Security news.
The security landscape today is dominated by looming mass exploitation risks surrounding two critical unpatched PHP vulnerabilities, prompting emergency warnings and heightened readiness across web administrators. Concurrently, major supply chain and credential threats are unfolding, including compromised intermediate CA certificates and hijacked WordPress management infrastructure. Federal authorities are also stepping up pressure with new KEV additions and directives banishing specific AI tooling from agency systems.
Emergency Alerts Issued for Critical "PHP2Shell" Flaws
The SANS ISC has raised its Infocon to Yellow ahead of an emergency PHP release addressing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) with early PoC exploits already leaking.
Stolen UpdraftCentral Keys Used to Plant Backdoors on WordPress Sites
Attackers breached TeamUpdraft's infrastructure to access customer connection keys for UpdraftCentral, allowing them to dispatch commands and backdoor connected WordPress websites.
Major Browsers Block Compromised eMudhra Intermediate CAs
Google, Mozilla, and Apple have blocked eight intermediate certificate authority keys from eMudhra after flaws allowed their private keys to be easily recovered and forged.
CISA Adds Four Exploited Plex, Siemens, and SiteGuard Flaws to KEV
CISA has mandated federal agencies patch four actively exploited vulnerabilities, including the "Plex2Shell" flaws (such as SSRF flaw CVE-2026-96652) affecting Plex Media Server.
CISA Warns SafePay Ransomware Hit 600+ Critical Infrastructure Orgs
A new joint advisory details widespread campaigns by the SafePay ransomware group, which has breached more than 600 critical infrastructure entities globally since 2024.
U.S. Orders Federal Agencies to Remove DeepSeek AI Systems
The Department of Homeland Security directed civilian federal agencies to purge all products and integrations developed with Chinese vendor DeepSeek due to national security concerns.
Attackers Hijack 300+ Tor Exit Relays to Harvest SSH Passwords
Threat actors compromised over 300 Tor exit nodes over a five-day window to intercept plaintext SSH traffic and harvest server authentication credentials.
Compromised Developer Account Injects Stealer into OVHcloud CLI
Researchers found an attacker hijacked an OVHcloud developer's credentials using GlassWorm malware to inject an info-stealer into the official command-line interface.