Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ep. 91 - PHP2Shell: The PHP Flaws That Can Run a Stranger's Commands Before Your App Even Loads

Oct 28, 2026 By SafeBreach In SafeBreach
PHP2Shell is two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let a stranger run commands on your web server without logging in. On Apache mod_php, it can happen before your application code even loads. We unpack which PHP setups are exposed, why PHP says updating is the only safe fix, what to do about end-of-life PHP, and three questions every CISO should ask about a web-tier foothold. Update: on 26 Oct, researchers reported the first successful in-the-wild exploitation.
View Video
bdrsuite

BDRShield v9.5.0 Now Available: Multi-Tenant Management and Expanded Resumable Backups

Oct 28, 2026 By Praveen E In BDRSuite
BDRShield v9.5.0 is now available with enhanced multi-tenant management and expanded resumable backup support. The release gives administrators more control over tenant access and resources, while helping more interrupted backup...
Read Post
trilio

Active-Active Replication: When It's Worth the Complexity

Oct 28, 2026 By Vincent Button In Trilio
TL;DR: Active-active replication lets every node in a cluster accept writes and sync changes to its peers, which keeps writes available during regional outages but adds conflict resolution, replication lag, higher costs, and no protection against corruption or ransomware. It justifies that complexity mainly for five-nines, multi-region, or edge workloads, while read replicas, sharding, or active-passive setups suit most other needs.
Read Post
certkit

CA distrust wargame: moving every certificate in 10 minutes

Oct 28, 2026 By Todd H. Gardner In CertKit
Last week, dozens of schools found out their certificate authority was being distrusted and they needed to replace all of their certificates in a few days. We wanted to know how we’d handle it if our own CA went away, and how long it would take. So we tried it with one of our other products. It has 6 certificates from Let’s Encrypt, deploying to 18 targets across Windows IIS, Linux nginx, Elasticsearch, and a mail server. Then we wargamed it: “Let’s Encrypt is being distrusted.
Read Post
appknox

KnoxIQ: The AI Agent That Triages Mobile App Vulnerabilities

Oct 28, 2026 By Dhruv Pandya In Appknox
KnoxIQ is the agentic triage layer in Appknox. It takes the findings from your SAST and DAST scans, filters out the ones that aren't real and ranks the rest by how exploitable they are in your build. For each one, it shows you how to reproduce it and writes a fix for your app, including a prompt for Claude Code, Cursor, Github Copilot or any AI coding agent.
Read Post
CrowdStrike

CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies

Oct 28, 2026 By Counter Adversary Operations In CrowdStrike
Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, reflecting the value of legal entities to both eCrime and nation-state adversaries. Legal entities hold privileged communications, corporate transactions, intellectual property, government matters, and financial records that make them valuable targets for threat actors seeking financial gain or long-term strategic intelligence.
Read Post
CrowdStrike

When AI Guardrails Expose Vulnerabilities

Oct 28, 2026 By Jonathan Bar Or - D'Angelo Gonzalez In CrowdStrike
CrowdStrike researchers asked a frontier AI model to explain a function in a small C web server. While it had previously explained every other function in the codebase without hesitation, it refused to explain this one. The request was routine. We'd only asked what the code does; we hadn't asked about security, exploits, or vulnerabilities. But a single token in the code had changed: a max swapped for a min; a one-character logic inversion that creates an out-of-bounds write.
Read Post
salt security

An Alert Doesn't Stop an Attack: Introducing Autonomous Defense

Oct 28, 2026 By Aner Gelman In Salt Security
Security teams have never been better at finding problems. Discovery is broader, detection is sharper, and the volume of findings keeps climbing. But a finding is not a fix. When teams identify a risky AI agent, an exposed MCP server, or an active attack against an API, what happens next usually looks the same: someone triages it, someone opens a ticket, and someone on another team eventually makes the change. Until then, the risk stays exactly where it was.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.