CVEs that matter, exploitation status and patch guidance without the hype.
AWS has launched AWS Continuum for code vulnerabilities as a generally available service, automating the detection, validation, and remediation of exploitable code flaws while keeping human teams in control of deployment decisions.
Arista Networks has released fixes for a critical SQL injection flaw in VeloCloud Orchestrator On-Prem that allows authenticated attackers to escalate privileges and access internal functionality.
Two critical PHP vulnerabilities forced sites offline this week, but the real damage may come from disputes over how the patches were released and the strain on maintainers facing AI-accelerated exploit discovery.
Exploitation of two critical PHP vulnerabilities started four days ahead of the October 21 patch release, with attackers using anonymized infrastructure and multiple proof-of-concept variants.
Chrome's Enhanced Protection mode now leverages server-side Gemini analysis to identify scam patterns and intercept malicious clipboard commands, expanding coverage beyond traditional full-page warnings.
Four chained vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, are being actively exploited to steal admin credentials and execute code remotely. CISA has ordered federal agencies to patch by October 23.
Two severe vulnerabilities in PHP are actively being exploited to achieve remote code execution on affected servers, prompting emergency updates across major web platforms and content management systems worldwide.
The PHP development team has issued urgent security updates addressing two critical unauthenticated remote code execution vulnerabilities affecting all major PHP deployment configurations.
