Vulnerabilities & remediation
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
The Hacker News reports: Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory.
Vulnerabilities & remediation
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
The Hacker News reports: Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system.
Vulnerabilities & remediation
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
BleepingComputer reports: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.
Vulnerabilities & remediation
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The Hacker News reports: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.
Vulnerabilities & remediation
Limited reports of PHP bug exploitation emerge
The Record reports: One cyber firm listed a half-dozen exploitations of the PHP2Shell bugs, and another identified a well targeted, suspected Chinese campaign that breached U.S. "government affiliated" servers.
Vulnerabilities & remediation
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
BleepingComputer reports: A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.
Security Operations
Cyberattack disrupts Belgian tax services before filing deadline
The Record reports: The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin, the country's main online platform for managing tax and financial affairs.
Security Operations
Japan Airlines suffers third-party data breach exposing passenger info
BleepingComputer reports: Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers.