Computer Security Articles

SummaryLast week, PHP imploded, following the disclosure of the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619.Researchers leveraging AI tools discovered that some dormant vulnerabilities in PHP could be chained together into a functional exploit, which introduced PHP2Shell to the world. This exploit could allow attackers to compromise any sites that use PHP. A fix was rolled out, and chaos ensued. This story echoes what happened earlier this year, with CVE-2026-31431. Also known

SummaryCryptocurrency is being used every day to facilitate a variety of transactions. It’s unlike the usual banking systems, having its own unique strengths and weaknesses. Attackers have made specialized malware to redirect normal transactions to wallets they control in order to steal money, referred to as “Clipbankers”. Due to the nature of cryptocurrency, these transactions are irreversible. ReversingLabs investigated two malware families of this nature, digging into how they work. This blog

One of the world’s leading AI companies just received an important reminder about cybersecurity: Your security is only as strong as the software you trust. On October 26,The Washington Post reportedthat researchers from cybersecurity startup Cathedral used AI agents to discover pathways into sensitive internal systems at Anthropic, the company behind Claude.The most significant detail wasn’t the sophistication of the AI agents or even the speed of the exercise. The researchers reportedly gained

A malware campaign that was discovered early this year targeting JavaScript and Python developers with cryptocurrency-related fake recruiter tasks has spread to Terraform providers and Go modules, according to research published recently by Aikido.It is the first time the company’s research team has observed malware distributed through Terraform providers. Aikido security researcherOliver Smith wrote in a September postthat the malware overlaps with the Graphalgo npm campaign thatReversingLabs r

Key takeawaysSource scanners, SBOMs, certificate managers, network monitors, and vendor questionnaires each answer a different question, and none of them inspects the cryptography inside the software you actually run.The gap is the final software artifact: compiled binaries, packages, and COTS products where no source, manifest, or vendor disclosure exists.Binary analysis fills that gap and can produce a CBOM that ties each cryptographic asset to the component containing it.You don’t need PQC su