All News

TENESYS AI NEWS tracks the most important AI news and explains what changed, why it matters and whether a technology is worth testing.

All News Models Agents Voice AI Automation Business Research Cyber Security

Any time Today This Week This Month🔴 Breaking 🟠 Important 🧪 Worth Testing

#Patch Management — 2 articles ✕

Cyber Security· Important

AWS releases WAF rules to buy time against two critical unauthenticated PHP RCE bugs

On October 21, 2026, PHP maintainers pushed out urgent patches for two critical flaws, nicknamed PHP2Shell together, that let an attacker run code on a server without logging in. Both carry a CVSS v4.0 score of 9.2 and sit in how PHP processes multipart file-upload requests before application code even runs. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and AWS has since published AWS WAFv2 rule templates plus host-level settings that shrink the attack surface for teams that need time to roll out the upgrade. AWS is clear that the firewall rules only help at the edge — they cannot fully close one of the two bugs, so patching remains mandatory.

1 hour agoAWS Security

BreakingCyber Security

AWS Honeypot Data Shows PHP Flaw Was Hit by Attackers Before Public Patch

Amazon's MadPot honeypot network recorded an exploitation attempt against what is now tracked as CVE-2026-109618 and CVE-2026-109619 — nicknamed PHP2Shell — on October 17, 2026, four days before the vendor publicly disclosed the flaw. The request came from a commercial anonymization network, suggesting a threat actor had working exploit code ahead of the official embargo lift. When the embargo ended on October 21 at 1400 UTC, AWS says proof-of-concept code and real attack traffic hit its sensors within hours, from several distinct sets of infrastructure. AWS argues this points to a structural shift: AI-assisted analysis is making it faster to turn a patch or advisory into a working exploit, shrinking the old assumption that most attacks follow a public PoC.

4 hours agoAWS Security