php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

MSP remote access tool sent...

Deep Instincts researchers have uncovered a hacker group known as MuddyWater, which has been linked to Iran’s Ministry of Intelligence and Security and typically engages in covert operations operations targeting...

Eufy’s camera streams URLs offers...

Eufy denies claims that its cameras can be live streamed without encryption. Eufy stated that it does not upload identifiable footage to the cloud from its camera streams using VLC...

Android users at risk over...

A number of digital certificates used by vendors such as Samsung, LG, and MediaTek have been discovered to be compromised in order to stamp approval on malicious Android apps, rendering...

New Go-based malware target vulnerable...

Aqua Nautilus, a cloud security firm, discovered new Go-based malware that targets Redis (remote dictionary server), an open source in-memory database and cache. The attack was carried out against one...

DuckDuckGo launches beta version of...

DuckDuckGo, a privacy-focused search engine, has added an App Tracking Protection tool to its Android app, allowing users to see what personal data trackers are typically attempting to collect before...

Attackers leverage malicious python packages...

Security researchers from Checkmarx have uncovered an ongoing supply chain attack that involves spreading the malware identified as W4SP Stealer. W4SP Stealer is a discord malware that grabs all the...

Worok, the malware that hides...

Worok malware makes the rounds by deploying multi-level malware designed to steal data and compromise high-profile victims such as government entities in the Middle East, Southeast Asia, and South Africa,...

IceXLoader malware targets home and...

IceXLoader, an updated version of a malware loader, is suspected of infecting thousands of personal and enterprise Windows machines around the world. IceXLoader is a commercially available malware that costs...

Microsoft patches Windows 0-day...

Microsoft has fixed six actively exploited Windows vulnerabilities and 68 vulnerabilities in its November 2022 Patch Tuesday. Eleven of the 68 vulnerabilities fixed are classified as “critical,” allowing privilege escalation,...

Researchers uncover similar tools between...

According to security researchers from SentinelOne, the relatively new ransomware gang called Black Basta shares tooling and possibly personnel with the notorious FIN7 hacking group. The researchers were able to...

Hackers use Clop ransomware to...

A hacker group that is identified simply as DEV-0950 is using CIop ransomware to encrypt the network of organizations that were previously infected with the Raspberry Robin worm. Raspberry Robin...