WARNING: Another Unpatched PHP RCE, Node2Shell Exploit, Linux RCE Exposed and More

THN Daily Updates Learn to Build a Security Operations Roadmap for AI-Powered Threats Learn how to assess your AI threat readiness and build security operations with the visibility, context, and speed needed to investigate and stop machine-speed cyberattacks. Download Now Sponsored LATEST NEWS Oct 23, 2026 PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applicatio... Read More Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involve... Read More Guide: How to Set Up a Vulnerability Disclosure Program Only about half of the critical secret leaks GitGuardian reports get fixed. Six steps, with templates. Read More Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow ... Read More Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the offi... Read More PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing ... Read More The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed it... Read More Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel... Read More Learn to Build a Security Operations Roadmap for AI-Powered Threats Learn how to assess your AI threat readiness and build security operations with the visibility, context, and speed needed to investigate and stop machine-speed cyberattacks. Download Now Sponsored This email was sent to sikubaycom.s3cr3tz@blogger.com. You are receiving this newsletter because you opted-in to receive relevant communications from THN. To manage your email newsletter preferences, please click here. Contact THN: info@thehackernews.com Unsubscribe THN | K.P BLock, Pitampura, Delhi