Cybersecurity News
Filters
Filtered by category: Cybersecurity News, tag: remote code execution × Clear
Fortinet Urges Customers to Patch Critical Flaws Affecting FortiOS, FortiManager, and FortiAnalyzer
Matched: OpenAI
Fortinet is urging customers to apply security updates releasing October 22 for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, addressing critical and high-severity vulnerabilities. The company warns against treating patches as routine, noting attackers can use AI-assisted patch diffing to build exploits within hours. Public advisories will follow on November 10, but Fortinet asks customers to act immediately, prioritizing internet-facing devices.
October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks
Matched: cryptocurrency
Multiple critical security issues emerged October 21, 2026. PHP patches addressed two RCE flaws (CVSS 9.2); Node.js fixed ten vulnerabilities including a Brotli decompression RCE. LiteLLM version 1.107.0 contained credential-stealing malware; AWS keys were misused within hours. WordPress plugin firm UpdraftPlus suffered a management key breach. OVHcloud CLI binaries were briefly replaced. Eight eMudhra certificate authority signing keys were found recoverable from public certificates. Palo Alto GlobalProtect and Plex servers faced active exploitation. Patching alone is insufficient where credentials or backdoors may already exist.
PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers
Matched: OpenAI
PHP has released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, which could allow unauthenticated remote code execution on web servers. Both carry a CVSS 4.0 score of 9.2. Fixed versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Administrators should update immediately and restart PHP workers to ensure patched versions are active across all services.