CISA added critical PHP flaws CVE-2026-109618/109619 (unauthenticated RCE) to its KEV list; honeypots caught 35 working shells Oct 24. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; federal deadline Oct 29.
CVE-2026-111497, an out-of-bounds write in Brotli decompression, can lead to RCE via fetch() responses and Express 5 bodies. Akamai says 61% of networks it sees run affected Node versions; upgrade to 22.23.4, 24.22.1 or 26.12.1.
Resets followed days of service problems, with no word yet on cause or data access. DreamHost customers should rotate credentials and review access logs.
GMO Internet's tenth update confirms suspected attackers published claimed company and customer data; its white-hat team is checking customer devices for planted malware. Expect phishing impersonating the Japanese provider.
About 9,408 SOL left users' wallets in 94 seconds. Bloom blames a third-party module RCE and promises reimbursement, but transfers were signed with victims' own keys: if a bot ever held your key, move to a fresh wallet.
A flash loan won two of three council seats, which approved a treasury sale worth about $4.75M; 821 ETH then went to Tornado Cash. A textbook case of governance with no timelock or defense against borrowed votes.
A MoveVM script-caching bug let an attacker mint unbacked tokens and bridge out about $2.7M before the chain halted. It stays halted until an audited fix ships.
Seoul police tied seven suspects to breaches of 90+ organizations with ransom demands around $270K; the leader used an autonomous AI pentesting suite to scale attacks.
Hackers moved past the limited SmileBASIC jailbreak to dumping firmware and games to a PC, with AI models reportedly helping find the memory-read chain. Expect a quick Nintendo patch.
Trivy · Apache-2.0 license
Trivy, from Aqua Security, scans container images, filesystems, Git repos and Kubernetes clusters for known vulnerabilities, misconfigurations, exposed secrets and license issues. It's built for DevOps and security teams who want one free scanner they can drop into CI.