THREAT INTELLIGENCE · RESEARCH · COMMUNITY

Security news,
without the noise.

Practical coverage of vulnerabilities, emerging threats, and the tools shaping modern security.

Latest intelligence

5 articles

Cloudflare Blog · RESEARCHOct 21, 2026 · 06:36 PM · UTC · UTC+00:00

Cloudflare deploys protections against php2shell vulnerability

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

RESEARCH

Elastic Security Labs · RESEARCHOct 21, 2026 · 05:56 PM · UTC · UTC+00:00

php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this behavior.

RESEARCH

Cisco Talos · RESEARCHOct 21, 2026 · 05:56 PM · UTC · UTC+00:00

Two critical RCEs in PHP core

Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial

RESEARCH

Zero Day Initiative · RESEARCHOct 16, 2026 · 08:12 PM · UTC · UTC+00:00

ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-95636.