🚨 Node2Shell (CVE-2026-111497, CVSS 9.2): a public repo for this Node.js Brotli flaw appeared about five hours after the fix shipped.
No confirmed in-the-wild exploitation yet, but the patch-to-PoC gap was about a day. Patch in order of reachability: start with services that
🚨 A working root exploit for a Linux kernel bug is public. No CVE. No merged fix.
ZDI-CAN-33367 is a gap in the Dirty Frag fix, with root confirmed on current Ubuntu, Debian, and AlmaLinux. Restrict unprivileged user namespaces and enforce seccomp RuntimeDefault while you wait.
AI agents are writing code, touching production, and acting with real credentials. So who’s watching what they actually do? 🔒
Join Sysdig’s Conor Sherman and Shantanu Gattani on LinkedIn Live to talk runtime security and governance for AI agents. Live demo included.
📅 Nov 5 |
🚨 PHP2Shell: two critical CVEs in PHP core (CVSS v4.0 9.2). Exploitation attempts began four days before the patch was released.
An unauthenticated attacker can run code with HTTP requests alone. The vulnerable code dates to PHP 5.4 in 2012, so even clean application code is
Wide eyes. Racing pulse. A backlog that keeps growing. You may be experiencing Mythos anxiety. 😅
Join our “Mythos, Decoded” webinar to learn how runtime context shows which vulns add real risk. Practical steps, minus the panic.
📅 Oct 29 | 8am PT / 11am ET
