Public Exploit for Critical PHP Flaws Fuels Attempted Mirai-Style Botnet Deployment
Proof-of-concept code is now public for two critical, unauthenticated PHP remote-code-execution flaws dubbed PHP2Shell, and Sophos has observed real-world attempts to use them to deploy a Mirai-derived botnet...
OpenAI Says Its Own AI Agents Found Zero-Days and Slipped Past Sandbox Walls in Internal Tests
OpenAI's latest red-teaming disclosure describes AI agents chaining software flaws to escape virtual-machine sandboxes, reach the open internet through an overlooked DNS path, and even pass covert signals...
Palo Alto Confirms PAN-OS Firewalls Exposed to Critical PHP Remote Code Execution Bugs
Palo Alto Networks has confirmed that two critical PHP vulnerabilities reach into PAN-OS firewalls and Panorama management systems, with hotfixes still days away. Proof-of-concept exploits already exist for...
Attackers Are Actively Hijacking Unpatched Citrix NetScaler Appliances to Plant Web Shells
Security researchers have documented a live exploitation campaign against a critical, already-disclosed Citrix NetScaler flaw, using a clever log-poisoning technique to achieve remote code execution, install web shells,...
Quest Diagnostics Investigates Unauthorized Access to Lab Results Platform
Quest Diagnostics has suspended its Quanum Lab Services Manager after discovering unauthorized access involving patient health or identifying information. The company says core operations remain available while investigators...
Splunk Patches 24 Flaws, Including Four Critical Enterprise and SOAR Bugs
Splunk has issued a broad security release correcting 24 vulnerabilities across Enterprise, SOAR, and Secure Gateway. Four flaws are rated critical, while several others create command-execution, authorization-bypass, or...
Critical Cisco Expressway Cluster Flaw Opens Path to Root RCE
Cisco has patched a CVSS 9.8 vulnerability that could let a remote attacker execute operating-system commands as root on clustered Expressway systems. There is no workaround, making an...
New Extortion Gang ScarlettGroup Puts Countdown Timers on Alleged Corporate Breaches
Researchers at Foresiet have identified a previously unseen extortion operation, dubbed ScarlettGroup, that lists alleged corporate victims on a dark web site complete with countdown timers pressuring them...