PHP2Shell Gets a Federal Patch Deadline While you were probably hoping for a quiet week, security teams must now scramble to investigate potential PHP2Shell compromises as CISA officially orders federal civilian agencies to patch the actively exploited flaws by Thursday. While researchers recorded successful remote code execution on a juicy honeypot setup, widespread compromises remain …
Cybersecurity
Forgotten Website Tags Put iPhones at Risk Researchers uncovered a massive iPhone spyware pipeline lurking in the digital graveyard of abandoned third-party website tags. Meanwhile, iVerify traced a separate, zero-click infection straight to a seemingly harmless Instagram ad. Cybercriminals are scooping up the expired domains those forgotten analytics tags still ping, quietly funneling unsuspecting visitors …
Smart TVs Give ‘Opt Out’ a Plot Twist Between Samsung’s residential proxy app ban and LG’s ambient audio disputes, smart TVs are having a major privacy moment. Now, hitting “no” on your smart TV’s tracking pop-up is clearly just a polite suggestion. Some smart TVs continue sending tracking-related traffic after users opt out, Northeastern researchers …
Global websites pulled down as PHP bugs threaten to set the internet on fire Well… you know it’s going to be a rough one when PHP makes mainstream news and the family group chats. Where do we start? On Wednesday, the internet almost burned down thanks to two bugs, dubbed PHP2Shell, which allows unauthenticated remote …
GitLab’s 12-Year-Old Flaw Demands Another Patch In a stunning display of digital archaeology, GitLab patched a CVSS 10.0 flaw that could let unauthenticated attackers run server code through a crafted regular expression, under certain conditions. The kicker? CVE-2026-110264 affects unpatched Community and Enterprise releases dating all the way back to 7.0 in 2014. Self-managed admins …
PHP Flaws Put Government Sites on Pause Even governments need an emergency maintenance screen. Two critical PHP flaws triggered emergency patches and prompted the Netherlands, France, and Finland to yank their government websites offline yesterday. Panic aside, the outages weren’t evidence of actual breaches—just a desperate scramble to board up the windows. PHP builds the …
Army Wants AI Hackers With Minimal Supervision Apparently, minimal supervision is a selling point for cyberweapons. US Army Cyber Command (ARCYBER) is looking to outsource its offensive hacking to autonomous AI, because what could possibly go wrong? According to documents reviewed by The Intercept, the proposed framework—adorably codenamed ECHOTRIBBLE—would let software hunt and disable adversary …
OpenCode Breach Puts AI API Keys at Risk OpenCode’s hosted Console sprang a leak, and it may have exposed OpenAI, Anthropic, and Google API keys. The company claims 1.4% of Console users were affected and notified; its co-founder insists that keys stored solely in local apps weren’t dragged into the mess. Surprise! Users are already …
Google Play Boots a Fake Chrome App Google’s vaunted reviewers somehow let a startlingly bold Chrome impersonator slip through the cracks, though Google Play finally removed the counterfeit browser on Oct. 14. The bogus app boasted over 100,000 downloads, but that inflated metric largely spans its past life as a mundane game called Ball Bounce. …
Spyware Ads Don’t Need You to Click A nightmare scenario has officially arrived: zero-click spyware delivered through targeted online ads. Dubbed AdFection, the technique infects your device just by loading an ad—no clicking required. A new report links Israeli ad firm Discover-Tech’s infrastructure to Candiru’s mercenary spyware. At least 45 Al Jazeera Windows devices were …