Today's cybersecurity landscape highlights critical vulnerabilities needing urgent attention, particularly for PHP and certificate authorities, alongside a concerning rise in AI-driven attacks. Several high-profile breaches and ongoing ransomware campaigns underscore the persistent threats facing organizations of all sizes.
Emergency PHP Updates Address Critical RCE FlawsVulnerability
PHP is issuing an out-of-cycle security update to patch two critical remote code execution (RCE) vulnerabilities, rated 9.2 on the CVSS v4.0 scale. While specific details are undisclosed, these flaws allow attackers to execute arbitrary code. The fixes are available for supported PHP versions 8.2 through 8.5.
Why it matters: Website owners using PHP should apply these emergency patches immediately to prevent potential remote code execution on their servers and protect their online assets from attackers.
Read more at The Hacker News ↗
Major Certificate Authority Keys Compromised, Leading to Broad BlocksVulnerability
Eight private keys belonging to intermediate certificate authorities (CAs) from eMudhra have been compromised, confirmed by Mozilla and Google's Chrome Root Program. This compromise means an attacker with these keys could potentially issue trusted certificates for any website. Consequently, major browsers and the Go programming language have moved to block these compromised certificates.
Why it matters: If your website's SSL/TLS certificate was issued by eMudhra or any of the affected intermediate CAs, it might be untrusted by browsers soon, requiring a re-issuance to maintain secure connections for your users.
Read more at The Hacker News ↗
Public Exploit Released for Critical FortiSIEM FlawVulnerability
A critical path traversal vulnerability in Fortinet FortiSIEM (CVE-2026-106173, CVSS 9.4) now has a publicly available proof-of-concept (PoC) exploit. This flaw allows unauthenticated attackers to execute arbitrary code or commands on affected systems. Fortinet has already released a patch for this vulnerability.
Why it matters: Organizations using FortiSIEM must ensure they have applied the latest patches immediately, as the availability of a public exploit significantly increases the risk of attacks.
Read more at The Hacker News ↗
Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFARansomware
Ransomware groups Qilin and INC are actively exploiting a previously patched Palo Alto Networks PAN-OS and Prisma Access vulnerability (CVE-2026-0257, CVSS 7.8). This authentication bypass flaw allows attackers to establish unauthorized VPN connections, bypassing multi-factor authentication. Palo Alto Networks issued a patch for this vulnerability in May 2026.
Why it matters: If you use Palo Alto Networks' PAN-OS or Prisma Access, confirm that all security updates, especially those from May 2026, have been applied to prevent ransomware groups from exploiting this MFA bypass.
Read more at The Hacker News ↗
Autonomous AI Agents Used in Widespread Website BreachesThreat
A Chinese-speaking threat actor utilized autonomous AI agents to breach over 100 company websites, targeting more than 1,200 sites in total. Researchers observed these agents autonomously compromising targets, including major companies like Deere and SharkNinja. The operators mistakenly left their control panels exposed online, allowing for observation of the attacks.
Why it matters: The rise of AI in cyberattacks necessitates robust security measures. Small businesses should prioritize strong authentication, regular security audits, and continuous monitoring to defend against sophisticated automated attacks.
Read more at The Hacker News ↗
OVHcloud CLI Releases Backdoored on GitHub to Steal SecretsBreach
Attackers compromised a contributor's GitHub account and injected secret-stealing malware into five existing releases of OVHcloud's command-line interface (CLI) tool. The malicious archives were available for a short period before being detected and removed by OVHcloud, posing a supply chain risk to developers who downloaded them.
Why it matters: If your development team uses the OVHcloud CLI, verify the integrity of your installed versions and consider rotating any credentials or secrets that might have been exposed during the compromise window.
Read more at The Hacker News ↗
Zeabur Shuts Down After Second Security BreachBreach
Development platform Zeabur is ceasing operations following its second security incident in two months. The latest breach involved an attacker compromising infrastructure using leaked internal credentials, stealing over 3.2 million environment variable records and data from 321,810 accounts.
Why it matters: If you used Zeabur for development, immediately change any credentials, API keys, or other sensitive information that may have been stored on the platform, and review your systems for unauthorized access.
Read more at BleepingComputer ↗
Compromised UpdraftCentral Keys Backdoor WordPress SitesBreach
The website of TeamUpdraft, developers of popular WordPress backup and security plugins, was breached, potentially exposing UpdraftCentral connection keys. These compromised keys could allow threat actors to send commands and backdoor connected WordPress websites, posing a significant risk to plugin users.
Why it matters: WordPress site owners using UpdraftCentral should immediately check their installations for any unusual activity and rotate their UpdraftCentral connection keys to prevent unauthorized access.
Read more at BleepingComputer ↗
Russian APT28 Breaches NATO Naval ShipbuilderThreat
The Russian state-sponsored threat actor APT28 (also known as Fancy Bear or Forest Blizzard) has been linked to attacks targeting two NATO member states. One of these incidents involved a breach of a NATO naval shipbuilder, where the group deployed new custom malware, including a backdoor called HOOKEDGE and a reflective loader.
Why it matters: Even small businesses should be aware of state-sponsored threats, as supply chain attacks can target them to gain access to larger organizations. Implement robust network segmentation and advanced threat detection to mitigate risks.
Read more at The Hacker News ↗
Ahold Delhaize Experiences Cyberattack Disrupting ServicesBreach
Ahold Delhaize, a major global food retailer, confirmed that a recent cyberattack caused significant service disruptions across its stores in both Europe and the United States. The company is actively working to restore affected services, with many European websites and applications already operational, and US e-commerce platforms expected to be restored within days.
Why it matters: This incident highlights the pervasive risk of cyberattacks impacting operational continuity for large retailers. Businesses should have robust incident response plans and resilient backup systems to quickly recover from such disruptions.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.