Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PHP2Shell is in CISA KEV: why runtime visibility matters

Five days after PHP shipped the fix, CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities (KEV) catalog. Federal civilian agencies have until October 29 to remediate. Last week’s question was whether attackers could turn the flaws into working shells. This week’s question is which of your images and hosts still run an affected PHP build, and who can fix each one.

CA distrust wargame: moving every certificate in 10 minutes

Last week, dozens of schools found out their certificate authority was being distrusted and they needed to replace all of their certificates in a few days. We wanted to know how we’d handle it if our own CA went away, and how long it would take. So we tried it with one of our other products. It has 6 certificates from Let’s Encrypt, deploying to 18 targets across Windows IIS, Linux nginx, Elasticsearch, and a mail server. Then we wargamed it: “Let’s Encrypt is being distrusted.

Fixing distrusted InCommon certificates with ERR_CERT_AUTHORITY_INVALID

Starting Tuesday, October 27, a lot of university websites will open in Chrome to this. Chrome is distrusting a root certificate, emSign ECC Root CA - G3, after eMudhra generated CA keys as small as 4. Every InCommon certificate issued from eMudhra’s ECC chain since April chains to that root.

Which Cloud Misconfigurations Would an Attacker Actually Exploit First?

A cloud security dashboard can produce hundreds of configuration issues in a single afternoon. There are a few small housekeeping concerns. Some leave customer files or administrative tools open for strangers to access. Security teams need to know what findings need quick attention, yet they have limited time to examine.

How Network Discovery Tools Map Every Device on a Company Network

A company network changes as staff connect laptops, printers, phones, servers, and virtual machines. Some devices remain for years; others appear briefly during projects, maintenance, or seasonal work. An incomplete inventory can leave an unmanaged endpoint exposed or slow an investigation. Network discovery gives IT teams a repeatable way to identify equipment and record details they can verify and maintain. The process starts with scans, but a useful map depends on what happens after detection.

Vibe Coding Has a Security Problem (And How to Fix)

I vibe coded a working app in 10 minutes without writing a single line of code. It ran fine. It also had a hardcoded API key, a database password sitting in a Model Context Protocol (MCP) config file, and an npm package I never checked. In episode one of Secure Vibe Coding, we look at what AI-assisted coding means for secrets security, using data from GitGuardian's State of Secrets Sprawl 2026 report.

PHP2Shell: What Security Teams Need to Know About CVE-2026-109618 and CVE-2026-109619

On October 21, 2026, the PHP project shipped emergency releases for two critical memory-safety bugs in the PHP core itself: CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both are rated CVSS 9.2. Both are reachable before any application code runs, which means a “Hello World” PHP page is as exposed as a full WordPress install. And both were being probed in the wild before the fix was public.

Internet2's certificate authority (eMudhra) is being distrusted

On Tuesday, October 27, Chrome will distrust an eMudhra root certificate, emSign ECC Root CA - G3. Mozilla already did. Most of the people who have to deal with it run IT at American universities. They get their certificates from InCommon, the certificate service Internet2 runs for higher education. The certificates say Internet2 on them, but since April, eMudhra, an Indian certificate authority, has issued them.

How to Keep a Game Server Safe From Crashes and Data Loss

Two years of building, gone in one afternoon. It happens to a group somewhere every week. Usually it starts small. A plugin updates badly. The power blinks during a save. Someone types a command they shouldn't. And the world file ends up half-written and unreadable. None of those things are rare. But almost all of them are survivable, if you set things up before they happen. Here's how.

Protecting sovereign AI with CloudCasa and SUSE AI Factory

A production AI service accumulates data that your team needs to recover: documents, embeddings, vector indexes, application settings, and conversation history. Once a retrieval-augmented generation (RAG) pipeline connects a model to your organization’s information, those dependencies become part of the service you operate. SUSE and CloudCasa by Catalogic are working together to protect that state in SUSE AI Factory.