Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial…
Excerpt from the primary source: Cisco Talos Intelligence
Who is affected
Enterprises · Security professionals
Affected technology: Cisco networking & security
What you should do · Review
Review whether your organization uses Cisco networking & security and assess exposure using the linked advisories.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Security research
Related
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
There are signs this may already be exploited, which usually shortens the time available to patch.
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134) is being actively exploited, CISA warns
CISA added CVE-2026-105134 (Ahsay AhsayCBS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s…
CISA lists this as exploited in the wild. Unpatched AhsayCBS and Cisco networking & security systems are exposed to active attacks now.
Treat this as an emergency.