Red Cell Blog

TL;DR Two critical PHP flaws, now patched: CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution, and PHP shipped fixes on October 21. WatchGuard's Red Cell Alert covers the immediate steps; this post looks at what the response exposed. The fix was the clear part: the hard…

TL;DR Invisible instructions, real security risks: ASCII smuggling uses hidden Unicode characters to conceal malicious instructions in content processed by AI assistants. Trusted access can become an attack pathway: Prompt injection can manipulate AI assistants into performing unauthorized actions…

Critical php2shell flaws (CVE-2026-109618, CVE-2026-109619) let attackers take over PHP servers without logging in. What MSP and Security teams should do now.

TL;DR WatchGuard Red Cell researcher Euler Neto investigated three malware campaigns involving VBScript (VBS), revealing how cybercriminals combine phishing, obfuscated scripts, and legitimate Windows components to deliver malicious payloads while evading detection. The research examines Overlord…

What happened On October 16, 2026, ConnectWise disclosed unauthorized access tied to its Cloud Backup for Microsoft 365 service, formerly known as SkyKick Cloud Backup. ConnectWise has opened incident response, and the investigation is ongoing. Unconfirmed community reports describe an attacker…

Introduction This post is a first-hand experience of all the phishing attempts against me after my data was exposed in four of the recent Trezor-related breaches. All four of these breaches were of Trezor third-party vendors, not Trezor themselves. The post is written as a personal narrative…