Aggregator

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report

PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP […]

Name: CREST CTF 2.0 (an CREST CTF event.)
Date: Oct. 23, 2026, 5:30 a.m. — 23 Oct. 2026, 11:30 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://crest.ctf7.com/
Rating weight: 0
Event organizers: CREST

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an

Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]

American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]

This week, two critical flaws in the core of PHP forced websites around the world offline. Link11 assesses what is known about the attacks and the role of web application firewalls, explaining why only the update closes the gaps. On October 21, the PHP project released security updates for the two critical vulnerabilities, CVE-2026-109618 and […]

The post PHP2Shell: The First Wave Is Over, but the Real Risk Remains appeared first on Link11.

Athena-AI+雅典娜安全竞赛平台

Mercury 是一个基于 Python 的框架，主要用于将 Jupyter Notebook 快速转换为交互式的 Web 应用程序。在早期的版本中，其内核管理接口存在严重的访问控制缺陷。

本文复现 CVE-2026-109618 PHP2Shell OOM 堆破坏 RCE 漏洞，基于 Docker 靶场验证绕过 ASLR 的完整利用链，并对照官方补丁验证修复效果，总结复现坑点与安全加固方案。

一个键名后面还有没有点号，本该在本行之内就能确认。在 smol-toml ≤ 1.8.0 里，这个判断被做成了以整篇文档为范围的全文搜索。smol-toml 是 Squirrel Chat 维护的轻量 TypeScript TOML 解析器。

漏洞描述未认证攻击者可利用 get_page_template() 的页面模板解析逻辑，使 WordPress 包含活动主题目录之外的、攻击者选定的本地可读 .php 文件。在服务器环境和活动主题均满足特定前置条件时，可进一步导致远程代码执行（RCE）前置条件主题条件：当前启用的子主题或父主题包含一个以 page- 开头的顶级目录（例如 page-templates）。受影响的包括旧版 Twent

本文以 CVE-2024-57521（RuoYi v4.7.9 认证后 SQL 注入）为切入点，搭建一套基于 ELK Stack + Filebeat + Python 的安全日志分析与自动化告警响应平台，完整实现安全运营闭环。