Red Cell Blog

Critical php2shell flaws (CVE-2026-109618, CVE-2026-109619) let attackers take over PHP servers without logging in. What MSP and Security teams should do now.

TL;DR WatchGuard Red Cell researcher Euler Neto investigated three malware campaigns involving VBScript (VBS), revealing how cybercriminals combine phishing, obfuscated scripts, and legitimate Windows components to deliver malicious payloads while evading detection. The research examines Overlord…

What happened On October 16, 2026, ConnectWise disclosed unauthorized access tied to its Cloud Backup for Microsoft 365 service, formerly known as SkyKick Cloud Backup. ConnectWise has opened incident response, and the investigation is ongoing. Unconfirmed community reports describe an attacker…

Introduction This post is a first-hand experience of all the phishing attempts against me after my data was exposed in four of the recent Trezor-related breaches. All four of these breaches were of Trezor third-party vendors, not Trezor themselves. The post is written as a personal narrative…

72,000 CVEs are projected to be published in 2026, while the median time from vulnerability disclosure to in-the-wild weaponization has fallen to well under 24 hours. Those two figures capture a growing challenge for defenders: more vulnerabilities to manage and less time to respond. Marc and Corey…

Cyberattacks do not always begin with malware. Sometimes they start with a job application. Sometimes with a trusted account. And increasingly, they may involve an AI agent operating with access that was originally intended for something much more routine. In Episode 389 of The 443: Security…