❌

Normal view

Received — 21 October 2026 ⏭

PHP warns it plans to release 2 emergency patches imminently

✇Ars Technica - All
By: Dan Goodin
21 October 2026 at 03:12

Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere.

PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

Waiting for PHP2Shell

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

Read full article

Comments

© Getty Images

PHP warns it plans to release 2 emergency patches imminently

✇Ars Technica - Technology
By: Dan Goodin
21 October 2026 at 03:12

Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere.

PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

Waiting for PHP2Shell

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

Read full article

Comments

© Getty Images

PSA: Patch your Plex media server before someone hacks it

✇Ars Technica - Technology
By: Dan Goodin
19 October 2026 at 20:39

Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said.

Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10. A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain "Plex2Shell."

Complex exploit chain

The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box and then using it to send the user’s traffic to a final destination.

Read full article

Comments

© Plex

Xbow spent $40K on AI and cracked Google Chrome wide open

✇Computerworld
16 October 2026 at 16:14

A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it.

Researchers at Xbow USA worked for six days on developing the exploit, which earned them a $250,000 bug bounty from Google, the first under the new 2026 rules.

They chose OpenAI’s GPT-5.6 Sol for the task to demonstrate what’s possible with a publicly available model rather than a specialist security implementation. They used it to search Chrome’s source code, test ideas, and build proofs of concept, while they set the strategy, chose where to look, and checked its work.

They successfully chained together a vulnerability to escape first from the sandbox containing the V8 JavaScript engine and then from Chrome’s operating-system process sandbox, launching a Windows app from within a malicious web page.

Xbow presented its findings to Google, which fixed the flaws. The researchers set out all the details as to how the exploit was developed in a blog.

Bank of America spent millions on anti-money-laundering tech, but not enough to avoid a $1.2B fine

✇InfoWorld
16 October 2026 at 14:02

Bank of America has had to spend big on IT in response to an AI security audit and findings that its anti-money-laundering (AML) controls were lacking.

The bank was fined a whopping $1.2 billion for money laundering offences this week, after banking authorities identified a lax attitude to compliance.

“We understand the seriousness of compliance, and we are responsible for getting it right,” Bank of America CEO Brian Moynihan said on a conference call to discuss the company’s third-quarter financial results. “We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime,” he said, adding that “a couple hundred million” of that spending in the third quarter was on “remediation for the AML”.

The IT team had to spend a similar amount on fixing software vulnerabilities in its systems, a task that also required it to hire 1,000 consultants, Moynihan said.

The bank’s security vulnerabilities were revealed after the company received an early release of Claude Mythos Preview. In a report to the US House of Representatives Financial Services Committee, Anthropic said that Claude Mythos Preview “has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.”

This article first appeared on CSO.

Fridge hack costing millions and sparking fires stemmed from poor security

✇Ars Technica - Technology
By: Dan Goodin
14 October 2026 at 22:35

Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybersecurity would have prevented it.

French authorities say the systems, made up of entire fleets of refrigerators and freezers throughout a store, were hacked. More specifically, Internet-connected controllers that allow technicians to remotely administer the store-wide systems were compromised. The unknown attackers responsible then activated defrosters long enough for the fridges to reach temperatures as high as 50° Celsius (122° Fahrenheit). By the time the mass compromise was discovered, food was spoiled, and in some cases their electrical systems caught fire.

The hacks that didn't have to happen

Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident—sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US—contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators. Until recently, Danfoss controllers, for instance, used a credential that changes each day. The password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn’t received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores.

Read full article

Comments

© Getty Images

Attackers have been exploiting critical Zimbra flaw to steal emails

✇Ars Technica - Technology
By: Dan Goodin
30 September 2026 at 21:44

Hackers have been exploiting a critical vulnerability in the Zimbra Collaboration Suite in an attempt to obtain email backups and authentication credentials of vulnerable organzations, Microsoft has warned.

The vulnerability, tracked as CVE-2026-73570, lets attackers remotely issue operating system commands without authentication. Zimbra maintainer Synacor issued a patch on July 20, but didn’t disclose the vulnerability for more than three weeks after that. The security-focused Shadowserver Foundation said last week that its scans found that 274 separate instances of the Zimbra Collaboration Suite had been compromised. The number of servers running the software has fluctuated from 19,000 in the week following the patch to about 12,000 in the weeks following that. Currently, Shadowserver is tracking about 10,000 instances.

Look, ma, no authorization

From July 28 to August 7, Microsoft said Wednesday, the company detected two distinct scanning tools probing the Internet for vulnerable endpoints. The attackers first validated their exploit worked by sending HTTP, requests and DNS, ICMP, and out-of-band identity checks to domains hosted on public services. The probes allowed the attackers to confirm the exploit successfully executed commands on vulnerable servers without actually compromising them. Eventually, the attackers began using their command injection capability to install malicious payloads. Microsoft wrote:

Read full article

Comments

© Getty Images

❌