Barsec Cyber Intel: What matters. What it means. What to do.

Plain-English briefs on the security news that affects small businesses.

• PHP2Shell: Two Critical PHP Flaws Are Being Actively Exploited: If your website or server uses PHP, two flaws can let an attacker run commands without logging in. Patched versions are available now.
• Self-Hosted GitLab Flaw Is Being Exploited: Update Now: A flaw in GitLab can let an attacker run code on a self-hosted server without logging in. GitLab.com and GitLab Dedicated are already patched.
• WordPress 7.1.4 Fixes a Dangerous Update-Window Flaw Attackers Are Already Probing: The security release fixes 22 issues. The most serious can let an attacker run code during a brief window while WordPress Core is updating.