CVEFeed Newsroom – Latest Cybersecurity Updates
The "Cyber Newsroom Feed" module is a live feed of the latest cyber news enriched with CVE and vulnerability data. The feed is updated every 10 minutes and includes the latest news from the cyber security industry. The feed is designed to provide users with a comprehensive overview of the latest cyber security news and trends.
-
The Hacker News
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Cont ...
-
The Hacker News
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bun ...
-
TheCyberThrone
Cisco Releases October 2026 Security Updates for Unified Communications Products
October 22, 2026Cisco has released security updates for multiple Unified Communications products, addressing eight vulnerabilities across different weakness categories. Published on October 21, 2026, ...
-
The Hacker News
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of ...
-
The Hacker News
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the fla ...
-
CrowdStrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
Two critical memory-corruption remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell, have been disclosed in core PHP, the underlying engine powering a vast portion of the web. Th ...
-
SentinelOne
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique
Executive SummaryOn October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4. ...
-
Dark Reading
'PHP2Shell' Bugs Signal Red Alert for Security Industry
4 Min ReadCredit: DSGpro via Getty ImagesA pair of critical vulnerabilities tied to open source scripting language PHP appear to have significant consequences for much of the server infrastructure hol ...
-
The Hacker News
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2 ...
-
Kaspersky
PHP2Shell: How to Protect Your Server | Kaspersky official blog
vulnerabilities PHP developers have released patches for two critical vulnerabilities that could allow an attacker to remotely execute arbitrary code on the server without authentication. Editorial Te ...