09:37 +0000SecurityWeek reported that Cisco released fixes for roughly two dozen vulnerabilities across its products, including critical issues in Catalyst SD-WAN, IOS XE and Secure Firewall Management Center. For Catalyst SD-WAN, SecurityWeek and Secure ISS said Cisco identified CVE-2026-20303, CVE-2026-20304 and CVE-2026-20310 as critical vulnerabilities, and listed fixed releases 20.9.10, 20.12.8.1, 20.15.6, 20.18.4 and 26.1.2 by branch. The reporting also listed IOS XE fixes for CVE-2026-20272 and CVE-2026-20267, with fixed releases including 17.9.10, 17.12.8, 17.15.6, 17.18.4 or 17.18.4a, and 26.1.2.RadarVulnerabilitieshttps://badtech.org/n-able-n-central-auth-bypass-flaw-is-under-active-exploitation-customers-told-to-verify-2026-3-1-7/https://badtech.org/n-able-n-central-auth-bypass-flaw-is-under-active-exploitation-customers-told-to-verify-2026-3-1-7/Tue, 04 Aug 2026 01:55:28 +0000N-able’s N-central RMM platform is under active exploitation through an authentication-bypass flaw, with Huntress reporting multiple affected organizations and observed follow-on activity including reconnaissance, process-list requests, and abuse of the Take Control remote-access feature on downstream hosts. N-central is a remote monitoring and management platform used to administer and remotely access systems across customer environments.BreachesRadarVulnerabilitieshttps://badtech.org/water-utility-cyber-incidents-across-at-least-seven-u-s-states-disrupted-monitoring-and-control-across-at-least-seven-u-s-states/https://badtech.org/water-utility-cyber-incidents-across-at-least-seven-u-s-states-disrupted-monitoring-and-control-across-at-least-seven-u-s-states/Sat, 01 Aug 2026 00:47:59 +0000CBS News, NBC News, and CNN Newsource via KEYT reported that the FBI and EPA said water and wastewater utilities in at least seven U.S. states experienced malicious cyber incidents, with some activity degrading operations. The reporting says the activity targeted internet-facing programmable logic controllers, or PLCs, which utilities use to monitor and control equipment such as pumps, valves, pressure and chemical processes.BreachesRadarhttps://badtech.org/broadcom-patches-critical-vmware-vcenter-and-esxi-flaws-including-auth-bypass-rce-and-vm-escape/https://badtech.org/broadcom-patches-critical-vmware-vcenter-and-esxi-flaws-including-auth-bypass-rce-and-vm-escape/Fri, 31 Jul 2026 01:06:59 +0000Security Affairs, Mallory.ai, and Field Effect reported that Broadcom released patches on July 29 for five VMware vulnerabilities affecting ESXi, vCenter, Workstation, and Fusion, including three rated critical. They said the most severe issue, CVE-2026-59309, is a critical vCenter authentication bypass rated CVSS 9.8, and that Broadcom also fixed CVE-2026-59310, a critical directory traversal flaw in the Syslog Server component that can lead to remote code execution over the network. vCenter is VMware’s centralized management platform for ESXi hosts and virtual machines.RadarVulnerabilities