Security news.
Critical remote code execution vulnerabilities in core PHP continue to draw active exploitation and botnet activity, including rapid AI-driven intrusions against government targets. Meanwhile, CISA has mandated patches for actively exploited bugs in Collabora Online and Arista VeloCloud, as novel supply chain compromises and root privilege escalations hit enterprise developer stacks.
PHP2Shell Vulnerabilities Exploited via Agentic AI in Government Breach
Threat actors are actively abusing PHP flaws CVE-2026-109618 and CVE-2026-109619 alongside autonomous AI frameworks, exfiltrating password hashes and MFA configurations within hours of initial access.
CISA Adds Collabora Online and Arista VeloCloud Zero-Days to KEV Catalog
CISA issued emergency patching directives for actively exploited vulnerabilities, including an OS command injection flaw (CVE-2026-110447) in Collabora Online CODE Server and an Arista VeloCloud Orchestrator SQL injection flaw (CVE-2026-114625).
Tailscale SSH Flaw Enables Lateral Privilege Escalation to Root
Misconfigurations in networks with port-forwarding enabled can allow an attacker with control of a single authorized device to escalate privileges to root across reachable servers.
Widespread Brotli Decoder Memory Flaw Impacts Bun, Node.js, and Python
Tracked as CVE-2026-111497, a buffer overwrite vulnerability in Google's Brotli decompression library threatens memory corruption and potential arbitrary code execution across major runtime ecosystems and Envoy proxies.
Leaked LiteLLM Master Key Triggers Python Supply Chain Hijack
An exposed key in a public repository enabled threat actors to hijack LiteLLM's release pipeline and deploy poisoned package versions designed to harvest credentials via Python startup hooks.
BlackX UEFI Bootkit Bypasses Secure Boot in Diplomatic Espionage Campaign
Suspected China-nexus actors deployed the BlackX bootkit using the Baton Drop flaw to circumvent Windows Secure Boot and disable endpoint defenses across targets in Central Asia.
HPE ArubaOS Updates Address Eight Maximum-Severity RCE Flaws
HPE released fixes for 72 vulnerabilities across ArubaOS, featuring eight critical bugs carrying 10.0 CVSS scores that allow unauthenticated remote code execution and authentication bypass.
Rogue Markdown Instruction File Tricked AI Coding Agents into Installing Malware
Researchers discovered malicious directives in an AGENTS.md file stored in a Downloads folder that prompted autonomous coding assistants to pull rogue packages from npm.