PHP vulnerabi2026-10-22 02:20:10Critical PHP flaws trigger emergency website shutdowns as patch race beginsTwo critical PHP vulnerabilities with CVSS v4 scores of 9.2 have pushed governments, hosting operators, and security teams into emergency mode, with some public-facing websites temporarily taken offline before patches were broadly applied. The bugs allow unauthenticated remote code execution on affected servers, meaning attackers may be able to run malicious code without logging in, steal data, alter web pages, or fully take over a server. PHP has released fixes for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while also confirming that PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed are affected, with Apache mod_php carrying particularly high risk. The issue matters to crypto users even if blockchains themselves are untouched. A compromised server can serve a malicious front end that looks normal but tricks users into connecting wallets or approving token transfers. Cloudflare said it had already seen early attack activity before the official patch release and pushed emergency firewall rules to customers, though it described those protections as temporary. For site operators, the message from the PHP Foundation and core developers is blunt: patch or upgrade immediately. For users, the practical risk is not a PHP update on their own devices, but whether the websites they trust have secured their servers in time.520
PHP2026-10-21 15:35:16Two Critical PHP Flaws Trigger Global Website Shutdowns as Patch Race BeginsTwo critical vulnerabilities in PHP, the server-side language used by roughly 70% of websites with a known backend language according to W3Techs, set off a global scramble on Oct. 21, 2026. The bugs, both rated 9.2 under CVSSv4, allow unauthenticated remote code execution, meaning attackers can run commands on affected servers without logging in. The PHP Foundation warned users a day earlier and then released fixes ahead of schedule in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, urging immediate updates. The response was unusually severe. Finland began taking public services offline, the Dutch cybersecurity agency pulled down its own site, and France temporarily shut prefecture websites while waiting for patches. Cloudflare CTO Dane Knecht said the company was already seeing early attacks before the patch shipped and rolled out emergency WAF rules to all customers, while stressing those protections were only temporary. The report also pushes back on several viral claims. It says the affected range likely starts at PHP 5.4 rather than 2004-era releases, notes that Node.js was unrelated despite social media confusion, and highlights the scale of exposure: Mallory counted about 884,000 internet-facing hosts running PHP 8.1 or older on Oct. 20. Security firms warned mass exploitation could begin within minutes of the patch release.630
Meta2026-09-22 03:33:29Meta’s Muse hit by local zero-day flaw that can reroute agent voice requestsMeta’s personal AI agent Muse has been found vulnerable to a local zero-day on Mac just two weeks after launch, according to the source report. Security researcher Patrick Wardle said an attacker only needs to run code under the current user account to change a hidden Muse setting and redirect voice requests to a server they control. The code does not require extra macOS permissions. Once that setting is changed, the attacker could intercept what a user says to Muse, inject malicious instructions, and potentially obtain Muse authentication data. Because Muse can access system resources such as files and the camera, a malicious local program may be able to act through whatever permissions the user has already granted to Muse. The issue is not described as a remote Mac compromise. An attacker must first get code running on the target machine. The report also noted that Meta had highlighted Muse’s security architecture at launch, including Muse Secure VM and a separate Sentinel Agent, but the first disclosed zero-day stems from a hidden setting in the Mac client that an ordinary local process can modify.770
Google2026-09-05 16:42:18Google patches exploited Chrome zero-day CVE-2026-85046 and urges users to updateGoogle has released a fix for CVE-2026-85046, a high-severity Chrome zero-day that was being exploited in real-world attacks at the time the patch shipped. The flaw affects Chrome’s V8 JavaScript and WebAssembly engine and is described as a type confusion issue that can be triggered through crafted HTML or JavaScript content. According to Google’s security notice, the bug could lead to incorrect handling of memory object types, giving attackers arbitrary read and write capabilities and allowing attacker-controlled code to run inside the browser sandbox. The patch was included in the Stable Channel update released on Sept. 3. Version numbers are Chrome 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, with rollout continuing over the coming days to weeks. The bug was reported by researcher Salvatore Gulizia on Aug. 4 and earned a $1,000 bounty. On Sept. 4, the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog and directed Federal Civilian Executive Branch agencies to patch by Sept. 18.810
Google Chrome2026-09-05 15:06:57Google Patches Chrome Zero-Day Exploited in Wild; Browser Wallet Security Under SpotlightGoogle has fixed a high-severity Chrome vulnerability (CVE-2026-85046) that was actively exploited in the wild, affecting the V8 engine. The patch is included in Chrome 152.7977.82/83 and will be rolled out in the coming days. The bug was reported by researcher Salvatore Gulizia on August 4, who received a $1,000 bounty. The update includes 12 security fixes, 9 of which are high-severity. Google has not linked the exploit to crypto thefts, but browser wallets and exchange accounts have been targeted previously.1500
Google2026-09-05 15:03:26Google Patches High-Severity Chrome Flaw Already Exploited in the WildGoogle has released a fix for CVE-2026-85046, a high-severity Chrome vulnerability that the company said was already being exploited in the wild before the patch landed. The flaw affects V8, the engine Chrome uses to run JavaScript and WebAssembly, but Google has not identified the attackers, named any victims, or explained what the exploit is capable of doing. The patch is included in Chrome 152.0.7977.82 and 152.0.7977.83 for Windows and Mac, and in version 152.0.7977.82 for Linux, with rollout scheduled over the coming days and weeks. Google also said it is temporarily withholding some details while users and affected third-party projects install updates. Security researcher Salvatore Gulizia, known as Serotav, reported the bug on Aug. 4 and received a $1,000 reward. While Google has not linked this issue to attacks on crypto users, recent cases have shown that browser wallets, exchange accounts, and wallet-related extensions remain active targets for theft and credential harvesting.830
Litecoin2026-07-23 16:20:16Litecoin MWEB Zero-Day Triggered 13-Block Reorg After Invalid Transactions Passed Old NodesLitecoin said a zero-day flaw in MWEB let outdated mining nodes accept malformed transactions, creating a temporary validation split. The network later carried out a 13-block reorganization and deployed a patch.920
Cosmos2026-07-23 02:10:14Cosmos Researcher Discloses High-Severity CometBFT Zero-Day Affecting Over $8BResearcher Doyeon Park disclosed a CVSS 7.1 zero-day in CometBFT, saying it can stall Cosmos-based chains during block sync and affect networks securing more than $8 billion in on-chain value.750
