|
By Pedro Umbelino
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) arrived with predictions of a Log4Shell-scale mass exploitation event. Panic was visible, many rushed to update or even disconnect systems from the Internet until a patch was applied. PHP runs a large share of the web and the vulnerable ranges were reported to cover every branch from 5.4 to 8.5, which are essentially the majority of versions we can see deployed in the internet installed base.
|
By Laura Puckett
AI is changing how attackers find and exploit weaknesses, and how security teams respond. As teams bring AI into more of their work, the data and context behind it becomes just as important as the model itself. Today, Bitsight is expanding how customers can use our industry-leading intelligence through three experiences: AI Mode, Bitsight MCP, and Bitsight Skills.
|
By João Cruz
The PHP security team has announced an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both bugs are described as remote code execution issues, meaning an attacker could get their own commands running on a vulnerable server. The route to disclosure was messy.
|
By Nethaniel Ribco
Public discussion of AI-enabled cybercrime tends to lean heavily on vendor marketing and speculation about future capabilities. We wanted to measure what criminal practitioners are actually discussing, what tools they prefer, and where their attention is shifting.
|
By Emma Stevens
When people discuss DragonForce, two distinct names usually come up: DragonForce Ransomware and DragonForce Malaysia. To set the record straight, the ransomware operation isn't necessarily the same entity as DragonForce Malaysia. DragonForce Malaysia operates as a politically driven hacktivist collective known for pro-Palestinian campaigns, defacing websites, launching DDoS attacks, and leaking data.
|
By Emma Stevens
In late July 2026, 36 municipal waste and water systems across Minnesota were targeted in a cyber attack. The attackers targeted Programmable Logic Controllers (PLCs) that were in control of pressure, pumps, and chemical dosing. When the news broke, it felt like it was everywhere. This was an attack on critical systems, systems that we require and use daily. But cyberattacks on U.S. critical infrastructure systems like water, hospitals, sewage, gas, and electricity aren’t new.
|
By Emma Stevens
Imagine waking up Monday morning to discover you’ve been breached. The attacker has stolen sensitive financial data, set up persistent access, and then greets you with a lovely ransom note at 8:00 a.m. demanding money in exchange for the encryption key. Immediately, you reach out to your security operations team, and they quickly begin assessing the damage and reviewing the breadcrumbs left behind.
|
By Naomi Yusupov
A vendor can pass every questionnaire you send it and still be the reason you end up in a breach report. That's the gap most third-party risk programs live in today. According to the 2026 Verizon Data Breach Investigations Report, 48% of breaches now involve a third party, up from 30% the year before and 15% the year before that. But most organizations still manage that risk with periodic assessments and separate threat feeds. Those methods can tell you whether a supplier passed a review last quarter.
|
By Emma Stevens
Citrix disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway that are already being exploited in the wild. CVE-2026-88771 allows unauthenticated attackers to run commands on an affected appliance, while CVE-2026-88772 can lead to remote code execution or denial of service when DTLS is turned on. Both received a CVSS v4.0 score of 9.5, and CISA added them to its Known Exploited Vulnerabilities catalog.
|
By Emma Stevens
It’s not a secret that phishing, stolen credentials, and human error remain some of the easiest ways for attackers to get into an environment. Identity has become one of the biggest attack surfaces for organizations today because sometimes, all an attacker needs to do is log in. That access can come from valid credentials, stolen sessions, exposed tokens, compromised service accounts, or abused application permissions.
|
By Bitsight
Could PHP2Shell pose a cybersecurity risk on the scale of Log4j? Newly disclosed critical PHP vulnerabilities are raising concerns about widespread exposure across enterprise environments and third-party supply chains. With millions of potentially affected systems and limited patching options for legacy PHP versions, security teams face a complex remediation challenge.
|
By Bitsight
As U.S. and EU regulators increase scrutiny of third-party cyber risk, organizations face growing pressure to demonstrate effective vendor oversight, continuous monitoring, and risk management. In this Bitsight webinar, Jake Olcott, VP of Government Affairs and former legal counsel to the House Homeland Security Committee and Senate Commerce Committee, explores the regulatory developments shaping third-party risk management (TPRM) heading into 2027.
|
By Bitsight
Could PHP2Shell become the next Log4j-scale cybersecurity threat? Newly disclosed critical PHP vulnerabilities are raising concerns about widespread exposure across enterprise environments and third-party supply chains. In this webinar, Bitsight cybersecurity experts examine the potential impact of PHP2Shell, share findings from Bitsight's latest exposure research, and explain how security teams can identify vulnerable assets, assess third-party risk, and prioritize remediation.
|
By Bitsight
How can security teams put agentic AI to work with trusted cyber risk intelligence? Discover how Bitsight MCP and Bitsight AI Mode help teams investigate cyber exposure, prioritize vulnerabilities, assess third-party risk, and automate security workflows. In this 45-minute webinar, Bitsight experts Christina Chehade and Tadd Hopkins demonstrate practical ways to bring AI into cybersecurity operations, from natural-language investigations to repeatable agentic workflows. You'll also get a 30/60/90-day roadmap for moving from initial exploration to scalable automation.
|
By Bitsight
Meet Bitsight AI Mode, a new way to investigate cyber risk, prioritize critical exposures, and accelerate security decisions using AI-powered intelligence and agentic workflows. Built directly into the Bitsight platform, AI Mode combines conversational AI with automated, multi-step analysis to help security and risk teams turn complex cyber risk data into actionable insights. With Bitsight AI Mode, you can.
|
By Bitsight
How much attention are you giving the doors outside your own network? Your security team may be watching a high-profile CVE closely. An attacker might be looking at a stolen session, a phishing kit, or a supplier with slower response times. Frontier AI gives them more ways to explore those routes. Bitsight’s Emma Stevens breaks down that decision in part two of our video series.
|
By Bitsight
Frontier AI can shrink weeks of vulnerability research into exploitation in hours. What does that mean for the flaws your team deprioritized years ago? Bitsight’s Emma Stevens, Senior Threat Intelligence Advisor, breaks it down in the first video of our new series.
|
By Bitsight
Cyberattacks take shape long before a breach through exposed systems, vulnerable software, stolen credentials, underground tools, and attacker experimentation. In this webinar, Emma Stevens, Threat Intelligence Researcher at Bitsight, and Qionglu Lei, Senior Product Marketing Manager at Bitsight, explore what Bitsight research reveals about AI-enabled attacker behavior and the changing cyber underground.
|
By Bitsight
When AI can map your attack surface faster than you can, the question shifts from "can we patch everything" to "what do we fix first." Here is how to make that call defensibly, across your own environment and your supply chain.
|
By BitSight
Cybersecurity ROI isn't about cost savings. It's about how your cybersecurity program helps you achieve your goals while managing risk to a level that your executive team is comfortable with. So if you shouldn't measure success in cost savings, how do you measure it? BitSight is providing five steps that help CISOs and executive teams evaluate their company's cybersecurity performance.
|
By BitSight
Are you overwhelmed by the intricacies of your attack surface? Concerned about the rising risk of vulnerabilities in your and your partners' digital ecosystems? New BitSight research finds that the average vulnerability remediation rate across organizations is about 5 percent per month, sparking concern that the status quo of exposure and vulnerability management is broken. Moreover, organizations face significant challenges in managing vulnerabilities in their extended, third-party ecosystem, and most security leaders do not have the tools to address these emerging threats.
|
By BitSight
Traditional vendor risk management programs are not effective at mitigating risk in ever-expanding third-party networks, and yet 69% of businesses still rely on manual processes. It's time to take your program to the next level. How can you centralize, automate, and streamline your process to manage hundreds of vendors as effectively as you manage ten? Scalable VRM continuously detects, monitors, and mitigates risk, going beyond due diligence and initial assessments to constantly reassess and proactively act on vendor risk.
|
By BitSight
Stop reacting to cyber risk as it comes. BitSight for Security Performance Management empowers security leaders to strengthen cyber resilience over time with objective, meaningful, and evidence-based metrics. Gain insights, drive decisions, and build confidence with our suite of advanced analytics.
- October 2026 (14)
- September 2026 (9)
- August 2026 (14)
- July 2026 (9)
- June 2026 (16)
- May 2026 (11)
- April 2026 (9)
- March 2026 (12)
- February 2026 (13)
- January 2026 (12)
- December 2025 (15)
- November 2025 (10)
- October 2025 (15)
- September 2025 (12)
- August 2025 (8)
- July 2025 (10)
- June 2025 (7)
- May 2025 (5)
- April 2025 (6)
- March 2025 (6)
- February 2025 (8)
- January 2025 (16)
- December 2024 (10)
- November 2024 (4)
- October 2024 (10)
- September 2024 (8)
- August 2024 (7)
- July 2024 (11)
- June 2024 (8)
- May 2024 (14)
- April 2024 (11)
- March 2024 (6)
- February 2024 (7)
- January 2024 (26)
- December 2023 (4)
- November 2023 (7)
- October 2023 (10)
- September 2023 (11)
- August 2023 (16)
- July 2023 (15)
- June 2023 (13)
- May 2023 (17)
- April 2023 (19)
- March 2023 (7)
- December 2022 (2)
- August 2022 (2)
- July 2022 (8)
Bitsight is a cyber risk management leader transforming how companies manage exposure, performance, and risk for themselves and their third parties. Global enterprises, governments, and organizations rely on Bitsight to prioritize their cybersecurity investments, build greater trust within their ecosystem, and reduce their chances of financial loss. When unrelenting market pressure pushes organizations to uncertainty and caution, they turn to Bitsight to confidently navigate cyber risk and grow with confidence.
Bitsight's universally recognized risk standard and market-leading data provides actionable insights into how companies set and manage to standards and report results to internal and external stakeholders. Built on over a decade of technological innovation, Bitsight's integrated solutions deliver value across enterprise security performance, digital supply chains, cyber insurance, and data analysis.
Bitsight is on a mission to free the global economy from the material impact of cyber incidents.