Blog

PHP2Shell CVE-2026-109618 and CVE-2026-109619: corrupted PHP memory leaks secrets to an attacker shell

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): The PHP Vulnerabilities Security Teams Should Patch Now

Patch critical PHP2Shell vulnerabilities and validate your defenses against exploitation attempts with Cymulate Exposure Validation.

Cymulate Recognized as a Customers’ Choice in Gartner® Peer Insights™ Voice of the Customer for Adversarial Exposure Validation

See why customers recognized Cymulate as a 2026 Gartner® Peer Insights™ Customers’ Choice for Adversarial Exposure Validation.

Illustration of MITRE ATT&CK protection strategies showing attack technique mapping, security control validation, and continuous threat prevention.

MITRE ATT&CK Protection Strategies: Building the Model Together

MITRE’s new protection strategies aim to turn security guidance into actionable controls that teams can verify and maintain.

1 / 3

Illustration of the Pillow CVE-2026-96639 heap overflow. A cracked picture frame resting on a pillow releases larger, wider pixel layers, and overflowing pixel data streams into a terminal running code.

One Image to Remote Code Execution: The Critical Pillow Zero-Day Our AI Benchmark Found by Accident (CVE-2026-96639)

Purple panel stage with four chairs and mics; threat icons flow in from the left and leave as checkmarks on the right.

Triangle InfoSeCon Panel Recap: How Security Leaders Prove Defenses, Respond to Breaches and Recover

Across the Kill Chain: How Agents Became the Enterprise's New Front Door

Across the Kill Chain: How Agents Became the Enterprise's New Front Door

MITRE ATT&CK matrix with a 10-step red team attack path, with results showing it was executed, prevented and detected.

Red Team Scenarios: 10 Real-World Attacks to Test Your Defenses

Discovered exposures validated for exploitability, with exploitable CVEs moved to a fix-first list and re-tested

Vulnerability Assessment Solutions: How to Run an AI-Driven Assessment in the Modern Enterprise

WSSnatch attack: a WebSocket tunnel carries an OAuth token from Google Cloud Shell port 900 to an attacker’s browser

CVE-2026-85267: CloudShell WSSnatch

1 2 3 4 5...57 / 57