GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]
THREAT INTELLIGENCE · RESEARCH · COMMUNITYSecurity news,
Security news,
without the noise.
Practical coverage of vulnerabilities, emerging threats, and the tools shaping modern security.
Latest intelligence
404 articlesOpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September
Understanding PHP2Shell: Everything you need to know about CVE-2026-109618 & CVE-2026-109619
PHP remains one of the most widely deployed server-side languages on the web. Estimates suggest it powers close to 70% of all websites, from small personal blogs to large-scale government services, banking platforms, and e-commerce applications. With such huge presence, any vulnerability in PHP's core engine carries the potential to affect a significant portion of the web. On October 21st, 2026, the PHP project released emergency patches for two critical remote code execution (RCE) vulnerabiliti
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]