Vulnerability Management articles
Articles, checklists and expert guidance on vulnerability management from Aesparrow's penetration testers, auditors and compliance consultants.
Articles
PHP2Shell Vulnerabilities: Exploitation Attempt Detected Before Public Disclosure
The PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution in vulnerable PHP systems. Learn about the reported exploitation attempts, detection challenges, and security measures organizations should take to reduce exposure.
Microsoft October 2026 Patch Tuesday: 1,400+ Security Flaws
Microsoft's October 2026 security updates address more than 1,400 reported vulnerabilities across Windows, Office, developer tools, SharePoint Server, and other products. The release includes an actively exploited Windows security feature bypass, highlighting the importance of risk-based patching…
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
Attackers compromised five OVHcloud CLI releases by hijacking a contributor's GitHub account and replacing download archives with malicious builds designed to steal secrets. The incident highlights software supply chain risks and the importance of verified releases, protected developer accounts…
GitLab CVE-2026-97229: Critical Security Vulnerability
GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability with a CVSS score of 10.0 that could allow unauthenticated attackers to execute arbitrary code on affected servers. The flaw involves insufficient validation of specially crafted regular expressions in CI/CD…
GenAI and Agentic AI Security: When Autonomous Agents Cross the Line
Generative AI and agentic AI are transforming software development, cybersecurity research, and automated testing. However, security investigations show that AI agents can create serious risks when they have excessive permissions, unrestricted internet access, or insufficiently isolated execution…
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Attackers are exploiting a Siemens Software Center vulnerability in ClickFix campaigns to deliver malware and remote access trojans. The flaw, CVE-2026-110936, involves DLL sideloading and affects versions earlier than 4.0.9.8. Organizations should update the software, investigate suspicious…
Let’s find the gaps before someone else does.
Tell us what you need tested for a fixed-scope quote, or talk it through with an Aesparrow practitioner — no obligation, no sales script.