Posts of last few hours

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html
Arista Networks security advisory (AV26-1080) – Update 1
https://cyber.gc.ca/en/alerts-advisories/arista-networks-security-advisory-av26-1080
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP […]
https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html
The cyber threat to aviation
https://cyber.gc.ca/en/guidance/cyber-threat-aviation
CREST CTF 2.0
Name: CREST CTF 2.0 (an CREST CTF event.)
Date: Oct. 23, 2026, 5:30 a.m. — 23 Oct. 2026, 11:30 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://crest.ctf7.com/
Rating weight: 0
Event organizers: CREST
https://ctftime.org/event/3477
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1
https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/
PHP2Shell: The First Wave Is Over, but the Real Risk Remains

This week, two critical flaws in the core of PHP forced websites around the world offline. Link11 assesses what is known about the attacks and the role of web application firewalls, explaining why only the update closes the gaps. On October 21, the PHP project released security updates for the two critical vulnerabilities, CVE-2026-109618 and […]

The post PHP2Shell: The First Wave Is Over, but the Real Risk Remains appeared first on Link11.

https://www.link11.com/en/blog/threat-landscape/php2shell-the-first-wave-is-over-but-the-real-risk-remains/
攻防竞赛 Athena-AI+雅典娜安全竞赛平台案例分享
Athena-AI+雅典娜安全竞赛平台
https://xz.aliyun.com/news/92962
Mercury 框架未授权远程代码执行漏洞 (RCE) 深度剖析
Mercury 是一个基于 Python 的框架，主要用于将 Jupyter Notebook 快速转换为交互式的 Web 应用程序。在早期的版本中，其内核管理接口存在严重的访问控制缺陷。
https://xz.aliyun.com/news/93020
CVE-2026-109618 (PHP2Shell) 漏洞深度复现与修复验证
本文复现 CVE-2026-109618 PHP2Shell OOM 堆破坏 RCE 漏洞，基于 Docker 靶场验证绕过 ASLR 的完整利用链，并对照官方补丁验证修复效果，总结复现坑点与安全加固方案。
https://xz.aliyun.com/news/93027
一个点号的全文搜索：smol-toml 二次方解析拒绝服务（GHSA-r4xh-jqrq-34v2）复现与分析
一个键名后面还有没有点号，本该在本行之内就能确认。在 smol-toml ≤ 1.8.0 里，这个判断被做成了以整篇文档为范围的全文搜索。smol-toml 是 Squirrel Chat 维护的轻量 TypeScript TOML 解析器。
https://xz.aliyun.com/news/92977
WordPress 页面模板解析路径遍历漏洞详解（CVE-2026-87902）
漏洞描述未认证攻击者可利用 get_page_template() 的页面模板解析逻辑，使 WordPress 包含活动主题目录之外的、攻击者选定的本地可读 .php 文件。在服务器环境和活动主题均满足特定前置条件时，可进一步导致远程代码执行（RCE）前置条件主题条件：当前启用的子主题或父主题包含一个以 page- 开头的顶级目录（例如 page-templates）。受影响的包括旧版 Twent
https://xz.aliyun.com/news/92979
从 RuoYi CVE-2024-57521 到 ELK 攻击溯源：一次完整的安全运营闭环实
本文以 CVE-2024-57521（RuoYi v4.7.9 认证后 SQL 注入）为切入点，搭建一套基于 ELK Stack + Filebeat + Python 的安全日志分析与自动化告警响应平台，完整实现安全运营闭环。
https://xz.aliyun.com/news/92981
2026年第二届黑灰产检测技能大赛区域决赛 WP
上个月打了一场黑灰产检测方向的线下赛，题面全部围绕涉黑灰产案件的电子数据取证展开：聊天记录、支付流水、群组事件、登录日志、APK 样本、WHOIS 历史，覆盖了从身份归一到资金链分析的完整链路。赛后把全部解题过程重新整理了一遍，形成这篇复盘。
https://xz.aliyun.com/news/92982
一个反斜杠击穿主机白名单：fast-uri 双 CVE 的成因、复现与补丁审计
fast-uri 把反斜杠当普通字符，Node 原生 URL 把它当路径分隔符。同一个 URL 在检测端解析出主机 allowed.com，在请求时却连到 127.0.0.1，CVE-2026-16221 与 CVE-2026-18446 都出在这个分歧上。
https://xz.aliyun.com/news/92984

Managed ad