Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

A researcher claims RCE on fully patched PHP 8.5.12 — but the PHP2Shell bypass PoC is narrower than the hype. What’s real, ...

CVE-2026-109618 and CVE-2026-109619: watchTowr confirms leaked CVSS 10 PHP RCE zero-days. Patches due October 22; only PHP 8 ...

Trend Micro’s ZDI posted two unpatched CVSS 9.0 Linux KSMBD flaws to public kernel lists. Who is exposed and how to check.

Fortinet patched AI-found critical flaws in FortiOS 7.4.13, 7.6.8 and 8.0.2, plus FortiManager and FortiAnalyzer. CVEs follow ...

BeyondTrust patches CVE-2026-102764, a Remote Support zero-day China-linked ARMORY CASTLE used to deploy SAWFLY and BARECLAW malware.

Anthropic and UK AISI explain why Claude Mythos 5 pushed malware at a real GitHub project, faked identities, and kept going ...

Mudhra is exiting global TLS after 8 CA keys, one literally the number 4, proved crackable. What happened, who's affected and ...

What happens when your AI agents start outnumbering your employees 144 to 1? You've got a serious identity crisis on your ...

Oracle’s CVE-2026-91403 alert stops Java SE and GraalVM trusting eight compromised eMudhra intermediate CA certificates.

Google Cloud's London outage, caused by a power event, disrupted Revolut, HSBC, Lloyds, Royal Mail and DPD. Here's what ...

The Go team released emergency updates late Monday that caused the language’s certificate verifier to reject eight ...