vulnerability
21 articles with this tag
[Breaking] Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), Japan's IPA and JPCERT/CC issue alerts: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now
On October 21, 2026, the PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution (RCE), and urged all users to update immediately. CVE-2026-109618 involves out-of-memory handling and CVE-2026-109619 involves stale internal state surviving between requests; both are rated 9.2 under CVSS v4.0. All PHP installations serving web requests are at risk (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). The team considers mod_php the highest risk, citing a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. PHP 8.1 and older get no official update; the team provided minimal source backports for 7.4, 8.0 and 8.1. Linux distributions received the patches in advance. There is no complete mitigation; updating is the only safe choice. On October 22, Japan's IPA and JPCERT/CC issued alerts and JVN published JVNVU#99905564. CISA said it had not observed exploitation as of its publication. No confirmed break-in had been announced as of 04:45 UTC on October 22. Many shared-hosting providers have announced that the fix is applied, but some have not yet. This site's take: confirm whether you or your provider updates PHP for each site and move to the fixed version today. On shared hosting, check your provider's completion notice on its official website.
Metabase vulnerability breaches (Trezor 80,689 customers and others): what leaked, and what affected people and analytics-tool operators should do
In August 2026 it emerged that an unauthenticated SQL injection in the BI (business intelligence) and analytics tool Metabase (CVE-2026-72898, CVSS 10.0) had been exploited before a fix was released. Metabase says fewer than 3% of its cloud customers and some internet-reachable self-hosted instances were compromised. Organizations that disclosed impact include Trezor, which sells cryptocurrency hardware wallets (80,689 customers' names, addresses, phone numbers and email addresses, via its logistics partner's analytics environment), laptop maker Framework, automation tool n8n, Anaconda's Kilo Code and wallet-infrastructure provider Privy. This site's take: what leaked matches what the compromised analytics tool could read at the time. Trezor customers should never type or share their wallet backup (recovery seed) and should assume their home address is known, so they should not follow instructions in letters or calls either. Operators of analytics tools should patch, and also limit the data the tool can read to the columns analysis actually needs.
Companies House WebFiling Flaw: Logged-In Users Could See Other Companies' Private Details — What Directors and Developers Should Do
On March 13, 2026, UK Companies House became aware of an issue that meant a logged-in registered user of its WebFiling service could potentially view and change another company's details after a specific set of actions. It closed WebFiling at 1:30pm that day and reopened it at 9am on March 16. According to Companies House, the cause was a defect introduced during a major system update on October 11, 2025, and it was not a cyber-attack. Data that may have been visible includes the day of the date of birth and residential addresses of directors and people with significant control (PSCs), and company registered email addresses; unauthorised filings such as new accounts or changes of director were also technically possible. Passwords, identity verification data and existing filed documents were not affected. An April 8 update said a very small number of instances of unauthorised access or attempted changes had been identified. This was an authorization failure, not an intrusion. The login check worked; the check on whether this user may handle this company did not. Directors should review their filing history and turn on Follow alerts; developers should test, on every release, that requesting someone else's data is refused.
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
What is CORS — how it works, and what a misconfiguration exposes
CORS is how the browser controls whether another origin's JS can read your API responses. A misconfiguration — reflecting any Origin, or Access-Control-Allow-Origin:* with credentials — lets a third-party site read logged-in data. The basic defense: an allowlist, don't blindly reflect Origin, default deny.
What is session fixation — making a victim log in with an ID the attacker already knows
Session fixation makes a victim use an attacker-known session ID, then impersonates them after they log in with it. The main defense: regenerate the session ID on login (and on privilege change). Don't accept IDs from the URL, and set HttpOnly/Secure/SameSite on cookies.
What is clickjacking? An attack that makes you click buttons on a transparent page laid over another
Clickjacking layers your real site invisibly over an attacker's page so the user performs an unintended action (transfer, settings change, consent). The main defense is refusing to be framed: CSP frame-ancestors plus X-Frame-Options.
What is IDOR: a flaw that exposes other people's data when an ID is changed
IDOR lets a user change ?id=124 to 125 and read someone else's invoice or personal data — broken access control. The main defense: server-side, check on every access whether the logged-in user is allowed this object. Hard-to-guess IDs are not a fix.
What is open redirect: a flaw that forwards users from your trusted URL to another site
An open redirect lets a ?next= style parameter forward users to any external site, borrowing your trusted domain for phishing. The main defense: never accept external URLs as redirect targets; use relative paths and an allowlist only.
What is path traversal — reading files the server should never serve, via ../
Path traversal mixes ../ into a filename input to escape the base directory and read/write .env, config, or keys. The main defense: never use user input as a raw file path, and normalize-then-confine inside an allowed base directory.
What is CSRF (Cross-Site Request Forgery): an attack that makes a logged-in user send requests they did not intend
CSRF makes a logged-in user's browser send an unintended action, abusing the browser's habit of auto-attaching cookies. The main defense is CSRF tokens plus SameSite cookies. Never use GET for state changes.
What is SQL injection (SQLi): a flaw that lets input rewrite your database commands
SQLi is when input is read as 'part of the command' rather than data, changing a query's meaning and leading directly to read/alter/delete. The main defense is to stop string-concatenating SQL and pass values via placeholders (prepared statements).
What is XSS (Cross-Site Scripting): a flaw that runs an attacker's script in another user's browser
XSS makes an attacker-supplied string run 'as script' in another user's browser, leading directly to session theft and impersonation. The main defense is escaping on output. Don't disable your framework's auto-escaping.
What is a CVE? How the shared vulnerability ID system works
A CVE is a globally shared ID for a vulnerability (e.g. CVE-2025-12345). CVE = the name, CVSS = severity, KEV = is it exploited. It's the anchor for monitoring. Track it with machines, not by hand.
What is CVSS? The vulnerability severity score and how it's calculated
CVSS rates severity 0.0–10.0. The score is computed from defined metrics (attack vector, complexity, privileges, user interaction, scope, CIA impact) through a public formula — not a guess. Know the rubric and you can read what a 10.0 means. Still, prioritize with KEV (is it exploited) and whether you use it.
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE lets an attacker run arbitrary code on your server — straight to takeover, the worst class. How far the damage spreads is set by the running process's privileges. The core defenses are fast patching, CVE monitoring, and least privilege.
What is SSRF (Server-Side Request Forgery)
SSRF abuses external-input URLs to make a server access internal resources (internal IPs, cloud metadata). If you fetch URLs, you need an allowlist of destinations, internal-target blocking, and protection against redirect/DNS-rebinding bypasses. It was the cause of the Capital One breach.
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 9.8) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy detection.
Heartbleed (CVE-2014-0160) — an OpenSSL bug that leaked server memory
OpenSSL's memory over-read could leak private keys and sessions. The cause: the server trusted a claimed length and read adjacent memory. The lesson: act as if it all leaked (re-issue certificates, rotate all secrets), monitor widely used base libraries, and value memory safety.
Log4Shell (CVE-2021-44228) — a logging library flaw, and why teams couldn't quickly tell if they used it
Log4j's CVSS 10.0 bug. The core problem was the transitive dependency: being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the follow-up CVEs are the lessons.
The XZ Utils backdoor (CVE-2024-3094) — a supply-chain attack by a trusted co-maintainer
A trusted maintainer planted a backdoor in xz, a supply-chain attack. One engineer noticed logins were slow and found it just before stable releases. Code wasn't the target; people and trust were. Minimize dependencies, pin versions, build reproducibly, chase anomalies, and support maintainers.