October 24, 2026
October 24, 2026 Hash 1e75904c076cd56ba20f963ece970aae5 2929e92b8808cc17d7f9c9b196fd9f925 387144a8d4c24010487fc5096220b295d URL 1http[:]//m[.]moriyura[.]com/ 2http[:]//keyvigilant[.]com[.]mx/ 3http[:]//acstrasbourg6[.]godaddysites[.]com/ IP 1103[.]195[.]236[.]196 241[.]242[.]115[.]84 3159[.]89[.]133[.]149...
October 23, 2026
October 23, 2026 Hash 1a6139cebe07bdecbd92d354cfda4c3ae 20bc60ac7134232df36643b45015e0386 31824009b1770e52283487350370cd90a URL 1https[:]//patratrimulia[.]com/ 2https[:]//lebang[.]si/ 3http[:]//nakedwolfe[.]us/ IP 1165[.]154[.]14[.]170 2220[.]118[.]173[.]234 3177[.]36[.]214[.]46...
Reproducing the PHP2Shell Vulnerability and Detection Using AhnLab EDR/XDR
On October 22, 2026, the PHP Security Team announced in an advisory that it would release security updates addressing the vulnerabilities CVE-2026-109618 and CVE-2026-109619. Although the causes of the two vulnerabilities differ, they are both remote code execution vulnerabilities that allow an unauthenticated threat actor to execute arbitrary code remotely.
Vercel Product Security Update Advisory (CVE-2026-96889)
A security update has been released to address a vulnerability in a Vercel product. The affected product is Next.Js, and the Affected Versions are those prior to 15.5.28 And prior to 16.4.1. The vulnerability that has been addressed is CVE-2026-96889, a use-after-free vulnerability (a vulnerability where memory that has already
F5 Product Security Update Advisory
F5 Security Update Advisory F5 has released security updates to address vulnerabilities in NGINX-related products. The affected products are NGINX Plus, NGINX Open Source, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF, F5 DoS for NGINX, NGINX App Protect DoS, NGINX Gateway Fabric, and NGINX Ingress Controller.
“Approximately 110,000 PHP Servers” in Korea: How Were They Counted?
After an article titled “Two Critical PHP Vulnerabilities Discovered… Urgent Updates Needed Due to Risk of Web Server Attacks” was posted on the AhnLab website yesterday (October 21), we received many inquiries asking for the basis of the figure “approximately 110,000 Korean PHP server IP addresses” cited in the article.
October 22, 2026
October 22, 2026 Hash 1f8664efcf4faf37304d1e0e739703005 2d10ae6b31014f501e69a55c87e74476d 323352a66e30c2822a601357f5397ab24 URL 1http[:]//monicamarinhopsi[.]com[.]br/ 2https[:]//monicamarinhopsi[.]com[.]br/ 3http[:]//silkrete[.]com/ IP 1103[.]189[.]208[.]13 2213[.]230[.]127[.]104 3103[.]84[.]236[.]242...
Analysis of the GitHub “php2shell” Repository: Public PoCs and Defense Tools That Spread Immediately After the Disclosure of the PHP Vulnerability
Overview Immediately after the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, a large number of repositories named “php2shell” were created in a short period of time on GitHub, a code repository platform. Of the top 100 repositories (excluding forks) found by searching for “php2shell,” 99 addressed
Adobe Product Security Update Advisory (CVE-2026-81983)
A security update addressing a vulnerability in Adobe products has been released. The affected products are Adobe Acrobat, Acrobat Reader, and Acrobat 2024. The identified vulnerability is CVE-2026-81983, an out-of-bounds write vulnerability (a vulnerability where data is written outside the memory bounds). The affected versions are as follows: Acrobat version
October 21, 2026
October 21, 2026 Hash 1136421130c29b7214d534e0e18ed1546 232e1812d96dc3042292c888dae87b54e 360d9fc8f0128b6ca543d7068d6fe5235 URL 1http[:]//login[.]policies[.]governmentlegal[.]org/ 2http[:]//senvd[.]com/ 3http[:]//mfasepm[.]weebly[.]com/ IP 143[.]153[.]14[.]44 2136[.]36[.]189[.]65 3170[.]106[.]64[.]165...
