The Exploit HQ @TheExploitHQ

OpenHands sandbox ports exposed root commands. Check your deployment. #OpenHands #VulnCheck #Docker #Apptainer #Cohere #Alibaba #Qwen #Microsoft #DeepSeek #UniversityOfRochester youtu.be/tBRAfMlldXg

Full brief, chapters and every primary source: youtube.com/watch?v=Q2-K3d… Primary sources: - PHP: cisa.gov/news-events/al…

[!] PHP: active exploitation confirmed. Federal agencies must remediate both vulnerabilities under BOD 26-04, and all organizations should prioritize patching them. [!] ACTIVELY EXPLOITED - PHP - CVE-2026-109618, CVE-2026-109619 (CISA KEV) [!] DEVELOPING - Wiz Research reported on Gheist, an automated campaign mass-abusing compromised GitHub tokens to exfiltrate secrets via GitHub Actions workflows - CISA unveiled its CISA 2030 strategic plan to transition toward an aggressive, anticipatory posture protecting critical infrastructure [>] Full 5-min brief with sources in the first reply. #CyberSecurity #ThreatIntel

@OpenAI We need to see how this new model will work on both sides of cybersecurity (red and blue teams).

Gheist steals GitHub secrets. Revoke tokens; rotate secrets. #Wiz #GitHub #Anthropic #HuggingFace #Groq #NVIDIA #AWS #Amazon #Google #Microsoft #HashiCorp #IBM #Xinference #Xorbits #Unitree #Leon #VulnCheck youtu.be/zmh3iqOQplA

Full brief, chapters and every primary source: youtube.com/watch?v=KNUrKZ… Primary sources: - Arista VeloCloud Orchestrator: cisa.gov/sites/default/… - Collabora Online Built-in CODE Server for Nextcloud: cisa.gov/sites/default/…

[!] Arista VeloCloud Orchestrator: active exploitation confirmed. Upgrade to a fixed VCO release as soon as possible and preserve logs if compromise is suspected. [!] ACTIVELY EXPLOITED - Arista VeloCloud Orchestrator - CVE-2026-114625 (CISA KEV) - Collabora Online Built-in CODE Server for Nextcloud - CVE-2026-110447 (CISA KEV) [!] PATCH NOW - JPCERT/CC updated its security alert warning that proof-of-concept exploit codes and communications attempting exploitation have been observed for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 [!] DEVELOPING - JPCERT/CC warned that an out-of-bounds write vulnerability in Google's Brotli C implementation can cause application crashes, memory disclosure, or arbitrary code execution (CVE-2026-111497) [>] Full 6-min brief with sources in the first reply. #CyberSecurity #ThreatIntel

[!] Collabora Online / Nextcloud CODE Server: active exploitation confirmed. Update the Collabora Online Built-in CODE Server (richdocuments) app to version .303 or later immediately. [!] ACTIVELY EXPLOITED - Collabora Online / Nextcloud CODE Server - CVE-2026-110447 (CISA KEV) - Arista VeloCloud Orchestrator (VCO) On-Prem - CVE-2026-114625 [!] PATCH NOW - Palo Alto Networks confirmed that PAN-OS firewalls and Panorama management appliances are affected by PHP2Shell vulnerabilities, with fixes in upcoming releases (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) [!] DEVELOPING - CISA warned that InterSystems IRIS for Health has TLS/SSL encryption disabled by default, allowing attackers to intercept transmitted data and log in (CVE-2026-111594) [>] Full 6-min brief with sources in the first reply. #CyberSecurity #ThreatIntel

LiteLLM 1.107.0 shipped credential-stealing malware. Rebuild affected environments and rotate exposed secrets. #LiteLLM #GitHub #Docker #AWS #Amazon #BerriAI youtube.com/watch?v=pZtmY-…

@ollama This is why local matters: redaction tools miss things. We demonstrated that with a fictional support ticket and a local Ollama workflow on The AI Security HQ. Redact, keep inference local, check the output, then get human approval. youtu.be/3cuMnyHXI94

@NetworkChuck I've used it for several months and it's been getting dumber

@claudeai Is not who made it first, is who make it better than the others.

ARTEX targets vendors. Review sign-in logs. #Wiz #Microsoft #Baidu #GitHub #Zscaler #Okta #Amazon #AWS #Anthropic #Theorem #HiddenLayer #TogetherAI #FireworksAI #LiteLLM #BerriAI #OpenAI #VirusTotal #Google #NVIDIA #Tencent #Cisco #Cline #Ollama youtube.com/watch?v=tOCCh9…

Full brief, chapters and every primary source: youtube.com/watch?v=alljlI… Primary sources: - Siemens Software Center: cisa.gov/news-events/ic… - Arista VeloCloud Orchestrator (VCO) On-Prem: arista.com/en/support/adv…

[!] Siemens Software Center: active exploitation confirmed. Update Siemens Software Center to the latest version and inspect AppData directories for unauthorized binaries. [!] ACTIVELY EXPLOITED - Siemens Software Center - CVE-2026-110936 (CISA KEV) - Arista VeloCloud Orchestrator (VCO) On-Prem - CVE-2026-114625 [!] PATCH NOW - The PHP Group released emergency security updates fixing two critical unauthenticated remote code execution vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) [!] DEVELOPING - ConnectWise confirmed unauthorized access to application credentials for Cloud Backup, attributing the incident to a China state-aligned group using agentic AI - Microsoft Threat Intelligence reported that Chinese state-aligned group Storm-0940 leveraged the ARTEX agentic AI framework to automate attacks following a ConnectWise supply-chain compromise [>] Full 7-min brief with sources in the first reply. #CyberSecurity #ThreatIntel

theexploithq.com/briefs/2026-10…

PHP2Shell is under attack. Patch now. #PHP #Wiz #OpenAI #Calif #Amazon #AWS #Cloudflare #LiteLLM #BerriAI #Docker #GitHub #Microsoft #ConnectWise #NVIDIA #Anthropic #Cisco #CrowdStrike #Dell #Google #HPE #IBM #Meta #PaloAltoNetworks youtu.be/d6hSM86tFRg

Full brief, chapters and every primary source: youtube.com/watch?v=2ohb0W… Primary sources: - PHP: cisa.gov/news-events/al… - Palo Alto Networks PAN-OS: unit42.paloaltonetworks.com/active-exploit… - Plex Media Server / EG Secure Solutions SiteGuard / Siemens Software Center: cisa.gov/news-events/al… - SafePay Ransomware Group: cisa.gov/news-events/cy…

CISA issued an alert strongly urging organizations to immediately patch critical php2shell remote code execution vulnerabilities in PHP. Immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take unpatched PHP-based web systems offline. [!] ACTIVELY EXPLOITED - PHP - CVE-2026-109618, CVE-2026-109619 (remote code execution) - Palo Alto Networks PAN-OS - CVE-2026-0257 (CISA KEV, ransomware) - Plex Media Server / EG Secure Solutions SiteGuard / Siemens Software Center - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-106931, CVE-2026-110936 (CISA KEV) - SafePay Ransomware Group - CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 (ransomware) [!] DEVELOPING - The Node.js project announced security releases resolving a high-severity out-of-bounds write vulnerability in its Brotli decoder permitting remote code execution (CVE-2026-111497) - Microsoft Threat Intelligence reported that Chinese state-aligned group Storm-0940 leveraged the ARTEX agentic AI framework to automate attacks following a ConnectWise supply-chain compromise [>] Full 9-min brief with sources in the first reply. #CyberSecurity #ThreatIntel #Microsoft #Node #SafePay #PHP #PHP2shell

@kalilinux github.com/wortos/my-meag…