TL;DR Two critical PHP flaws, now patched: CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution, and PHP shipped fixes on October 21. WatchGuard's Red Cell Alert covers the immediate steps; this post looks at what the response exposed. The fix was the clear part: the hard…
72,000 CVEs are projected to be published in 2026, while the median time from vulnerability disclosure to in-the-wild weaponization has fallen to well under 24 hours. Those two figures capture a growing challenge for defenders: more vulnerabilities to manage and less time to respond. Marc and Corey…
In Episode 378 of The 443 Security Simplified, Marc Laliberte and Corey Nachreiner examine lessons from a recent CISA security incident, a vulnerability affecting the Amazon Q Developer extension for Visual Studio Code, and Microsoft research into a destructive malware platform known as Giga Wiper…
Vulnerability management has never been just about finding flaws. It is about understanding which flaws matter most, which ones attackers are likely to exploit, and which ones security teams need to prioritize before they become a real business risk. That is why CVEs, CVSS scores, and vulnerability…
Artificial intelligence, exposed edge devices, and vulnerability disclosure are colliding in ways that security teams can no longer treat as separate risks. In Episode 375 of The 443: Security Simplified, WatchGuard’s Marc Laliberte and Corey Nachreiner unpack three timely cybersecurity stories: the…
TL;DR The time between vulnerability disclosure and active exploitation is shrinking. In episode 372 of The 443 Security Simplified, WatchGuard’s Marc Laliberte and Adam Winston discuss why the traditional patch window is becoming harder for defenders to rely on. The episode also examines a recent…
Artificial intelligence is no longer just a productivity multiplier. It is becoming a force multiplier for cybersecurity, and potentially for cyber risk. In Episode 366 of The 443, Marc Laliberte and Corey Nachreiner discuss three developments that together paint a clear picture of where the…
The cybersecurity landscape is shifting quickly. In Episode 361 of The443 Podcast, Marc Laliberte and Corey Nachreiner discuss three emerging issues shaping modern security: A critical authentication bypass in a popular JSON Web Token (JWT) library An autonomous AI bot exploiting GitHub repositories…
Three stories, one theme: control planes, supply chains, and human workflows remain high-leverage targets. This Secplicity blog follows the sequence and details covered by Marc Laliberte and Corey Nachreiner in The443 Podcast Episode 360. 1) Cisco Catalyst SD-WAN 0-Day (CVSS 10): What happened Cisco…
Sometimes supposedly small things make a huge difference. This can also be true in cyber security configurations. In recent weeks, multiple partners described very similar cyber attacks their customers faced, and in some cases, the criminals were unfortunately even successful in compromising…