Brief Archive

The most urgent threat is the active exploitation of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.

This week's key threats include newly disclosed vulnerabilities in Tailscale's SSH implementation, which could allow a compromised device to gain root access on other network servers, posing a significant risk for lateral movement.

The most urgent threat is a critical memory corruption vulnerability (CVE-2026-111497) in Google's Brotli decoder, impacting a wide range of software including Node.

The most urgent threat is an actively exploited SQL injection vulnerability (CVE-2026-114625) in VeloCloud Orchestrator, which is listed on the CISA KEV catalog and requires immediate patching.

The most urgent threat this week is the emergence of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619), a pair of critical remote code execution flaws in PHP.

The most urgent threat is a pair of critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell.

The highest priority this week is active exploitation of a Palo Alto Networks PAN-OS vulnerability (CVE-2026-0257), which is on the CISA KEV list and being used by ransomware groups to bypass MFA.