Discussions, questions and news about Vulnerability Management from cybersecurity professionals on Cyberr.
0 members · 220 posts
Laurent Halimi — CEO & Founder CYBERR & HEELR
3/3 on today's Cyberr daily challenge. Senior level: incident response, threat intelligence and vulnerability management. Try today's set. https://cyberr.ai/daily/56a5c879-ca55-4d63-ae18-e72789195c68
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Just dropped a massive suite of 9 live services on the Heelr marketplace. I’m moving application security and compliance out of traditional bottlenecking models and into pure, automated velocity. What's live on the dashboard right now: • Deterministic Layer-Zero Validation: Neut…
· 4 reactions · 0 comments
Quinton Plaatjies — SOC Engineer
The headline suggests that OpenBSD 8.0 introduces three major areas of improvement: Stronger security controls : OpenBSD is already known for its security-first design, so this likely includes additional kernel hardening, stricter privilege separation, improved memory-protection…
· 2 reactions · 0 comments
Quinton Plaatjies — SOC Engineer
“PHP Releases Emergency Windows Security Update To Fix Critical Brotli Decoder Vulnerability” highlights a serious security issue affecting PHP deployments on Windows that use the Brotli compression library. What is Brotli? Brotli is a compression algorithm developed by Google a…
· 1 reactions · 0 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
https://youtu.be/kIG2ffjUrXU في الفيديو ده من مجتمع Information Security Tutorials هنناقش أبرز الثغرات الأمنية اللي اتكشفت في Node.js خلال أكتوبر 2026، وهنفهم ليه تحديثات الأمان الخاصة بالـ Runtime والـ Dependencies ممكن تكون حاسمة في حماية تطبيقات الويب والأنظمة اللي بتعتمد علي…
· 3 reactions · 0 comments
ZIYAD TARIQ HASHMI — Penetration Tester
I got 3/3 on today's Cyberr daily challenge (Vulnerability management, junior level). Think you'd beat me? https://cyberr.ai/daily/13909589-dfd3-42ea-9e81-0bc4bf7e4157
· 4 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
The Architectural Manifesto: Part 2 — Why "Black October" Proves Your Threat Model is Dead. The global cybersecurity ecosystem is scrambling over the new PHP "php2shell" zero-days (CVE-2026-109618 & CVE-2026-109619). CISA is yelling to patch, tech stacks are forcing emergency of…
· 6 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
AI is now finding bugs that humans missed for a decade. But attackers have AI too. If both sides find the same flaw at the same time, does a 90-day (or even 2-day) embargo still protect anyone? Vote, then tell us: how fast did your team patch PHP2Shell?”
· 7 reactions · 1 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
A critical flaw affecting 70% of all websites has the cybersecurity world panicked Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. Left unfixed, the flaw would allow hackers to easily take ov…
· 12 reactions · 2 comments
samuel watua Soita — Full Stack Software Engineer
One malicious package can turn a developer tool into a credential-harvesting machine. That's exactly why software supply-chain security deserves much more attention. Microsoft recently analyzed the LiteLLM 1.107.0 supply-chain compromise, where attackers used stolen developer to…
· 0 reactions · 0 comments
Maxwell Bwire — Technical Support Technician
I'm happy to share that I've been working through the OWASP Top 10 on TryHackMe, building my understanding of common web application security risks through hands-on practicals. During this learning journey, I've explored topics including: - Injection— understanding how unsafe in…
· 6 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
The scariest vulnerability isn't necessarily the one with the highest CVSS score. It's the one attackers are already exploiting while defenders are still trying to understand it. Recent threat intelligence shows the pace of zero-day exploitation is increasing. Google Threat Inte…
· 4 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
A critical vulnerability doesn't automatically mean you're compromised. But an exposed critical vulnerability is a very different story. This distinction is becoming increasingly important. Organizations are dealing with an enormous volume of vulnerabilities. Google Threat Intel…
· 1 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
Critical security issue affecting PHP he NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619). What has happened? PHP has published a security update to address a critical security issue th…
· 10 reactions · 1 comments
Maxwell Bwire — Technical Support Technician
Completed: Guided Pentest: Infrastructure | TryHackMe I've completed the Guided Pentest: Infrastructure room on TryHackMe, where I practised the main stages of an infrastructure penetration test, from enumeration to privilege escalation. What I worked on -Nmap: Scanned the targe…
· 6 reactions · 0 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
https://youtu.be/jxJujICo9xc في الفيديو ده من مجتمع Information Security Tutorials هنتكلم عن ثغرات PHP2Shell اللي ظهرت في أكتوبر 2026، وليه الثغرات اللي بتصيب الـ PHP Runtime ممكن تمثل خطورة كبيرة على خوادم الويب والتطبيقات اللي بتعتمد عليه. هنناقش الثغرتين CVE-2026-109618 وCVE-…
· 3 reactions · 0 comments
Nikki Webb — Cybersecurity is not just technical, it is human | Protecting people, businesses & resilience
#PHP2Shell has everyone rattled this week. Here is the calm version. Two critical flaws in PHP itself. Fixes are out. The National Cyber Security Centre says patch now. Most teams will update the servers they know about. The breach risk sits in the ones they don’t. The forgotten…
· 8 reactions · 0 comments
Maxwell Bwire — Technical Support Technician
I’ve just completed the Guided Pentest: Web room on TryHackMe! 🚩 This was a valuable hands-on exercise that helped me put web penetration-testing concepts into practice, from enumerating a web application and identifying vulnerabilities to exploiting a file-upload weakness and…
· 10 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
AI found the bug. Humans took the blame. Meanwhile, the internet went dark. The current global PHP crisis (php2shell) forced entire government and healthcare networks in Europe to literally pull the plug and go offline. Why? Because an AI discovered a remote code execution (RCE)…
· 4 reactions · 0 comments
Imrane T. — Offensive Security | Attack Chains & Business Logic
One authenticated session. One changed member ID. One missing ownership check. While testing an API flow, I found that changing a client-controlled memberId allowed the session to resolve another account’s preference state. Same session. Different account object. HTTP 200. The r…
· 4 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Inside the ETBV Engine State Machine: Eliminating Vulnerability Classes in <0.15ms If you want to survive sub-minute weaponization windows, your defenses must be completely deterministic. Here is exactly how the Execution-Time Boundary Verification (ETBV) engine processes, handl…
· 5 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
What happens when vulnerabilities are discovered faster than organizations can patch them? We may be approaching that reality. Google Threat Intelligence reports that monthly vulnerability disclosures more than doubled in 2026—from 5,045 in January to 10,477 in July, reaching 10…
· 1 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
A vulnerability doesn't have to be complicated to become dangerous. It just needs to reach the right server. The cybersecurity community is currently dealing with PHP2Shell — two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 CVSS v4.0 and…
· 2 reactions · 0 comments
Mihai Camburov — Senior Offensive Security | Penetration Testing | Ethical Hacking | OSCP · CCIE Security | DefendSec Turning OSINT & penetration testing findings into real risk visibility.
Before You Run That PoC, Treat It Like Malware When a critical vulnerability is disclosed, security researchers and pentesters naturally want to validate exposure quickly. And that is exactly what makes fake Proof-of-Concept exploits effective. The recent PHP2Shell disclosure is…
· 5 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
A vulnerability in PHP just turned a programming language into a cybersecurity headline. Two critical vulnerabilities. CVE-2026-109618 CVE-2026-109619 Both carry a CVSS v4.0 score of 9.2 and can enable unauthenticated remote code execution on affected PHP systems. What makes thi…
· 5 reactions · 0 comments