PHP2Shell: CVE-2026-109618 and CVE-2026-109619. See how CrowdStrike Falcon helps you identify affected assets and container images, assess risk, and investigate potential exploitation. Watch the technical demo:

🚨 SlowMist TI Alert: CVE-2026-85706 🚨 🔴 A critical path traversal vulnerability in @gitlab CE/EE (CVSS 10.0) could allow unauthenticated attackers to read arbitrary files from affected GitLab servers via the Repository Commits API. 🛠️ GitLab has released security patches to address this vulnerability. ⚠️ Affected: affected from 18.7 before 19.1.8 affected from 19.2 before 19.2.6 affected from 19.3 before 19.3.2 🚨 Self-managed GitLab users should upgrade to 19.1.8, 19.2.6, or 19.3.2 immediately, and review logs and potentially exposed credentials after patching. 🔐 Stay alert and keep your infrastructure up to date. 🔗

2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)

Two days ago JFrog dropped CVE-2026-82329, a critical authentication bypass in Artifactory. It’s a CVSS 9.8, a disastrous vulnerability score. It’s like a 9.8 earthquake on the seismic scale. It affects default configs, requires no auth, no user interaction. It’s an RCE bomb because Artifactory hosts binaries, so you can basically poison everything, but an admin escalation can cause damage even beyond that. When the OpenAI / Hugging Face news came out of agents discovering zero-days, I was wondering if it was marketing-speak or reality, because I hadn’t seen a CVE filing. Now it’s here: https://www​.cve.org/CVERecord?id=CVE-2026-82329. I don’t see any official confirmation that it’s indeed the case, but one can speculate this is what the agents discovered and exploited. I’d previously written that it was obvious agents could help in finding serious vulnerabilities *alongside humans*, but exploiting them autonomously was a bridge not yet crossed. It seems like we’re now there. Our guidance for this new world: assume everything hackable will get hacked. And it will get hacked autonomously. You must also defend yourself autonomously, because your surface of attack is likely bigger and your code more vulnerable than you expect: https://vercel​.com/blog/everything-hackable-will-get-hacked

🚨 SlowMist TI Alert: Android’s November 2026 security bulletin is out 🚨 Among the critical flaws: CVE-2026-58868 (Critical) in the Framework component. 💥 It allows remote code execution with no user interaction and no extra privileges. 📱 Affects Android 14, 15, 16, 16-QPR2 and 17. 🔍 No confirmed in-the-wild exploitation so far. But if a bug like this ever gets exploited at scale, it would be a nuke for mobile. Android runs on roughly 7 out of every 10 smartphones worldwide. 🌍 🛡️ Patch levels: ✅ 2026-11-01+: includes CVE-2026-58868 and other Framework/System fixes ✅ 2026-11-05+: covers ALL fixes this month, incl. kernel, MediaTek & Qualcomm ⚙️ Check: Settings → About phone → Android version → Security patch level Please update ASAP ⬆️ 📄 Details:

Security note: United Stables does not use PHP. Regarding the PHP2Shell vulnerabilities (CVE-2026-109618/109619) disclosed this week: $U operates entirely through audited smart contracts on-chain, and our web infrastructure is not built on PHP. $U smart contracts, reserves, and minting/redemption remain completely safe.