PHP patches are out! Patch now.

There’s no shame in taking a website offline while waiting for PHP security patches.

A lot of developments since we broke this on X, for those keep trying to correct us. 1. Obviously now confirmed. 2. CVSS is 9,2 3. Patches to be released today October 21st at 14:00 UTC 4. Lots of AI PoCs including our own, can’t confirm if they are this until patches released. 5. Might need ASLR bypass. 6. Cloudflare customers protected by their WAF (apparently). 7. This is bad. 8. Many people taking their sites offline until patches released.

We have reproduced the PHP vulnerabilities and can now confirm that it's real. 0104 👈 Previdian clients have been notified. The vulnerabilities have been added to our autonomous watchlist. Customers who have it enabled will be automatically updated with new events as they unfold.

🚨 Gitea authentication-bypass attempts hit Previdian’s honeypots this morning, trying to impersonate the giteaadmin account with a spoofed HTTP header. The requests targeted CVE-2026-20896, published on 3 July 2026. We first observed these attempts on 20 October at 03:37:30 UTC. Both request sequences match ProjectDiscovery’s publicly available Nuclei template: • Check the Gitea version. • Retrieve a username through /api/v1/users/search?limit=1. • Request /api/v1/user without authentication. • Retry with X-Webauth-User: giteaadmin, attempting to impersonate that account without credentials. Both spoofed-header requests returned HTTP 401 with “token is required”. No successful authentication bypass was observed in these scans. Observed source IPs on 20 October, UTC: • 20.233.250[.]77 at 03:37:30 • 52.16.128[.]168 at 03:41:28 The vulnerability affects Gitea Docker images through 1.26.2 when reverse-proxy authentication is enabled and the trusted-proxy setting allows any source IP. If you run Gitea in Docker, update to a patched release and check REVERSE_PROXY_TRUSTED_PROXIES: it should trust only your intended proxy addresses. Review unexpected X-Webauth-User headers alongside the request sequence above. Details: previdian.com/CVE-2026-20896

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

Around 80% of vulnerabilities in Previdian's KEV dataset can be exploited without authentication. The remaining 20% require credentials. CVE-2026-105740 (Langflow) is one of that 20%. First, they checked whether Langflow's auto-login feature was enabled. When they found it disabled, they switched to trying common, weak credentials. After successfully authenticating, they immediately attempted to exploit CVE-2026-105740 to access environment variables and perform other actions. We first observed exploitation attempts on September 19, but activity increased dramatically following the CVE's publication on October 5. If you're running Langflow, disable auto-login, enforce strong passwords, ensure all patched, and review suspicious authentication and MCP API activity. We observe exploitation attempts targeting numerous vulnerabilities every day across our honeypot network. There's simply too much activity for us to post about everything. Don't rely on social media to stay ahead of emerging threats. Sign up to Previdian to stay informed about the vulnerabilities attackers are actively targeting daily.

This is last Friday's password: 92780

The Danfoss fridge backdoor admin passwords are not today's date, they are derived from the device's today's date. Still stupid, but that is different to what many are reporting.