Security news
The vulnerabilities and attacks that matter for websites, explained in plain words — with what to do about them.
CISA confirms PHP2Shell is exploited; US agencies must patch by 29 October
The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.
Exploit attempts seen against Oracle E-Business Suite RCE flaw
A honeypot operator reports exploratory attacks on CVE-2026-101767. There is no confirmed breach yet, but internet-facing EBS should be patched first.
JPCERT/CC warns of a wave of data-stealing intrusions at Japanese organisations
Since September, attackers have leaked personal data by scanning for known flaws, abusing hidden APIs found in mobile apps, and exploiting a Metabase SQL injection.
SiteGuard Server Edition WAF flaw exploited to run commands as root
An OS command injection in the widely used Japanese web application firewall is being exploited. It is on by default; collect diagnostics before you upgrade.
Microsoft October 2026 Patch Tuesday: 1,411 fixes and three zero-days
A record-size monthly update includes vulnerabilities already exploited in the wild, among them a Windows Shell security feature bypass.