Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

Last updated: October 22, 2026. This story is still developing, and we'll update this post as new details are confirmed. Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are putting a large share of the web at risk. The vulnerabilities, collectively named PHP2Shell, both carry a CVSS score of 9.2, and both allow remote code execution (RCE). Security teams should treat these vulnerabilities urgently and respond accordingly.

On Oct. 21, 2026, PHP fixed a vulnerability named php2shell by Calif. Pre-auth RCE under default configurations, confirmed on common CMS, webmail, e-commerce, file sharing, and database administration applications. A PHP server also stores and uses credentials, so this is a secret theft vector.

Railway's security incident may have exposed decrypted customer environment variables. Pull and scan yours with GitGuardian to know what to rotate first.

LevelBlue’s free Zero Trust Readiness Review helps organizations uncover security gaps and get more value from their existing investments. One of the first questions I ask security leaders is simple: Do you know whether all your security tools work together? The answer is rarely a straightforward yes. Most organizations have built their security environments over many years.

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, allow attackers to execute code on vulnerable web servers without authentication. PHP released fixes on October 21, 2026, including versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. But patching your servers is only part of the response. Organizations must also understand what their websites delivered to customers during the exposure window, including scripts served by third-party vendors whose infrastructure may have been vulnerable.

A valid digital signature is a green light for Windows, browsers, and “Microsoft SmartScreen” protection: this file comes from the publisher mentioned in the digital signature, and it has not changed since it was built. By signing code, you are trusting to ensure that the code is safe for your machine. Digging up the asset is not just their public.cer file, which is everywhere in a certificate store; it is the key that is vital for the creation of the signature.

Keeper Security, the leading zero-trust and zero-knowledge identity security platform, today announces Phishing Protection, a new feature in the Keeper Browser Extension that warns users before they enter credentials on fraudulent login pages. Built on a zero-knowledge local AI engine, the feature detects look-alike domains, spoofed websites and brand impersonation directly in the browser, helping users avoid handing over credentials to a cybercriminal.

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to by researchers as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical Severity) and can allow an unauthenticated attacker to execute code with the privileges of the affected PHP worker process.

Two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an unauthenticated attacker run commands on servers that use an affected PHP build to handle web requests. PHP released fixes on October 21, 2026, a day after details leaked online. Public proof-of-concept code followed within hours, and exploitation attempts were seen as early as October 17. AppTrana customers have been protected against PHP2Shell.

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code. Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.