What matters and why
The PHP project disclosed two critical remote-code-execution vulnerabilities on October 21. Fixed upstream branches begin at 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Apache mod_php and PHP-FPM have different demonstrated attack conditions; neither a WAF nor an application-framework upgrade substitutes for a patched runtime.
In focus
What changed, why it matters, and what to verify.
The PHP project disclosed two critical remote-code-execution vulnerabilities on October 21. Fixed upstream branches begin at 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Apache mod_php and PHP-FPM have different demonstrated attack conditions; neither a WAF nor an application-framework upgrade substitutes for a patched runtime.
Read analysis →Eight eMudhra intermediate CA certificates have compromised private keys, according to the certifi advisory. Attackers who can intercept a connection may impersonate services to clients that still accept the affected chains. The response must reach application bundles and container images as well as browsers.
Read analysis →CISA added CVE-2026-59310 on 18 August 2026. Its record says a network-reachable VMware vCenter path traversal vulnerability could allow code execution and records known ransomware campaign use as known.
Read analysis →CISA added CVE-2026-45659 to KEV on 1 July 2026. Its record describes SharePoint Server deserialization of untrusted data that allows an authorised attacker to execute code over a network.
Read analysis →CISA added CVE-2026-35273 on 12 June 2026 and describes missing authentication for a critical PeopleSoft Enterprise PeopleTools function that could permit takeover.
Read analysis →CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on 29 May 2026. CISA describes an authentication bypass in PAN-OS that can establish an unauthorized VPN connection.
Read analysis →Evidence to decisions
Response priority is evaluated separately from technical severity. Every published claim links back to collected public evidence.
RSS
Fetching recent headlines from monitored sources…
Stay informed
Follow new publications in your feed reader, or browse the daily and weekly archives.
Corrections and editorial questions: [email protected]