Red Cell Blog
Cybersecurity Headlines & Trends Explained
PHP2Shell: The Patch Is Out. Do You Know Where You're Exposed?
TL;DR Two critical PHP flaws, now patched: CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution, and PHP shipped fixes on October 21. WatchGuard's Red Cell Alert covers the immediate steps; this post looks at what the response exposed. The fix was the clear part: the hard…
How ASCII Smuggling Exploits AI Assistants and Creates Security Blind Spots
TL;DR Invisible instructions, real security risks: ASCII smuggling uses hidden Unicode characters to conceal malicious instructions in content processed by AI assistants. Trusted access can become an attack pathway: Prompt injection can manipulate AI assistants into performing unauthorized actions…
Red Cell Alert: php2shell Critical PHP Remote Code Execution
Critical php2shell flaws (CVE-2026-109618, CVE-2026-109619) let attackers take over PHP servers without logging in. What MSP and Security teams should do now.
How VBScript Malware Hides Behind Trusted Tools to Evade Detection
TL;DR WatchGuard Red Cell researcher Euler Neto investigated three malware campaigns involving VBScript (VBS), revealing how cybercriminals combine phishing, obfuscated scripts, and legitimate Windows components to deliver malicious payloads while evading detection. The research examines Overlord…
Red Cell Alert: ConnectWise Cloud Backup Unauthorized Access
What happened On October 16, 2026, ConnectWise disclosed unauthorized access tied to its Cloud Backup for Microsoft 365 service, formerly known as SkyKick Cloud Backup. ConnectWise has opened incident response, and the investigation is ongoing. Unconfirmed community reports describe an attacker…
The Tales of a Trezor Data Breach Victim
Introduction This post is a first-hand experience of all the phishing attempts against me after my data was exposed in four of the recent Trezor-related breaches. All four of these breaches were of Trezor third-party vendors, not Trezor themselves. The post is written as a personal narrative…
Looking For More?
Red Cell Podcast
A weekly podcast featuring the leading white-hat hackers and security researchers.
Ransomware Tracker
The Ransomware Tracker is a dynamic, all-in-one hub for IT professionals, researchers, and cybersecurity-minded folks to learn about the entire ransomware landscape. This information-laden resource brings together WatchGuard Red Cell research with evidence from all over the Internet into one single convenient location.