NetArt Media iBoutique SQL Injection Vulnerability

CVE Research

Threats exploiting CISA KEV-listed CVEs: April to September 2026

CVE Research

PHP2Shell: Two Critical Core PHP Flaws Enable Unauthenticated RCE Across the Web

PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets unauthenticated attackers execute code or read server memory through two critical flaws in PHP’s core runtime, affecting nearly every version since PHP 5.4 and triggering active exploitation attempts within hours of patch release.

CVE Research

F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.