Drupal Commerce Core authorization bypass actively exploited
CVE-2026-118539 affects Commerce Core 0.0.0–2.41 and 3.0.0–3.3.13; Drupal says to upgrade to 8.x-2.41 or 3.3.13.
74
- Mentions · 7d32
- Mentions · 30d82
- All mentions123
- First seenAug 12, 2026
- Last mentioned16h ago
Timeline
123 articles · newest firstCISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
74
Google unveils Gemini 4 Carbon for finding and fixing flaws
Limited Fairwind access comes first; Google cites 88.2% on SEC-bench Pro and prices of $2 and $10 per million tokens.
74
Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
Google unveils Gemini 4 Carbon for security and coding work
Access starts with selected cyber defenders via Fairwind at $2 per million input tokens before a later price rise.
74
Wiz CTO discusses PHP critical-bug cleanup on Equity podcast
Schwartz says he joined OpenAI, Calif and the PHP team after two critical bugs forced some sites offline.
30
Wiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
32
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
74
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
86
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
86
Google announces Gemini 4 Carbon with cybersecurity focus
Selected cyber defenders get access this week via Fairwind, priced at $2 and $10 per million tokens.
90
Google DeepMind announces Gemini 4 Carbon frontier model
Limited access starts with cyber defenders under Fairwind, at Argon’s $2/$10 per million token prices.
92
PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
30
Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
76
CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
88
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
86
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
86
Wiz reports limited PHP2Shell exploitation attempts after disclosure
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
78
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
72
LiteLLM supply chain attack began with an unrevoked GitHub master key
Poisoned release 1.107.0 carried an infostealer and remote access trojan and drew about 49,000 downloads before PyPI quarantined it.
76
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
74
Gheist used stolen GitHub tokens to steal secrets from 850 accounts
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
74
GitHub Actions pwn-request fixes still leave checkout gaps
Old actions/checkout SHA pins and triggers such as issue_comment can still run fork code with secrets.
64
Unrevoked LiteLLM key used to publish credential-stealing PyPI package
Microsoft said the malware ran on every Python startup, and stolen AWS keys were checked against Amazon AI models.
76
CSO ranks incumbent security vendors adapting to AI threats
Palo Alto’s Prisma AIRS hit $100 million ARR, and the company bought CyberArk for $25 billion.
22
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
82
Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Equity podcast debates PHP flaws, disclosure panic and attack attempts
Cloudflare's CEO is cited as seeing PHP2Shell attack attempts climb into the millions after an embargo broke.
36
PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
78
PHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
62
Third PHP2Shell bug waits for the regular PHP release
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
72
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
Essay says AI shrank PHP2Shell exploit time to hours
The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.
34
Malicious LiteLLM 1.107.0 packages hit PyPI and Docker Hub
The poisoned build was online about three hours, downloaded over 49,000 times, and the latest clean release is 1.106.2.
78
PHP before 8.2.35 and related releases allows remote code execution
Two flaws let unauthenticated attackers send crafted HTTP requests; a mod_php proof of concept runs before application code.
78
Wiz: PHP flaws back to 5.4 allow RCE or memory reads
Wiz says unauthenticated attackers can run code or read process memory that may hold passwords and tokens.
62
Tribus posts Wiz php2shell link in PHP RCE thread
The October 22 oss-security note contains only a link to Wiz’s php2shell PHP RCE blog.
52
PHP2Shell takes 32 UK government services offline
AWS says the two critical PHP bugs were exploited four days before disclosure; no public-sector compromise is confirmed.
88
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-420169%8.8Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
- CVE-2026-59822<1%8.8Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM
- CVE-2026-4201810%7.5Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
- CVE-2026-4835645%9.3Unrestricted dangerous file upload in Adobe Commerce and Magento
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
Appears with
- OpenAIorganization · 36
- Wizvendor · 32
- PHPproduct · 27
- Googlevendor · 24
- CISAorganization · 19
- Googleorganization · 18
- Gemini 4 Argonai model · 17
- Cloudflareorganization · 16
- Califorganization · 16
- PHPvendor · 15
- Microsoftvendor · 13
- LiteLLMproduct · 11
- GPT-5.6 Solai model · 10
- GitHubvendor · 10
- PHP Foundationorganization · 10
- watchTowrorganization · 9
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.