Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

reach security

Don't Let Configuration Drift Reopen PHP2Shell Attack Paths

Nov 11, 2026 By Garrett Hamilton In Reach Security
Key Takeaways: Configuration drift can reopen attack paths. Changes to firewall rules, inspection settings, or endpoint policies can expose vulnerable systems that were previously protected. ‍ Vulnerability exposure changes even when the CVE doesn't. Security teams need to reassess reachability and existing protections as configurations and exploit intelligence evolve. ‍ Reach connects configuration drift to vulnerability exposure.
Read Post
reach security

Disrupt PHP2Shell Post-Exploitation with CrowdStrike Controls

Nov 11, 2026 By Garrett Hamilton In Reach Security
Key Takeaways: Reachability determines exposure. Two servers with the same PHP2Shell vulnerability can face different levels of risk depending on accessible attack paths and existing protections. CrowdStrike can help disrupt post-exploitation activity. Falcon capabilities can detect or block malicious behaviors, including suspicious processes and command execution, even when a vulnerable service remains reachable. Effective protection depends on configuration.
Read Post
nucleus

How to Tell Whether Your CTEM Program Is Working

Nov 10, 2026 By Adam Dudley In Nucleus
A security team can run more scans, open more tickets, and close more findings without knowing whether the organization is becoming harder to attack. Those activities matter, but they do not answer the question that should guide your Continuous Threat Exposure Management (CTEM) program: Are we reducing the exposures that matter most to the business?
Read Post
reach security

PHP2Shell Reachability and How Cisco FTD Compensating Controls Can Mitigate Risk

Nov 10, 2026 By Garrett Hamilton In Reach Security
Key Takeaways: Reachability determines exposure. Systems with the same vulnerability can face different levels of risk depending on accessible attack paths and existing protections. Security configurations determine which protections apply. Firewall rules and inspection settings can leave vulnerable systems exposed even when exploit-blocking controls are available. Compensating controls can mitigate vulnerabilities.
Read Post
jfrog

Introducing JFrog Threat Hub: Turning Vulnerability Intelligence into Blast Radius Analysis

Nov 10, 2026 By Omer Buchnik In JFrog
A new supply chain attack hits the news. A CVE with a dramatic name starts trending. A malicious package turns up in npm, PyPI, and Hugging Face. Within minutes, your Slack channels fill up, your CISO wants an update, and someone asks the question every DevSecOps professional dreads.
Read Post
bluevoyant

After the PHP Patch: How BlueVoyant Detects Residual Supply Chain Exposure

Nov 10, 2026 By Matt Watson & Lorri Janssen-Anessi In BlueVoyant
It's been 20 days since the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and many organizations have already put an action plan in place to patch their own environments. Regulators are also demanding faster responses than ever: U.S. federal agencies had three days to apply fixes under CISA BOD 26-04, and frameworks like PCI DSS, DORA, and NIS2 all set firm expectations for timely remediation.
Read Post
Snyk

Say Yes To MCP, Safely A Guide For Governing AI Coding Agents With Evo ADS

Nov 9, 2026 By Daniel Berman In Snyk
When we announced that MCP Governance is generally available in Evo Agentic Development Security (ADS), the most common follow-up was practical: "Great. Where do I start on Monday?" It’s a fair question; across 10,000 developer environments, Snyk found 4,524 unique MCP servers in active use, and 1 in 12 developers with an MCP server installed had a confirmed high or critical finding.
Read Post
reach security

PHP2Shell: Understand Reachability and Identify Attack Paths You Can Close Before You Patch

Nov 8, 2026 By Garrett Hamilton In Reach Security
Two PHP servers can carry the same critical CVE and require different immediate work. In an illustrative pair, one accepts requests from an untrusted network through a rule with no effective intrusion prevention. The other is denied on the assessed path. The first needs an immediate mitigation decision. The second needs that restriction preserved while software remediation continues.
Read Post
astra

CVE-2026-123158 (*sshole)

Nov 7, 2026 By Ephrim Holyson In Astra
OpenSSH is the most widely used implementation of the SSH protocol for remote login. CVE-2026-123158, named *sshole, was published on November 5, 2026, with a CVSS v3.1 score of 8.1 (High). An unauthenticated attacker with network access to the SSH port can log in to an account that has no usable password by sending an overlong password. Access carries the permissions of that account.
Read Post

AI Helped Find Critical PHP Flaws: 4 Things to Do Today

Nov 6, 2026 By Netwrix In Netwrix
AI helped researchers find two critical PHP flaws, and one sat in the code for at least a decade. PHP runs roughly 70% of websites, and attackers were probing on the day the patches shipped, October 21. Dirk Schrader, VP of Security Research at Netwrix, lists four things to do today: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart the workers; on PHP 8.1 or older, where there’s no official release, use vendor extended support or take the server offline; check your logs and web roots from before the patch; and limit the account PHP runs under.
View Video
detectify

Critical vulnerability: OpenSSH authentication bypass on Alpine Linux (CVE-2026-123158)

Nov 5, 2026 By Detectify In Detectify
On November 5, 2026, Alpine Linux published a security advisory for an authentication bypass in its openssh-server package, nicknamed sshole by researcher Özgün Kültekin of Wakefield, who reported it. An attacker who can reach the SSH port can log in to accounts that have no password set, such as key-only users, without knowing any password. Every Alpine release from 3.16 through 3.24 and edge is affected. No CVE identifier has been assigned yet. Fixed packages are available.
Read Post
cultureai

Black October? What PHP2Shell Tells Us About the Future of Vulnerabilities

Nov 5, 2026 By Oliver Simonnet In CultureAI
October was a busy month for AI and security, with the story that got the most attention being PHP2Shell. On 20th October the PHP security team announced an out-of-cycle release for two critical remote code execution flaws in the PHP interpreter (CVE-2026-109618 and CVE-2026-109619), affecting every version of PHP, from 5.4 through 8.5.
Read Post
ionix

SSHhole (CVE-2026-123158) and how IONIX is helping you respond

Nov 5, 2026 By Tal Zamir In IONIX
CVE-2026-123158 is a password authentication bypass in sshd on Linux systems where sshd is linked against musl libc and runs without PAM. The CVE record rates it CVSS 3.1 8.1 (High); NVD analysis is pending. OpenSSH fixed it in Portable OpenSSH 10.6p2 on November 5, 2026. It was reported by Özgün Kültekin of Wakefield.
Read Post
manageengine

PHP2Shell mitigation: Applying the PHP workaround with Endpoint Central

Nov 4, 2026 By Manish from ManageEngine In ManageEngine
On October 21, 2026, PHP fixed two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. CISA added both to its Known Exploited Vulnerabilities catalog on October 26th. The real fix is upgrading PHP and restarting every worker process. But many Windows servers can’t do that yet: the vendor hasn’t certified the new version, the PHP branch is end-of-life, or nobody knows whether a PHP copy exists inside an old application.
Read Post
Snyk

Snyk Named a Leader in The Forrester Wave: Agentic Development Security Tools, Q4 2026

Nov 4, 2026 By Anthony Larkin In Snyk
We're proud to share that Snyk has been named a Leader in The Forrester Wave: Agentic Development Security Tools, Q4 2026. Snyk received the highest score in the Strategy category, along with the highest scores possible in these criteria.
Read Post
seemplicity

A Prioritized Backlog Is Still a Backlog

Nov 4, 2026 By Jessica Amado In Seemplicity
Vulnerability prioritization helps security teams identify what matters most, but it doesn’t actually resolve exposures. Even with better visibility, deduplication, and risk-based context, vulnerabilities remain unresolved until teams investigate, remediate, and verify the fixes. Real risk reduction isn’t about how efficiently you organize your backlog. It’s about how quickly you take action to shrink it.
Read Post
cloudflare

Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities

Nov 3, 2026 By CVE In Cloudflare
You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished.
Read Post

From Directive to Deadline: Operating BOD 26-04 in the Real World

Nov 3, 2026 By Nucleus Security In Nucleus
BOD 26-04 changes how federal agencies and FedRAMP providers handle vulnerabilities. It moves away from severity-based, 30-day patching and toward risk-based prioritization. In this webinar, Bob Costello (former CIO of CISA, strategic advisor to Nucleus Security, and Chief Digital and Information Officer at The Merlin Group) and Scott Kuffer (Co-founder and CPO at Nucleus Security) explain what the directive requires, why CISA built it on the SSVC decision-tree framework, and how to put it into practice.
View Video
astra

Vibe Coding Security Under Test: 100+ Vulnerabilities Across Four AI-Built Apps

Nov 2, 2026 By Ephrim Holyson In Astra
Vibe-coding platforms let you go from prompt to a deployed app in a single session, a pace that outpaces the review cycles most teams built for slower releases. With Lovable nearing 8 million users by late 2025, and Replit past 50 million by April 2026, we wanted to answer a sharper question than “is vibe coding safe?” Does the platform generating the code change the outcome, and does one security prompt give you the same security everywhere?
Read Post
nucleus

Known Exploited Means Your Mitigation Is Next

Nov 2, 2026 By Steve Carter In Nucleus
Last month, the FBI arrested a suspect in its ongoing response to an attack on its job portal, allegedly carried out by criminal hacker and extortion group ShinyHunters. The agency said a contractor failed to apply a security patch to a third-party platform involved in the breach of its job portal, while Reuters reported that the contractor worked for Accenture and that the platform was Oracle PeopleSoft. (Fair warning: The Reuters article is behind a paywall.)
Read Post
jfrog

Your Artifactory is fine. Your Linux kernel hosting it might not be.

Nov 2, 2026 By Barak Haryati In JFrog
Summary As we’ve written, AI is shrinking the time between “a fix is public” and “someone has a working exploit” to near-zero. JFrog products are not affected by Linux kernel CVE-2026-98432. Artifactory, Xray, and the rest of the JFrog Platform do not contain this flaw, as it lives in the Linux kernel itself.
Read Post
foresiet

CVE-2026-97229: Alpine Linux GitLab Security Incident

Nov 2, 2026 By Foresiet In Foresiet
A critical vulnerability in GitLab’s CI/CD processing became the focus of an attempted intrusion against Alpine Linux’s development infrastructure in October 2026. The incident prompted an extensive investigation, infrastructure rebuild and credential reset, despite the absence of confirmed remote code execution. What makes this case particularly important is not only the exploitation attempt itself, but a security issue discovered during remediation.
Read Post
coralogix

Threat Advisory - ClickHouse CVE-2026-116366: Unauthenticated Remote Code Execution

Nov 1, 2026 By Threat Detection & Response Team In Coralogix
On 30 October 2026, ClickHouse disclosed CVE-2026-116366, a critical vulnerability in ClickHouse Server (CVSS v4.0 9.5). Under certain conditions, an unauthenticated attacker with network access to the server can execute arbitrary code. Third-party vulnerability trackers classify it as an integer overflow (CWE-190); ClickHouse has not confirmed this.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.