Researcher Wins $2,000 Bug-Bounty Challenge by Chaining Critical PHP Flaws, Publishes New PoC
A security researcher known as 'killa' claimed the prize on a public bitcoin-themed hacking challenge by exploiting two critical PHP vulnerabilities — tracked as the PHP2Shell flaws, CVSS...
Researcher Uncovers 11 Tailscale SSH Flaws That Could Hand Attackers Root Across a Fleet
An independent security report dubbed 'Tailworm' details eleven separate weaknesses in Tailscale SSH, its serve and app-connector features, the DERP relay, and the open-source headscale server — several...
Palo Alto Confirms Critical 9.2-Severity Flaw in PAN-OS Firewalls, Ships Workarounds Ahead of Patches
Palo Alto Networks has confirmed that a critical memory-corruption flaw in Google's Brotli decompression library, tracked as CVE-2026-111497 with a CVSS score of 9.2, affects certain PAN-OS firewall...
Apache Camel’s Latest Security Update Closes Six Flaws — From File-Leaking XXE Bugs to Remote Code Execution
The Apache Camel integration framework has shipped fixes for six vulnerabilities spanning XML parsing, deserialization, and credential handling. Three are rated high severity, including a pair of XXE...
Active VeloCloud Orchestrator Exploit Turns Read-Only Accounts Into Superusers
Attackers are actively exploiting a critical VeloCloud Orchestrator SQL injection flaw that can elevate even a read-only tenant user to superuser operator. Organizations running affected on-premises releases should...
Eight Critical Aruba Network Flaws Carry Maximum CVSS Scores
HPE has patched a broad set of Aruba Networking vulnerabilities, including eight flaws scored CVSS 10.0. Several attack paths require no credentials and can lead to root command...
Critical Okta Access Gateway Bug Lets Rogue Admins Run System Commands
Okta has patched a critical flaw in Access Gateway, tracked as CVE-2026-115547 with a CVSS score of 9.1, that lets an already-authenticated administrator trigger system command execution through...
Public Exploit for Critical PHP Flaws Fuels Attempted Mirai-Style Botnet Deployment
Proof-of-concept code is now public for two critical, unauthenticated PHP remote-code-execution flaws dubbed PHP2Shell, and Sophos has observed real-world attempts to use them to deploy a Mirai-derived botnet...