TL;DR Two critical PHP flaws, now patched: CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution, and PHP shipped fixes on October 21. WatchGuard's Red Cell Alert covers the immediate steps; this post looks at what the response exposed. The fix was the clear part: the hard…
Critical php2shell flaws (CVE-2026-109618, CVE-2026-109619) let attackers take over PHP servers without logging in. What MSP and Security teams should do now.
TL;DR WatchGuard Red Cell researcher Euler Neto investigated three malware campaigns involving VBScript (VBS), revealing how cybercriminals combine phishing, obfuscated scripts, and legitimate Windows components to deliver malicious payloads while evading detection. The research examines Overlord…
What happened On October 16, 2026, ConnectWise disclosed unauthorized access tied to its Cloud Backup for Microsoft 365 service, formerly known as SkyKick Cloud Backup. ConnectWise has opened incident response, and the investigation is ongoing. Unconfirmed community reports describe an attacker…
Introduction This post is a first-hand experience of all the phishing attempts against me after my data was exposed in four of the recent Trezor-related breaches. All four of these breaches were of Trezor third-party vendors, not Trezor themselves. The post is written as a personal narrative…
72,000 CVEs are projected to be published in 2026, while the median time from vulnerability disclosure to in-the-wild weaponization has fallen to well under 24 hours. Those two figures capture a growing challenge for defenders: more vulnerabilities to manage and less time to respond. Marc and Corey…
TL;DR Euler Neto, a member of the WatchGuard Threat Lab, identified an active ClickFix and EtherHiding campaign targeting Windows users in Anglophone countries. WatchGuard telemetry observed activity affecting the United States, Canada, United Kingdom, Ireland, Australia, and New Zealand, with the…
TL;DR Cristóbal Tárraga García, a member of the WatchGuard Threat Lab, uncovered a malware loader targeting Portuguese-speaking users that uses an Ethereum smart contract to dynamically locate attacker infrastructure and distribute additional payloads. The multi-stage infection chain combines…
TL;DR Euler Neto, a member of the WatchGuard Threat Lab identified an active malware campaign using the ErrTraffic Malware-as-a-Service framework to distribute multiple threats through compromised WordPress websites, ClickFix social engineering, and EtherHiding. The campaign uses Polygon blockchain…
Artificial intelligence is no longer just helping cybersecurity teams analyze alerts, write code, or investigate threats. Increasingly capable AI models can now reason through cybersecurity problems, identify vulnerabilities, chain weaknesses together, and autonomously pursue an objective. That…