{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Barsec Cyber Intel",
  "home_page_url": "https://barsec.tech/cyber-intel",
  "feed_url": "https://barsec.tech/cyber-intel/feed.json",
  "description": "Plain-English briefs on important cybersecurity developments for small business owners.",
  "_barsec": {
    "note": "Approved, published Barsec Cyber Intel only. Automation must not post anything outside this feed."
  },
  "items": [
    {
      "id": "https://barsec.tech/cyber-intel/php2shell-critical-php-flaws-active-exploitation",
      "url": "https://barsec.tech/cyber-intel/php2shell-critical-php-flaws-active-exploitation",
      "slug": "php2shell-critical-php-flaws-active-exploitation",
      "title": "PHP2Shell: Two Critical PHP Flaws Are Being Actively Exploited",
      "summary": "If your website or server uses PHP, two flaws can let an attacker run commands without logging in. Patched versions are available now.",
      "date_published": "2026-10-30T16:50:00Z",
      "date_modified": "2026-10-30T16:50:00Z",
      "_barsec": {
        "category": "Actively Exploited Vulnerability",
        "urgency": "critical",
        "cves": [
          "CVE-2026-109618",
          "CVE-2026-109619"
        ],
        "affectedProducts": [
          "PHP 8.5.0 through 8.5.11",
          "PHP 8.4.0 through 8.4.26",
          "PHP 8.3.0 through 8.3.35",
          "PHP 8.2.0 through 8.2.34",
          "PHP 8.1 and older are end-of-life and lack an upstream supported fix"
        ],
        "sourceName": "Huntress",
        "sourceUrl": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities",
        "socialSummary": "PHP is behind a huge number of websites, and two critical flaws are now being actively exploited. If your site or server runs PHP, verify the PHP version itself, not just WordPress or your CMS. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Read the Barsec breakdown: [ARTICLE URL]"
      }
    },
    {
      "id": "https://barsec.tech/cyber-intel/gitlab-cve-2026-97229-self-hosted-server-takeover",
      "url": "https://barsec.tech/cyber-intel/gitlab-cve-2026-97229-self-hosted-server-takeover",
      "slug": "gitlab-cve-2026-97229-self-hosted-server-takeover",
      "title": "Self-Hosted GitLab Flaw Is Being Exploited: Update Now",
      "summary": "A flaw in GitLab can let an attacker run code on a self-hosted server without logging in. GitLab.com and GitLab Dedicated are already patched.",
      "date_published": "2026-10-30T16:50:00Z",
      "date_modified": "2026-10-30T16:50:00Z",
      "_barsec": {
        "category": "Actively Exploited Vulnerability",
        "urgency": "critical",
        "cves": [
          "CVE-2026-97229"
        ],
        "affectedProducts": [
          "Self-managed GitLab CE/EE 19.2 before 19.2.8",
          "Self-managed GitLab CE/EE 19.3 before 19.3.5",
          "Self-managed GitLab CE/EE 19.4 before 19.4.2"
        ],
        "sourceName": "CISA",
        "sourceUrl": "https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog",
        "socialSummary": "If you self-host GitLab, this deserves immediate attention. CVE-2026-97229 can let an attacker run code on the server without logging in, and CISA has confirmed real-world exploitation. Fixed versions are 19.2.8, 19.3.5 and 19.4.2. Barsec breakdown: [ARTICLE URL]"
      }
    },
    {
      "id": "https://barsec.tech/cyber-intel/wordpress-7-1-4-security-update-active-exploit-attempts",
      "url": "https://barsec.tech/cyber-intel/wordpress-7-1-4-security-update-active-exploit-attempts",
      "slug": "wordpress-7-1-4-security-update-active-exploit-attempts",
      "title": "WordPress 7.1.4 Fixes a Dangerous Update-Window Flaw Attackers Are Already Probing",
      "summary": "The security release fixes 22 issues. The most serious can let an attacker run code during a brief window while WordPress Core is updating.",
      "date_published": "2026-10-30T16:50:00Z",
      "date_modified": "2026-10-30T16:50:00Z",
      "_barsec": {
        "category": "WordPress & Plugins",
        "urgency": "high",
        "cves": [],
        "affectedProducts": [
          "WordPress Core 4.7 through 7.1.3 for the upgrade-window vulnerability",
          "WordPress 7.1 users should update to 7.1.4",
          "Older supported branches have corresponding security backports"
        ],
        "sourceName": "Wordfence Threat Intelligence",
        "sourceUrl": "https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/",
        "socialSummary": "WordPress 7.1.4 fixes 22 security issues, including a nasty one that can let an attacker run code during the few seconds a Core update is staged. Wordfence has already seen automated attempts trying to catch that window. Verify your site actually updated. Don't just assume it did. Barsec breakdown: [ARTICLE URL]"
      }
    }
  ]
}