From UDP Probe to Working Tunnel: Analyzing Hysteria2 Behavior via QUIC, HTTP/3 and Client Events

Black October Vulnerabilities: Node.js, Nginx, and Server-Side Exploits Analyzed

A detailed review of 15 critical and high-severity vulnerabilities disclosed in October reveals that only a handful actually affected a production server running Astro, Strapi, Nginx, and Ubuntu 24.04. Node.js remained unpatched for four days, exposing a Brotli decompression flaw that could lead to remote code execution. Nginx packages lagged behind security updates despite unattended-upgrades being enabled, though configuration checks showed most CVEs did not apply. PHP and GitLab issues were irrelevant due to their absence from the stack. The author also migrated away from inline scripts and third-party dependencies to reduce attack surface. Commands for verifying package changelogs, detecting deleted binaries in memory, and confirming librsvg fixes in sharp are provided throughout the analysis.

AI-Driven Discovery of PHP2Shell Zero-Day Forces Rethink of DevSecOps Practices

One week after the October 21 black Wednesday incident, European governments scrambled to shut down web services following the disclosure of a critical remote code execution flaw in the PHP core. The vulnerability, tracked as CVE-2026-109618 with a CVSS score of 10.0, was identified by an advanced AI model during automated auditing rather than by human researchers. The flaw resided in long-untouched multipart/form-data parsing code that had been protected by PHP's backward-compatibility policy for decades. Once a proof-of-concept leaked, attacker-controlled LLMs rapidly generated architecture-specific exploits and polymorphic code that bypassed basic WAF signatures. Human defenders were forced into manual patch cycles and emergency network isolations across the EU because they could not match the speed of automated exploitation. The event has triggered immediate calls for AI-powered fuzzing inside CI/CD pipelines, legacy code audits, and autonomous AIOps-driven protection systems.

Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Versions of Sophos UTM

Sophos has disclosed a severe remote code execution flaw in its legacy Sophos UTM security gateway product. The vulnerability, tracked as CVE-2026-118633, carries a CVSS v4.0 base score of 9.2 and is rated Critical. It impacts the email proxy when scanning features are enabled, allowing unauthenticated attackers to achieve root-level command execution by triggering a race condition. Although the product has reached end-of-life status, Sophos has released a manual patch that administrators must apply themselves. The company strongly urges immediate remediation for any deployments still using the mail protection functionality and recommends migrating to the supported Sophos Firewall platform.