CriticalBreach
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
The Hacker News·Source published ·1 min read
What happened?
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story.
Key details
- PHP Foundation released patches for two critical PHP code execution flaws.
- Google Brotli decoder library has severe unauthenticated remote code execution flaw.
- Plex Media Server vulnerabilities being chained into active exploits.
- Railway warns of targeted campaign aiming to steal AI provider API keys.
Affected
- Python packages certifi, pip, uv, sigstore, conda, and pixi.
- GitLab Community Edition and Enterprise Edition.
- Railway platform users with sensitive environment variables.
Fixes and mitigations
- PHP Foundation patches for CVE-2026-109618 and CVE-2026-109619.
- Restrict unprivileged user namespaces and enforce seccomp for KSMBD.
- Updated Python packages to remove emSign root CA certificate.
- GitLab patches for CVE-2026-110264.
- Railway urges users to revoke and reapply sensitive environment variables.
What to look for
- Millions of exploitation attempts detected for PHP flaws after disclosure.
- Unauthorized third-party AI agents detected in U.S. bank customer accounts.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.