Topic
News
Vulnerability news and short takes
3 posts
- News
PHP2Shell: the bug isn't in your app, it's in PHP itself
CVE-2026-109618 and CVE-2026-109619 open the door to unauthenticated RCE in the PHP runtime. Updating your CMS isn't enough; you need to patch the PHP binary on the server. - News
Coruna reaches iOS 18: a new wave with the DarkSword chain
The Coruna exploit kit, which hit older iPhones in March, expanded in late October with a DarkSword-based chain covering iOS 18.4–18.7.2. 608 domains, one-visit compromise and Telegram data. - News
Hunting for Treasure in the IOC Trash: The ‘Real’ Face of Threat Intel
Stop chasing static IPs and hashes. If you want to actually hurt an attacker, you need to climb the Pyramid of Pain and start targeting our TTPs.