This is not another 10k layoffs at Amazon which is like not even 3% of its employee

This is not 5% of Netflix

This is 25% of all employees at Microsoft. Absolute bombshell.

A cyberattack forced the University of New Mexico Health System to divert ambulances and cancel clinic appointments Monday, interrupting care at the state’s only Level I trauma center.

There is an important development in the PHP2Shell story we've been discussing.

Until recently, researchers had observed scanning and exploitation attempts, but convincing evidence of successful attacks was limited. That changed today.

Security researcher Adel Karimi reported evidence from honeypots showing successful exploitation against an Apache installation running PHP 8.4.26.

The evidence included memory disclosure followed by remote command execution.

Security researcher Marcus Hutchins independently reviewed the findings and described them as particularly convincing evidence of real-world exploitation.

The affected vulnerabilities are:

CVE-2026-109618 and CVE-2026-109619.

These are the same vulnerabilities addressed by the October 21 PHP security updates.

This is more significant than Google's earlier reminder to restart services after patching.

Researchers now have evidence that attackers can successfully execute commands against vulnerable PHP installations.

For administrators operating web applications or onion services using PHP, that raises the urgency of patching and checking for compromise.

The finding confirms successful exploitation against a honeypot. It does not establish how many production servers have been compromised.

Recommended action: Install the appropriate patched PHP release, ensure the patched runtime is actually running, and review suspicious requests and server activity.

Update the existing PHP2Shell announcement to distinguish confirmed successful exploitation from the earlier unsuccessful attempts.

Someone puts 2 million threats blocked this month on a dashboard and management thinks security is doing amazing. Half of that could be random scanners and bot traffic hitting the firewall

Same thing with vulnerability tickets. Closing 500 tickets looks great on paper. Meanwhile the same critical systems have exceptions that keep getting renewed and nobody wants to touch them.

You can have an entire dashboard full of green KPIs while the same security problems sit there for months

At some point you're just measuring how busy the security team is

dismal…

I Found a vulnerability on an SBI subdomain today , here's what could've gone wrong:

Discovered Oracle Discoverer 12.1.12 - an end of life reporting tool - publicly exposed on SBI's data warehouse infrastructure. No authentication. Anyone could access it

Oracle Discoverer connects directly to databases . On a bank's data warehouse this means potential unauthenticated access to - customer acc data , transaction records , internal financial reporting structure

CVE-2014-0398 documents exactly this exploit for this version. The url was publicly indexable one google search away

I reported it to cert-in although they replied after 21 hrs

Ref : CERTin-8144326

Fortinet announced the FortiGuard Inline AI Security Service for FortiGate customers. The company says it inspects prompts, model responses, MCP tool calls and agent actions, and can block or redact sensitive data. Its FortiAIGate product page says the gateway can also set model permissions, budgets and rate limits.

There are two deployment paths. The new service is cloud-delivered through existing FortiGate infrastructure, while FortiAIGate can be self-hosted on Kubernetes with NVIDIA GPUs for teams that need more control over where prompts, data and logs are processed.

This is a concrete control point for AI traffic, but the launch material is still vendor evidence. It does not include an independent benchmark or customer performance result, so latency and operational cost are still open questions.

Sources:

Fortinet announcement: https://investor.fortinet.com/news-releases/news-release-details/fortinet-expands-ai-security-fortiguard-inline-ai-security

FortiAIGate product page: https://www.fortinet.com/products/fortiaigate

There are a couple career advice type videos posted by CISA this past week.
https://youtu.be/TwKmY8wu7cQ?si=cNEu1xWLAmd-oR3N

Has anybody used a reliable API Discovery tool ? I am searching for one with minimum agent dependency. Also could it detect shadow APIs which are available in programs which are never called ? (No access to source)

Our Threat Research Unit published a breakdown of “The Gentlemen” - a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, reportedly after affiliates split off from established groups like LockBit and Qilin. A few things that stood out from the research:

• They’re offering affiliates up to 90% of ransom revenue - aggressive even by RaaS standards
• Claimed 800+ victims across the US and Europe, making them one of the top RaaS groups this year
• Cross-platform ransomware variants targeting Windows, Linux, NAS, and BSD
• Active use of EDR-killing tooling - one recent incident involved a custom dropper abusing vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers (BYOVD)
• A breach of the group’s own infrastructure gave researchers rare visibility into their affiliate network, tooling, and ties to the broader ransomware ecosystem

Full technical writeup linked below for anyone who wants to dig into the IOCs and affiliate details.
https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/

Hey everyone,
I have an AAS in Cybersecurity and Assurance and I’m currently pursuing my bachelor’s in Cybersecurity and Intelligence Management.
Honestly, I’m still unsure what career path I want to take after graduation. Sometimes I even think about switching to cloud engineering because of the better salary potential and career opportunities.
I’ve been struggling to land an internship despite having an associate degree and a good academic record, so I’m thinking about getting a certification to improve my chances before graduating.
I’m stuck between Security+ and CySA+. Security+ seems like the safer option since it’s broader and I haven’t decided on a career path yet. But CySA+ is more advanced, and I feel like it might make more sense since I already have a cybersecurity degree.
Which one would you recommend in my situation? Would CySA+ help me stand out more, or is Security+ still the better choice?
Any advice would be appreciated!

Just passed my security+ exam, what is the next thing to do to try and get into a SOC role?

I was planning on doing HackTheBox SAL 1 course but just wanted a second opinion on whether that’s the best next step.

Also for context, I have 9 months experience working in IT support and 2 years working as a 1st line NOC engineer.

I found a heap buffer overflow in the Brotli glue code in EDK2 (BrotliDecompress.c). It has been there since 2017 and it’s still unfixed at HEAD.

Some background. CVE-2021-28211 was a heap overflow in EDK2’s LZMA decompressor. GetInfo took a UINT64 decoded size and truncated it to UINT32 with no check, so the decoder could write past the buffer that had been allocated. The fix added a MAX_UINT32 check and bounded the output.

The Brotli decompressor was added earlier with the same structure, and it never got the same fix. BrotliDecompressInternal writes into the destination buffer with no limit. It just runs until the stream ends, whatever size the buffer is. If you control the firmware image, you declare a small output size (or use the UINT64 to UINT32 truncation), the DXE core allocates that much, and the decompressor writes past it. That’s a heap overflow in DXE, before Secure Boot.

I have an ASAN-confirmed PoC. I also built an end-to-end demo that corrupts adjacent pool objects in a controlled way: it hijacks function pointers and overwrites the Secure Boot flag with bytes I choose.

The catch is that I couldn’t find anyone using it. I scanned 200 shipping firmware images from LVFS and searched public GitHub repos, and found zero platforms that use Brotli GUIDed sections. The code is in the tree but looks unused in practice. That’s one scan of 200 images, so it doesn’t rule out private platforms. I still think it should be fixed, because anyone who adopts Brotli later would inherit the bug.

Write-up, PoC, demo and the LVFS scan: https://github.com/lukr54/edk2-security

EDK2 issue: tianocore/edk2#13391

Google cloud updated its PHP2Shell security advisory on October 23 with additional guidance from Mandiant Consulting.

CVE-2026-109618 and CVE-2026-109619

Both are critical remote-code-execution vulnerabilities affecting PHP.

The updated guidance emphasizes that installing patched packages does not necessarily mean the running web application is protected.

Older PHP processes may remain active in memory until the relevant web-serving services are restarted.

Researchers also recommend preserving volatile forensic evidence before restarting servers suspected of compromise.

Google additionally announced new detection capabilities for identifying potentially vulnerable systems and suspicious activity.

Why onion-service administrators should care

An onion service running PHP can remain vulnerable even when Tor successfully hides its hosting infrastructure.

Administrators should verify that the web server actually uses a patched PHP runtime.

For supported upstream branches, the initial fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Distribution-specific security backports may use different version numbers.

Review logs dating back to October 17, when Amazon Threat Intelligence observed early exploitation attempts.

Confirmed exploitation attempts do not automatically establish successful server compromise.

Recommended action: Patch, restart the appropriate services, verify the running version, and investigate suspicious activity. Preserve evidence first if compromise is suspected.