Breach Watch
Written for risk decisions, not headlines.
Breach, ransomware, vulnerability, advisory and threat intelligence, classified by LiveThreat and analysed in an ADTP brief for every item.
Showing 20 of 4,304
BREACH WATCH BRIEF
Critical Remote Code Execution Vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) Discovered in PHP 8.2–8.5
The PHP development team disclosed two critical RCE vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) affecting versions 8.2 through 8.5, each scoring 9.2 CVSS. Unpatched installations could be compromised remotely, underscoring the need for robust vulnerability‑management and continuous control‑assurance practices.
BREACH WATCH BRIEF
Zero‑Day Remote Code Execution Vulnerability in PHP (PHP2Shell) Exploited Prior to Public Disclosure
A critical remote‑code‑execution flaw in PHP (PHP2Shell) was weaponized four days before public disclosure, exposing web‑servers to command execution. The episode underscores the need for continuous patch‑management and audit‑ready evidence of control assurance.
BREACH WATCH BRIEF
Critical OS Command Injection in Collabora Online Built‑in CODE Server (CVE‑2026‑110447) Enables Unauthenticated Code Execution
CISA added CVE‑2026‑110447, a critical OS command‑injection flaw in Collabora Online Built‑in CODE Server, to its KEV catalog after observing unauthenticated exploitation in the wild. The vulnerability highlights the importance of robust vulnerability‑management controls and audit‑ready evidence for compliance frameworks.
BREACH WATCH BRIEF
Critical RCE‑Capable Brotli Decoder Flaw (CVE‑2026‑111497) Impacts Node.js, Python, Bun, and Envoy
A memory‑corruption vulnerability in Google’s Brotli decoder (CVE‑2026‑111497) allows crafted compressed data to trigger remote code execution in runtimes such as Node.js, Bun, Python Brotli packages, and Envoy proxies. The flaw underscores the need for robust vulnerability‑management controls and continuous evidence of patch compliance for audit readiness.
BREACH WATCH BRIEF
Critical SQL Injection in Arista VeloCloud Orchestrator (CVE‑2026‑114625) Enables Privilege Escalation
A CVSS 9.4 SQL‑injection flaw in Arista VeloCloud Orchestrator lets any authenticated user gain operator privileges and impersonate a super‑user. The issue highlights a privileged‑access control gap that must be addressed to maintain audit‑ready evidence and continuous monitoring.
BREACH WATCH BRIEF
CISA Flags Critical Actively Exploited Flaws in Collabora Online CODE Server and Arista VeloCloud Orchestrator (CVE‑2026‑110447)
CISA placed two critical‑severity CVEs affecting Collabora Online’s CODE Server and Arista VeloCloud Orchestrator on its Known Exploited Vulnerabilities list, citing active exploitation. Enterprises must verify patch status and strengthen third‑party risk monitoring to maintain audit‑ready control assurance.
BREACH WATCH BRIEF
Critical CA Key‑Generation Flaw (CVE‑2026‑111943 & CVE‑2026‑111944) Undermines Trust in eMudhra Intermediate Certificates
A flaw in eMudhra’s key‑generation ceremony produced eight intermediate CA certificates with near‑zero entropy, enabling attackers to forge TLS or code‑signing certificates. The incident stresses the importance of continuous PKI oversight and control‑mapping evidence for audit readiness.
BREACH WATCH BRIEF
Abandoned Popcorn Time App’s Unencrypted Updater Exposes Millions to Remote Code Execution (CVE‑2026‑30612)
A vulnerable updater in the abandoned Time4Popcorn client (CVE‑2026‑30612) allowed attackers to execute code as SYSTEM/root on millions of Windows and macOS devices. The flaw underscores the need for signed, TLS‑protected update pipelines to meet audit‑ready control assurance.
BREACH WATCH BRIEF
Code Execution Vulnerability in PHP (CVE‑2026‑115560) Affects Session Upload Progress
PHP disclosed CVE‑2026‑115560, a code‑execution flaw that can be triggered by a rare runtime change of the session serialization handler while session upload progress is enabled. The issue underscores the importance of strict configuration controls and audit‑ready evidence for compliance.
BREACH WATCH BRIEF
Critical PHP2Shell Vulnerabilities (CVE‑2026‑109618/109619) Prompt Urgent Patch Deployment Across Millions of Web Servers
Two critical PHP code‑execution flaws (CVE‑2026‑109618, CVE‑2026‑109619) have publicly available PoCs and early exploit attempts. While patches are released, only ~20 % of exposed hosts are patched, highlighting a widespread remediation gap that impacts audit readiness for vulnerability‑management controls.
BREACH WATCH BRIEF
Ruby Patches Three Regex Engine Bugs That Enabled Four Critical RCE Flaws in GitLab
Ruby released patched versions of its Onigmo regex engine, closing three bugs that had been exploited to create four critical remote‑code‑execution vulnerabilities in GitLab. The fix highlights the need for continuous vulnerability management and auditable evidence of remediation.
BREACH WATCH BRIEF
New Unpatched PHP RCE (CVE‑2026‑115560) Exploits Rare Config Combination; Mitigation Recommended
PHP disclosed CVE‑2026‑115560, a remote‑code‑execution flaw that requires a specific runtime configuration change. The team advises disabling session upload progress as a temporary mitigation. This highlights the need for continuous configuration monitoring and control‑mapping evidence for audit readiness.
BREACH WATCH BRIEF
Critical PHP RCE Flaws (CVE‑2026‑109618/109619) Threaten 70% of Websites – Patch Now
Two critical PHP vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) enable unauthenticated remote‑code execution across 70 % of web sites. Prompt patching is essential, and the incident highlights the need for a documented, continuously‑monitored patch‑management control to satisfy audit requirements.
BREACH WATCH BRIEF
Node.js Brotli Decoder Remote Code Execution (CVE‑2026‑111497) – Critical Runtime Flaw
Node.js released patches for ten vulnerabilities, the most severe being CVE‑2026‑111497, an out‑of‑bounds write in the Brotli decoder that enables remote code execution. The flaw lives in the runtime itself, so traditional dependency checks miss it, forcing enterprises to inventory and patch runtimes to maintain audit‑ready control assurance.
BREACH WATCH BRIEF
HPE Patches Eight Critical ArubaOS RCE and Authentication‑Bypass Flaws (CVE‑2026‑79844‑79851)
HPE released updates that fix 72 ArubaOS vulnerabilities, including eight critical remote‑code‑execution and authentication‑bypass bugs. The fixes illustrate why continuous vulnerability‑management evidence is essential for audit readiness.
BREACH WATCH BRIEF
426 Mobile Apps Exposed to PHP2Shell Backend Vulnerability
Researchers found 426 Android and iOS apps connecting to servers running vulnerable PHP versions (PHP2Shell). The flaw could let attackers execute code on those backends, putting app data at risk and highlighting the need for continuous third‑party risk monitoring.
BREACH WATCH BRIEF
OS Command Injection in Collabora Online (CVE‑2026‑110447) Added to CISA KEV Catalog
CISA has listed CVE‑2026‑110447, a command‑injection flaw in Collabora Online’s CODE Server, in its Known Exploited Vulnerabilities catalog. The vulnerability grants attackers total control of the host, prompting federal agencies to prioritize rapid remediation and urging all organizations to adopt risk‑based patching. This underscores the importance of robust vulnerability‑management controls for audit readiness.
BREACH WATCH BRIEF
Unpatched Remote Code Execution (CVE‑2026‑115560) in PHP Threatens Web Servers After Emergency PHP2Shell Fixes
PHP disclosed CVE‑2026‑115560, a high‑severity remote‑code‑execution flaw that affects web apps using a rarely‑enabled configuration. The vulnerability highlights the need for continuous configuration control and audit‑ready evidence for compliance.
BREACH WATCH BRIEF
eMudhra CA Issues TLS Certificates with 3‑8‑Bit Private Keys, Undermining Encryption Guarantees
eMudhra Limited issued eight TLS certificates whose private keys contained only 3‑8 bits of entropy, far below industry standards. This weakens TLS encryption for any service using those certificates and highlights the need for robust cryptographic‑key‑management controls in audit‑ready programs.
BREACH WATCH BRIEF
Critical PHP Engine RCE (CVE‑2026‑109618 / CVE‑2026‑109619) Triggers Millions of Exploit Attempts
Two remote‑code‑execution flaws in the core PHP engine (CVE‑2026‑109618, CVE‑2026‑109619) have been patched, but attackers launched millions of attempts within hours of disclosure. The story underscores the need for rapid patch deployment, continuous asset monitoring, and audit‑ready evidence of remediation.
Breach Watch intelligence is provided by LiveThreat, a product of a founding sponsor of the association. Every ADTP brief carries LiveThreat's analysis and links the original source.
Practitioner briefings
Written by the association: what the week's intelligence means for the controls you run.
Reading a vendor's breach notice for what it does not say
A practitioner checklist for turning a supplier notification into an evidence request and a monitoring change.
Where AI inventory efforts stall, and the control that unblocks them
Findings from practitioner roundtables on AI governance programs in their first year.
Evidence reuse across customer diligence and audit
How practitioners are organizing one evidence base to serve buyers and auditors at the same time.
Global Privacy Control signals and state opt-out obligations
What a site must do when it sees a GPC signal, and how to evidence it.
Get the digest
No membership required. Confirm by email; unsubscribe in one click.