Posts Tagged ‘patch management’
Dahua Camera Takeover Via Easy4IP Cloud Access
Attackers are taking over Dahua IP cameras and video recorders through Easy4IP, Dahua’s cloud remote-access feature, according to a CERT-UA alert published on October 23 and reported by Security Affairs on October 27. A Dahua camera takeover does not need an open port: the device dials out to Dahua’s cloud, and from there it can…
Read MoreBrotli RCE Vulnerability Node2Shell Added to CISA KEV
The Brotli RCE vulnerability CVE-2026-111497, known as Node2Shell, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 27. Brotli is compression code that sits inside runtimes, web servers and browsers, so the flaw lives in places nobody lists as a product. On October 26, researchers still disagreed on how reliably it gives code…
Read MorePHP2Shell Vulnerability: The Flaw Is in PHP Itself
We have covered PHP2Shell twice already: in our post of 21 October and in our Top 5 of 23 October. A week after PHP shipped its emergency patches, this is a closer look at the PHP2Shell vulnerability: what the flaw is, what turned out to matter, and what is still worth checking this week. Two…
Read MoreFortiSIEM RCE Vulnerability Now Has a Public Exploit
A FortiSIEM RCE vulnerability, CVE-2026-106173, now has a public exploit, and as of October 26 the Canadian Cyber Centre says open-source reporting indicates it is being exploited in the wild. FortiSIEM is the system many teams use to spot attacks, so a compromised appliance costs defenders visibility and hands an attacker a foothold next to…
Read MorePHP Critical Vulnerabilities Leaked Before Patch
Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team released the fix on October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code execution.…
Read More