Translated title. Original: php2shell: Erfolgreiche Angriffe auf PHP-Schwachstelle bestätigt | heise online
A Heise Online article confirms successful attacks exploiting a PHP vulnerability, noting an English version and editorial review before publication.
The piece argues that software security is deteriorating as vulnerability reports proliferate and dependency chains grow, overburdening maintainers. It notes misaligned incentives, noise from many researchers (and chatbots), and the tension between fixing security and shipping features, leading to burnout and a fractured development landscape.
Translated title. Original: Cybersécurité et IA : comment les entreprises peuvent se défendre contre les attaques automatisées - l'Opinion
AI is reshaping cybersecurity by exposing long-hidden flaws in widely used PHP code; patches exist but defenses must evolve to address AI-enabled threats, as noted by a F5 cybersecurity expert.
The open-source Secure Agent Playbook provides structured security procedures for AI agents, with repeatable checks and evidence-based findings. Its skills cover tasks such as code review, dependency scanning, and AI security audits, and can be installed in Claude Code or followed by other agents.
Translated title. Original: Chrome-Update stopft attackiertes Sicherheitsleck | heise online
The notice says an English version is available and was translated with technical assistance and editorially reviewed.
Spotify seeks a Security Engineer for Product Security to improve vulnerability remediation, using agentic AI workflows and tools to deliver reliable, safe code fixes for engineering teams.
Translated title. Original: Sicherheitslücke: Was die PHP-Sicherheitslücke für das Internet bedeutet
A severe PHP security flaw prompts urgent warnings from Germany's BSI and international experts; the document presents the key questions and answers about the risk and guidance. Berlin is noted as the context.
Azul issues security-only OpenJDK updates to fix 53 CVEs, aiming for rapid, regression-free deployment. The report links AI-driven speed of flaw discovery and exploitation to shorter patch windows and highlights Azul's unique security-only update approach contrasted with other distributions.
Researchers reveal a first-of-its-kind supply-chain vulnerability in OpenAI's official skills repository, where trusted skills—contributed or vetted by verified vendors—are used to teach AI agents how to interact with various platforms and services.
The document identifies a SQL injection vulnerability in a GET /api/users endpoint where the search parameter is directly interpolated into a SQL query, enabling cross-tenant data access; reproduction demonstrates that a crafted input yields all users, with the vulnerability located in users-repository.ts:42.