PHP2Shell Is Now Exploited in the Wild: What to Do Today
Two critical PHP RCE flaws, tracked as PHP2Shell, now have a confirmed successful exploit in the wild. Here is what the reports say, what they don't, and what I would do about it right now.
Your Downloads Folder Can Now Give Orders to Your AI Coding Agent
Researchers found a malicious AGENTS.md in a customer's Downloads folder that pushed an AI coding agent to install a rogue npm package. Here is what was reported, why it works, and what to change today.
ConnectWise Application Identities Compromised: What MSPs and Partners Should Check in Microsoft 365
Attackers got hold of ConnectWise application identities and used them against Microsoft 365 tenants. Here is what has been reported, why stolen app credentials are so dangerous, and what I would check first.
Vghost: A Nine-Year-Old Linux vhost Bug Gives Local Users Root and Lets Guests Hit the Host
CVE-2026-74580, nicknamed Vghost, is a stale-cache bug in Linux's vhost subsystem that gives local users root and, in one setup, lets a guest VM attack the host's QEMU process. Here is what's reported, who is exposed, and what to do now.
SlugFest: How a Repo Rename Could Hand Your npm Package to an Attacker
Bloom Security found that npm trusted publishing trusted a repository's name instead of its permanent ID until the first publish, leaving 1,500+ packages open to hijacking. GitHub has now added a 48-hour validation window, but maintainers still have…
Unpatched LMCache Flaw Gives Unauthenticated Attackers Remote Code Execution
A critical LMCache bug (CVE-2026-105192) lets anyone who can reach the multiprocess server run code on it, and there is no fixed version yet. Here is what is known, and what I would check first.
Hacked Fridge Controllers: What the French Supermarket Attack Teaches Us
Attackers reportedly heated fridges and freezers at hundreds of French supermarkets through internet-reachable Danfoss controllers. Here is what is known, what is not, and what operators of similar gear should do now.
CVE-2026-21589: Atlassian Data Center Bug Was Under Attack Within Two Hours
A critical arbitrary file access flaw in Atlassian Data Center products saw exploitation attempts about two hours after technical details went public. Here is what was reported, what I think it means, and what to do today.
Linux Backdoors Are Dressing Up as Your Email Security Software
Rapid7 found Linux implants in South Korea and Taiwan posing as products like SpamSniper and ShareTech, and using SMTP for command and control. Here is what was reported and what defenders can do about it.
What the Integrity Tech Advisory Tells Defenders About Chinese Email-Theft Operations
A joint advisory from CISA, the FBI, NSA and international partners details how actors enabled by Integrity Technology Group scan, spray passwords, persist through SoftEther VPN, and quietly pull email. Here is what I would act on first.