In focus
Research and analysis
What changed, why it matters, and what to verify.
Vulnerability analysis
PHP’s October RCE fixes: patch the runtime, then verify the workers
The PHP project disclosed two critical remote-code-execution vulnerabilities on October 21. Fixed upstream branches begin at 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Apache mod_php and PHP-FPM have different demonstrated attack conditions; neither a WAF nor an application-framework upgrade substitutes for a patched runtime.
Read analysis →- 01eMudhra and emSign: the risk lives in the clients that still trust compromised intermediatesEight eMudhra intermediate CA certificates have compromised private keys, according to the certifi advisory. Attackers who can intercept a connection may impersonate services to clients that still accept the affected chains. The response must reach application bundles and container images as well as browsers.
- 02vCenter path traversal: virtualization control planes deserve incident scrutinyCISA added CVE-2026-59310 on 18 August 2026. Its record says a network-reachable VMware vCenter path traversal vulnerability could allow code execution and records known ransomware campaign use as known.
- 03SharePoint deserialization risk: patching needs an exposure reviewCISA added CVE-2026-45659 to KEV on 1 July 2026. Its record describes SharePoint Server deserialization of untrusted data that allows an authorised attacker to execute code over a network.
- 04PeopleSoft authentication gap: treat enterprise applications as exposed servicesCISA added CVE-2026-35273 on 12 June 2026 and describes missing authentication for a critical PeopleSoft Enterprise PeopleTools function that could permit takeover.
- 05PAN-OS VPN authentication bypass: verify remote-access exposure firstCISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on 29 May 2026. CISA describes an authentication bypass in PAN-OS that can establish an unauthorized VPN connection.
- 06Device Code Phishing and the MFA Blind SpotDevice code phishing does not need the user's password. It convinces the user to complete a legitimate Microsoft sign-in flow that authorizes the attacker's session. The defensive lesson is uncomfortable: MFA can be present, successful and still produce a compromised token if the wrong flow is allowed in the wrong context.
- 07FIRESTARTER and the Firewall Persistence ProblemCISA, the UK NCSC and Cisco describe FIRESTARTER as persistence on Cisco Firepower and Secure Firewall devices running ASA or FTD software. The operational lesson is sharp: if the public indicator is present, an upgrade alone is not enough; Cisco recommends reimaging and upgrading to fixed releases, while a physical cold restart is only a risky temporary mitigation.
- 08How DualScope Chooses Cybersecurity Sources and Uses CISA KEVDualScope separates raw cybersecurity feeds from reviewed summaries. This article explains the source mix, why official advisories matter, how CISA KEV is used, and what common acronyms mean before they become shorthand in the rest of the site.
- 09Vercel, Context.ai and the Open Authorization Supply Chain ProblemVercel says attackers used access connected to Context.ai to reach internal systems and enumerate non-sensitive environment variables. The deeper lesson is that Open Authorization (OAuth) grants, artificial intelligence (AI) productivity tools, browser sessions and developer platforms now form one connected attack surface.
- 10Stryker, Intune and the Risk of Destructive Cloud Admin ActionsReports on the March 2026 Stryker incident describe global disruption, wiped employee devices, and a possible Microsoft Intune remote-wipe path. The lesson is broader than one company: endpoint-management consoles are powerful administrative planes, and destructive actions need stronger guardrails than ordinary helpdesk workflows.