Security news.
Critical remote code execution vulnerabilities in core web and decompression libraries are dominating defensive priorities, with widespread exploitation attempts underway. Attackers are also heavily targeting cloud developer environments and identity infrastructure through credential abuse, malicious agent prompts, and token-replay techniques.
PHP2Shell RCE Flaws Under Active In-the-Wild Exploitation
Attackers are actively targeting two critical remote code execution vulnerabilities in PHP core (CVE-2026-109618 and CVE-2026-109619), with scanning and exploit attempts observed globally.
Node2Shell Brotli Vulnerability Prompts Broad Ecosystem Patching
An out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) triggers memory corruption and code execution across Node.js, .NET, Bun, and multiple Python packages.
Microsoft 365 AitM Token Replay Breaches 79 Organizations
Adversary-in-the-middle relays were used to hijack session tokens and compromise nearly 100 enterprise Microsoft 365 accounts across multiple tenants.
Gheist Attack Hijacks GitHub Actions Logs to Exfiltrate Secrets
An automated campaign abuses stolen GitHub tokens to plant malicious workflows that echo sensitive repository secrets directly into build logs prior to retrieval.
Malicious Prompt File in Downloads Folder Targets AI Coding Agents
Security researchers stopped an attack that weaponized a local instruction file to manipulate developer AI coding assistants into installing malicious npm dependencies.
Persistent Campaign Injects Stealthy Loaders into 950+ E-Commerce Sites
Threat actors compromised 953 online storefronts with evasion-focused loader scripts that conditionally serve malicious skimming payloads to shoppers.
Tailscale SSH Configuration Flaw Enables Root Pivots
Attackers with an existing foothold on a permitted device can leverage port-forwarding configurations in Tailscale SSH to escalate to root on reachable network servers.
Arista Patches Third Actively Exploited VCO Zero-Day
CISA has added a critical Arista VeloCloud Orchestrator SQL injection flaw (CVE-2026-114625) to its Known Exploited Vulnerabilities catalog following active abuse to obtain operator privileges.