Latest security news
Page 8
Wed, October 21
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own. Until you can install it, what lowers your
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness is where the engineering in AI pentesting sits. The Hugging Face intrusion OpenAI disclosed in July
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception
「代金後払いサービス」で個人情報が流出 - ヤマト運輸
ヤマト運輸の「クロネコ代金後払いサービス」がサイバー攻撃を受けた問題で、顧客の個人情報が流出したことを明らかにした。
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable. The post Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor appeared first on SecurityWeek .
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. ⚡
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote
PowerDNS Security Advisory 2026-12 for PowerDNS Recursor
Today we have released PowerDNS Recursor 5.3.12 and 5.4.8. These releases provide fixes for PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues There are several CVEs associated with this advisory, three with severity High and the remaining with severity Medium or Low .
著名ITサービス相次いで緊急メンテへ コドモン、シャドバ、BASE、さくらのレンタルサーバなど 「PHP」脆弱性に起因か
保育園向けSaaS「コドモン」、ゲーム「Shadowverse: Worlds Beyond」「さくらのレンタルサーバ」といった著名サービスが相次いで緊急メンテナンスに入ったり、同日午後11時ごろからのメンテナンスを予告したりしている。Web開発で広く使われるプログラミング言語「PHP」で緊急性の高い脆弱性が見つかった影響とみられる。
修正予告されたPHPの2件の深刻な脆弱性についてまとめてみた
2026年10月20日、PHPの開発元であるThe PHP Groupのセキュリティチームは、PHPの深刻な脆弱性2件を修正するセキュリティリリースを予告しました。ここでは関連する情報をまとめます。（開発元等から詳細情報が公開され次第更新します。） 開発元は何を予告したの? PHPのセキュリティチームは10月20日(協定世界時)、2件の critical な脆弱性を修正するセキュリティリリースを予告した。2件とも深刻度は CVSS v4.0 で 9.2(Critical)。リリースは10月21日14時(協定世界時、日本時間23時)の予定で、全てのPHP利用者に事前の準備を呼びかけた(出典: 1…
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order. They may also no longer buy information technology products or services from the Chinese AI developer or its affiliates Homeland Security Secretary
「ふるさとチョイス」に不正アクセス - 会員情報が流出
ふるさと納税サイト「ふるさとチョイス」が第三者によるサイバー攻撃を受け、登録会員の個人情報が流出したことがわかった。
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)
Oracle、四半期定例パッチで1295件を修正 - 深刻な脆弱性も
Oracleは現地時間2026年10月20日、四半期ごとに提供している「Critical Patch Update（CPU）」を公開した。
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek .
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a track record of striking industrial
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader. The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek .
不正アクセス急増は“SaaS離れ”を招くか？ 露呈したもう1つの「SaaS is Dead」リスク
不正アクセス急増に伴い再燃する「SaaS is Dead」を巡る議論。ただ、これまでとは少々事情が違うようだ。
「PHP」に複数の深刻な脆弱性 - 21日に修正版を公開予定
「PHP」に複数の深刻な脆弱性が確認された。PHPのセキュリティチームは、10月21日に修正版をリリースする計画で、利用者にアップデートの準備を呼びかけている。
「Plex Media Server」など6件、悪用済み脆弱性に注意喚起 - 米CISA
米サイバーセキュリティインフラセキュリティ庁（CISA）は現地時間2026年10月20日、悪用が確認された脆弱性6件について注意を呼びかけた。
「カーセンサー」などに不正アクセス、最大371万件の個人情報漏えいか 問い合わせ客の氏名・住所など
リクルートは10月21日、中古車情報サイト「カーセンサーnet」などへの不正アクセスにより、最大約371万件の個人情報が漏えいした可能性があると発表した。中古車販売店に問い合わせた利用者の氏名や住所などが対象で、販売店側の情報も含まれる。
フジテレビに不正アクセス、メディア関係者の個人情報最大730件漏えいか 番組宣伝システムが被害
フジテレビは10月20日、番組宣伝システムが第三者による不正アクセスを受け、メディア関係者の個人情報が最大730件漏えいした可能性があると発表した。
PHPに「緊急」レベルの脆弱性2件 修正版を日本時間21日深夜に公開へ、事前準備を呼び掛け
PHPの開発プロジェクトは最大深刻度「Critical」の2件の重大な脆弱性を修正するアップデートの公開を予告した。リモートコード実行の恐れがあり、旧バージョンを含む広範な環境が影響を受ける可能性がある。専門組織は事前準備や、即時適用が困難な場合は外部からの切り離しを推奨している。
「Chrome 156」公開、脆弱性353件を修正 - 「クリティカル」6件
Googleは、ウェブブラウザ「Chrome」の最新版となる「Chrome 156」をリリースした。多数の脆弱性に対処しており、重要度がもっとも高い「クリティカル（Critical）」とされる脆弱性も6件含まれる。
Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
認証局eMudhraの中間証明書、秘密鍵が「数ミリ秒」で復元可能な脆弱性 大手各社が緊急遮断
インドの認証局eMudhraの中間証明書8件で、秘密鍵が第三者でも瞬時に復元可能な状態だったと判明した。悪用されればWebサイトのなりすましが可能になる。主要Webブラウザは遮断し悪用は確認されていないが、失効検証機能が標準で働かない非ブラウザ環境向けにGo開発チームなどが緊急修正を配布した。
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Weekly Report: 複数のマイクロソフト製品に脆弱性
複数のマイクロソフト製品に脆弱性
Weekly Report: SiteGuard Server EditionにOSコマンドインジェクションの脆弱性
SiteGuard Server EditionにOSコマンドインジェクションの脆弱性
Weekly Report: JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開
JPCERT/CCが「連続不正アクセス事案の攻撃手法に関する調査」を公開
Weekly Report: GitLabに複数の脆弱性
GitLabに複数の脆弱性
Weekly Report: ProgressのMarkLogic Serverに複数の脆弱性
ProgressのMarkLogic Serverに複数の脆弱性
Weekly Report: ((OTRS)) Community Editionに認証回避の脆弱性
((OTRS)) Community Editionに認証回避の脆弱性
Weekly Report: AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性
AssetViewに重要なリソースに対する不適切なアクセス権の割り当ての脆弱性
Weekly Report: Ivanti Connect Secureに認証回避の脆弱性
Ivanti Connect Secureに認証回避の脆弱性
Weekly Report: 複数のFortinet製品に脆弱性
複数のFortinet製品に脆弱性
Weekly Report: 複数のSAP製品に脆弱性
複数のSAP製品に脆弱性
Weekly Report: 複数のMozilla製品に脆弱性
複数のMozilla製品に脆弱性
Weekly Report: 複数のZoom製品に脆弱性
複数のZoom製品に脆弱性
Weekly Report: Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性
Cisco Secure Email Gatewayに任意のファイル書き込みの脆弱性
Weekly Report: 複数のPalo Alto Networks製品に脆弱性
複数のPalo Alto Networks製品に脆弱性
Weekly Report: NextcloudのCollabora Online - Built-in CODE Serverに脆弱性
NextcloudのCollabora Online - Built-in CODE Serverに脆弱性
Weekly Report: EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性
EC-CUBE4系用プラグイン「AmazonPayプラグイン」に不変と想定しているWebパラメータの外部制御の脆弱性
Weekly Report: Next.jsに複数の脆弱性
Next.jsに複数の脆弱性