Gorąca prośba. Jeśli używacie informacji które tu podajemy to warto jest linkowac lub podawać źródło ;)

🚨 Two Critical Vulnerabilities in PHP The PHP Security Team has announced an emergency security release addressing two critical vulnerabilities, reportedly identified as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and, according to preliminary security research, may allow unauthenticated Remote Code Execution (RCE). Key findings: • Affected product: PHP • Severity: Critical (CVSS 9.2) • Potential impact: Remote Code Execution (RCE) • Patch release: October 21, 2026, at 14:00 UTC • Affected versions: Not yet officially disclosed • Active exploitation: No confirmed cases reported Although active exploitation has not been confirmed, the potential impact and widespread use of PHP across internet-facing applications make these vulnerabilities a significant security concern. Organizations should identify exposed PHP environments, prepare for immediate patch deployment, and increase monitoring for suspicious activity. The disclosure of technical details may accelerate exploit development, potentially reducing the time available for remediation. Read our latest CTI Note for further technical analysis, threat assessment, and recommended mitigation measures: #RSCTINote

A vending machine. You drop in a few dollars, out comes a crime. A DDoS attack from 5 dollars an hour. A ready made infostealer on subscription. Someone's online banking login. A money mule for laundering, 30% commission. This is not theory. This is a price list. Crime has become a service. Packaged, priced and delivered like any other product. The whole market runs like a factory: someone builds the tools, someone sells them, someone handles the customer. At @RIFFSEC we took that factory apart. What sits on the shelves, what it costs and why it keeps running. Crime as a Service. October 2026. #CrimeAsAService #ThreatIntelligence