9.2
CVSS severity score
Wiz Research identified critical remote code execution and memory disclosure vulnerabilities in the core PHP engine, affecting versions dating back to 5.4.
21 Oct
Every figure reported in cybersecurity news this week, with what each figure measures, when it was reported and where it was published.
937 figures were reported across 456 cybersecurity articles in this window. The table lists the 60 carried by the highest-ranked articles.
Wiz Research identified critical remote code execution and memory disclosure vulnerabilities in the core PHP engine, affecting versions dating back to 5.4.
21 Oct
Wiz Research identified critical remote code execution and memory disclosure vulnerabilities in the core PHP engine, affecting versions dating back to 5.4.
21 Oct
Security researcher Ian Carroll discovered that eight intermediate certificate authority keys issued by eMudhra in April 2025 were cryptographically weak, consisting of single-byte values.
17 Oct (reported 21 Oct)
Security researcher Ian Carroll discovered that eight intermediate certificate authority keys issued by eMudhra in April 2025 were cryptographically weak, consisting of single-byte values.
17 Oct (reported 21 Oct)
Eight intermediate CA certificates issued by eMudhra have been compromised, allowing potential impersonation of websites.
17 Oct (reported 20 Oct)
GitLab released security patches on October 21, 2026, to address a critical remote code execution vulnerability (CVE-2026-110264) with a CVSS score of 10.0.
21 Oct
GitLab released security patches on October 21, 2026, to address a critical remote code execution vulnerability (CVE-2026-110264) with a CVSS score of 10.0.
21 Oct
A critical vulnerability, CVE-2026-111497, has been identified in the Google Brotli compression library, affecting versions 1.0.3 through 1.2.0.
21 Oct (reported 24 Oct)
A critical vulnerability, CVE-2026-111497, has been identified in the Google Brotli compression library, affecting versions 1.0.3 through 1.2.0.
21 Oct (reported 24 Oct)
Authorities in Europe, Asia, and the United States have taken government websites offline following the discovery of two critical security vulnerabilities in the PHP programming language.
21 Oct (reported 22 Oct)
Authorities in Europe, Asia, and the United States have taken government websites offline following the discovery of two critical security vulnerabilities in the PHP programming language.
21 Oct (reported 22 Oct)
GitLab has patched a maximum-severity integer overflow vulnerability, tracked as CVE-2026-110264, which allows unauthenticated remote code execution on self-managed servers.
21 Oct (reported 22 Oct)
GitLab has patched a maximum-severity integer overflow vulnerability, tracked as CVE-2026-110264, which allows unauthenticated remote code execution on self-managed servers.
21 Oct (reported 22 Oct)
GitLab has patched a maximum-severity integer overflow vulnerability, tracked as CVE-2026-110264, which allows unauthenticated remote code execution on self-managed servers.
21 Oct (reported 22 Oct)
The PHP project released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026.
21 Oct
The PHP project released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026.
21 Oct
The PHP project released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026.
21 Oct
Since September 2026, the China-aligned threat actor Storm-0940 has utilized the agentic AI framework ARTEX to automate global cyberattacks against hundreds of organizations.
21 Oct
On Wednesday, October 21, 2026, the PHP Foundation released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
21 Oct (reported 24 Oct)
Security researchers from Calif and Wiz identified two critical Remote Code Execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell.
23 Oct
Cybersecurity experts and tech leaders, including Sam Altman, Jason Clinton of Anthropic, Marc Benioff of Salesforce, and Matthew Prince of Cloudflare, have warned of a 'vulnerability tsunami' following the discovery of a critical flaw in the PHP programming language on October 21, 2026.
21 Oct (reported 23 Oct)
Researchers from Calif, supported by OpenAI's 'Patch the Planet' program, and the security firm Wiz independently discovered two critical PHP memory-corruption vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
05 Aug (reported 22 Oct)
Researchers from Calif, supported by OpenAI's 'Patch the Planet' program, and the security firm Wiz independently discovered two critical PHP memory-corruption vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
05 Aug (reported 22 Oct)
Researchers from Calif, supported by OpenAI's 'Patch the Planet' program, and the security firm Wiz independently discovered two critical PHP memory-corruption vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
05 Aug (reported 22 Oct)
The PHP programming language developers released urgent security patches on October 21, 2026, to address two critical vulnerabilities, nicknamed PHP2Shell, which allow remote code execution.
21 Oct (reported 22 Oct)
The PHP programming language developers released urgent security patches on October 21, 2026, to address two critical vulnerabilities, nicknamed PHP2Shell, which allow remote code execution.
21 Oct (reported 22 Oct)
On October 21, 2026, developers disclosed two critical PHP vulnerabilities, dubbed 'PHP2Shell,' which allow unauthorized remote code execution.
21 Oct (reported 22 Oct)
On October 21, 2026, developers disclosed two critical PHP vulnerabilities, dubbed 'PHP2Shell,' which allow unauthorized remote code execution.
21 Oct (reported 22 Oct)
On October 21, 2026, developers disclosed two critical PHP vulnerabilities, dubbed 'PHP2Shell,' which allow unauthorized remote code execution.
21 Oct (reported 22 Oct)
PHP developers released critical security patches on Wednesday, October 21, 2026, to address long-standing vulnerabilities discovered via AI.
21 Oct (reported 22 Oct)
The US government is coordinating with federal agencies and international partners to address two critical vulnerabilities in the PHP programming language.
21 Oct (reported 22 Oct)
The US government is coordinating with federal agencies and international partners to address two critical vulnerabilities in the PHP programming language.
21 Oct (reported 22 Oct)
The US government is coordinating with federal agencies and international partners to address two critical vulnerabilities in the PHP programming language.
21 Oct (reported 22 Oct)
PHP developers are releasing security patches today, October 21, 2026, to address two critical Remote Code Execution vulnerabilities with a severity rating of 9.2 out of 10.
21 Oct
PHP developers are releasing security patches today, October 21, 2026, to address two critical Remote Code Execution vulnerabilities with a severity rating of 9.2 out of 10.
21 Oct
PHP developers are releasing security patches today, October 21, 2026, to address two critical Remote Code Execution vulnerabilities with a severity rating of 9.2 out of 10.
21 Oct
The PHP development team has released emergency security updates for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
21 Oct
The PHP Foundation released security updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
21 Oct
The PHP Foundation released security updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
21 Oct
PHP developers released emergency updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
21 Oct
The PHP Foundation released emergency security updates on Wednesday, October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
21 Oct
The PHP Foundation released emergency security updates on Wednesday, October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
21 Oct
On October 21, 2026, government websites in France, Denmark, Finland, and the Netherlands were taken offline following the discovery of a critical vulnerability affecting up to 70% of global websites.
21 Oct
The PHP Foundation released emergency patches on Wednesday, October 21, 2026, to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting multiple PHP versions.
21 Oct
The PHP Foundation released emergency patches on Wednesday, October 21, 2026, to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting multiple PHP versions.
21 Oct
The PHP Foundation released emergency patches on Wednesday, October 21, 2026, to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting multiple PHP versions.
21 Oct
Unit 42 has identified two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP with a CVSS score of 9.2.
21 Oct
Unit 42 has identified two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP with a CVSS score of 9.2.
21 Oct
On Wednesday, October 21, 2026, multiple global cybersecurity incidents occurred, including critical vulnerabilities in PHP, Node.js, and a compromise of the LiteLLM proxy.
21 Oct
The PHP development team has disclosed a critical memory-management vulnerability named 'PHP2Shell'.
21 Oct
A threat actor group known as FULCRUMSECT has publicly claimed a massive data breach of PingCAP Inc. and its TiDB Cloud service.
08 Sep (reported 20 Oct)
A threat actor group known as FULCRUMSECT has publicly claimed a massive data breach of PingCAP Inc. and its TiDB Cloud service.
08 Sep (reported 20 Oct)
A threat actor group known as FULCRUMSECT has publicly claimed a massive data breach of PingCAP Inc. and its TiDB Cloud service.
08 Sep (reported 20 Oct)
A threat actor group known as FULCRUMSECT has publicly claimed a massive data breach of PingCAP Inc. and its TiDB Cloud service.
08 Sep (reported 20 Oct)
Microsoft reported that the China-aligned threat actor Storm-0940 compromised the ConnectWise Cloud Backup application using an AI-driven penetration testing framework called ARTEX.
01 Sep (reported 22 Oct)
Microsoft reported that the China-aligned threat actor Storm-0940 compromised the ConnectWise Cloud Backup application using an AI-driven penetration testing framework called ARTEX.
01 Sep (reported 22 Oct)
Microsoft reported that the China-aligned threat actor Storm-0940 compromised the ConnectWise Cloud Backup application using an AI-driven penetration testing framework called ARTEX.
01 Sep (reported 22 Oct)
Microsoft reported that the China-aligned threat actor Storm-0940 compromised the ConnectWise Cloud Backup application using an AI-driven penetration testing framework called ARTEX.
01 Sep (reported 22 Oct)
ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services following the detection of unauthorized access to application identities on October 15, 2026.
15 Oct (reported 19 Oct)
Indian certificate authority eMudhra announced on October 22, 2026, that it will exit the SSL/TLS certificate business.
22 Oct
60 of 937 figures are listed; the rest were ranked lower by importance and multi-source corroboration and are not shown.
Publishers cited most often across the events on this page.
Choose the topics and sources that matter to you. Dailyn turns them into one concise digest.
Build my digest →Dailyn’s analysis engine screens the week’s reporting for relevance, deduplicates overlapping coverage into distinct dated events, and ranks those events by significance, source corroboration and recency. The highest-ranked events form the core of the weekly briefing.
Every line is a fact taken verbatim from a single dated article, and that article is linked in the same row. Nothing on the page is written or inferred beyond the article set.
The analysis engine extracts facts, entities and figures from the week’s reporting, and the editorial synthesis is generated from that event data. Published claims remain traceable to the underlying reporting.
A new briefing is issued for every ISO week, and the key-numbers section is refreshed with it. Each page states the exact window of dates it covers.
Dailyn’s analysis engine processes everything its monitored sources published this week: it deduplicates overlapping coverage, clusters reporting into distinct dated events, extracts the companies, deals and figures involved, and ranks the results by significance, corroboration and recency.
Everything Dailyn’s monitored sources published across the seven-day window.
The engine filters out off-topic and low-quality reporting.
Articles the engine tagged with this industry inside the window.
Sector articles that reported at least one figure inside the window.
The figures this page prints, each quoted exactly as its article reported it.
Events ranked by significance, corroboration and recency.
Every line on this page is a fact taken verbatim from a single dated article, with that article linked in the same row. Nothing on this page is written or inferred beyond the article set.
Duplicate reports of the same event are collapsed to one entry; the corroborating-source count says how many outlets carried it.
Dates are publication dates. Where an article states a different date for the event itself, that date is shown first and the publication date in brackets. A date the article gives for something still to come is shown as "due".
A figure is listed exactly as the article reported it. Figures are not converted, rebased, summed or compared across articles.
Every event stays linked to the reporting it was built from.
Pick the topics and sources that matter to you. Dailyn reads them every day and sends one concise digest.