Security news.
Critical remote code execution vulnerabilities in PHP and Brotli decompression libraries are triggering an industry-wide patching wave as in-the-wild exploitation ramps up. Threat actors are also escalating identity-based attacks against cloud infrastructure, leveraging stolen GitHub tokens and Microsoft Teams social engineering. Meanwhile, critical sandboxing flaws in Wasmtime and mass e-commerce malware injections present urgent remediation priorities for developers.
PHP2Shell Flaws Actively Exploited in the Wild
Threat actors are actively weaponizing two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), transitioning from early reconnaissance probes to launching active interactive shells against targets.
Critical 'HTTP2Shell' Brotli Bug Sparks Emergency Multi-Ecosystem Patches
An out-of-bounds memory corruption vulnerability in the Brotli decoder has prompted urgent updates across Node.js, Microsoft .NET, and Python environments to avert remote code execution.
PHP Releases Second Brotli Update for Windows Builds
PHP rebuilt Windows packages for versions 8.2 through 8.5 to address CVE-2026-111497, a memory corruption flaw reachable when the cURL extension automatically decompresses malicious HTTP responses.
'Gheist' Campaign Abuses Stolen GitHub Tokens to Exfiltrate Secrets
An automated attack leverages compromised developer tokens to inject malicious workflows into GitHub Actions, dumping repository secrets into execution logs before deleting the traces.
Wasmtime Sandboxing Vulnerabilities Risk WebAssembly VM Escapes
Maintainers patched two critical vulnerabilities in the Wasmtime runtime that could permit specially crafted WebAssembly modules to break isolation boundaries and execute code on host systems.
Malware Campaign Injects Stealth JavaScript Across 950+ Online Stores
Nearly a thousand e-commerce platforms, predominantly Magento, have been compromised with obfuscated loader code designed to selectively evade scanners and deliver malicious payloads.
Attackers Exploit Microsoft Teams External Chat for Ransomware Delivery
Adversaries are systematically leveraging external tenant communication features in Microsoft Teams to run IT support impersonation scams that drop loaders and ransomware.
DreamHost Triggers Forced Password Resets After Security Breach
The hosting provider has initiated mandatory password updates across email, FTP, and SFTP accounts following an infrastructure disruption involving its File Manager service.