The Exploit HQ

Cybersecurity made practical. Daily threat briefs, clear patch priorities, and safe hands-on demos for beginners. Learn what matters and what to do

[The Exploit HQ @TheExploitHQ]

New to cybersecurity? Start here.

The Exploit HQ helps you understand:
• Which threats matter
• What to patch and why
• How security tools work through safe demos

Follow for clear explanations and practical next steps.

Watch: https://t.co/oU59XHavkT

[The Exploit HQ @TheExploitHQ]

OpenHands sandbox ports exposed root commands. Check your deployment. #OpenHands #VulnCheck #Docker #Apptainer #Cohere #Alibaba #Qwen #Microsoft #DeepSeek #UniversityOfRochester
https://t.co/Jxd7fxCGN0

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/vtvrIPqVVF

Primary sources:
- PHP: https://t.co/DCQGlfBgW0

[The Exploit HQ @TheExploitHQ]

[!] PHP: active exploitation confirmed.

Federal agencies must remediate both vulnerabilities under BOD 26-04, and all organizations should prioritize patching them.

[!] ACTIVELY EXPLOITED
- PHP - CVE-2026-109618, CVE-2026-109619 (CISA KEV)

[!] DEVELOPING
- Wiz Research reported on Gheist, an automated campaign mass-abusing compromised GitHub tokens to exfiltrate secrets via GitHub Actions workflows
- CISA unveiled its CISA 2030 strategic plan to transition toward an aggressive, anticipatory posture protecting critical infrastructure

[>] Full 5-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

@OpenAI We need to see how this new model will work on both sides of cybersecurity (red and blue teams).

[The Exploit HQ @TheExploitHQ]

Gheist steals GitHub secrets. Revoke tokens; rotate secrets. #Wiz #GitHub #Anthropic #HuggingFace #Groq #NVIDIA #AWS #Amazon #Google #Microsoft #HashiCorp #IBM #Xinference #Xorbits #Unitree #Leon #VulnCheck
https://t.co/dUvgCBMNjs

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/kb9dcoUzhW

Primary sources:
- Arista VeloCloud Orchestrator: https://t.co/90gHXGe7tU
- Collabora Online Built-in CODE Server for Nextcloud: https://t.co/90gHXGe7tU

[The Exploit HQ @TheExploitHQ]

[!] Arista VeloCloud Orchestrator: active exploitation confirmed.

Upgrade to a fixed VCO release as soon as possible and preserve logs if compromise is suspected.

[!] ACTIVELY EXPLOITED
- Arista VeloCloud Orchestrator - CVE-2026-114625 (CISA KEV)
- Collabora Online Built-in CODE Server for Nextcloud - CVE-2026-110447 (CISA KEV)

[!] PATCH NOW
- JPCERT/CC updated its security alert warning that proof-of-concept exploit codes and communications attempting exploitation have been observed for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

[!] DEVELOPING
- JPCERT/CC warned that an out-of-bounds write vulnerability in Google's Brotli C implementation can cause application crashes, memory disclosure, or arbitrary code execution (CVE-2026-111497)

[>] Full 6-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

[!] Collabora Online / Nextcloud CODE Server: active exploitation confirmed.

Update the Collabora Online Built-in CODE Server (richdocuments) app to version .303 or later immediately.

[!] ACTIVELY EXPLOITED
- Collabora Online / Nextcloud CODE Server - CVE-2026-110447 (CISA KEV)
- Arista VeloCloud Orchestrator (VCO) On-Prem - CVE-2026-114625

[!] PATCH NOW
- Palo Alto Networks confirmed that PAN-OS firewalls and Panorama management appliances are affected by PHP2Shell vulnerabilities, with fixes in upcoming releases (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560)

[!] DEVELOPING
- CISA warned that InterSystems IRIS for Health has TLS/SSL encryption disabled by default, allowing attackers to intercept transmitted data and log in (CVE-2026-111594)

[>] Full 6-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

LiteLLM 1.107.0 shipped credential-stealing malware. Rebuild affected environments and rotate exposed secrets. #LiteLLM #GitHub #Docker #AWS #Amazon #BerriAI
https://t.co/ZblHPJOq71

[The Exploit HQ @TheExploitHQ]

@ollama This is why local matters: redaction tools miss things. We demonstrated that with a fictional support ticket and a local Ollama workflow on The AI Security HQ. Redact, keep inference local, check the output, then get human approval.

https://t.co/DvctvN5itc

[The Exploit HQ @TheExploitHQ]

@NetworkChuck I've used it for several months and it's been getting dumber

[The Exploit HQ @TheExploitHQ]

@claudeai Is not who made it first, is who make it better than the others.

[The Exploit HQ @TheExploitHQ]

ARTEX targets vendors. Review sign-in logs. #Wiz #Microsoft #Baidu #GitHub #Zscaler #Okta #Amazon #AWS #Anthropic #Theorem #HiddenLayer #TogetherAI #FireworksAI #LiteLLM #BerriAI #OpenAI #VirusTotal #Google #NVIDIA #Tencent #Cisco #Cline #Ollama
https://t.co/SqHy953c2J

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/rstUt8qvVR

Primary sources:
- Siemens Software Center: https://t.co/sPM4of68uH
- Arista VeloCloud Orchestrator (VCO) On-Prem: https://t.co/yfMQRFteHq

[The Exploit HQ @TheExploitHQ]

[!] Siemens Software Center: active exploitation confirmed.

Update Siemens Software Center to the latest version and inspect AppData directories for unauthorized binaries.

[!] ACTIVELY EXPLOITED
- Siemens Software Center - CVE-2026-110936 (CISA KEV)
- Arista VeloCloud Orchestrator (VCO) On-Prem - CVE-2026-114625

[!] PATCH NOW
- The PHP Group released emergency security updates fixing two critical unauthenticated remote code execution vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

[!] DEVELOPING
- ConnectWise confirmed unauthorized access to application credentials for Cloud Backup, attributing the incident to a China state-aligned group using agentic AI
- Microsoft Threat Intelligence reported that Chinese state-aligned group Storm-0940 leveraged the ARTEX agentic AI framework to automate attacks following a ConnectWise supply-chain compromise

[>] Full 7-min brief with sources in the first reply.

#CyberSecurity #ThreatIntel

[The Exploit HQ @TheExploitHQ]

https://t.co/L8JkwXgA8V

[The Exploit HQ @TheExploitHQ]

PHP2Shell is under attack. Patch now. #PHP #Wiz #OpenAI #Calif #Amazon #AWS #Cloudflare #LiteLLM #BerriAI #Docker #GitHub #Microsoft #ConnectWise #NVIDIA #Anthropic #Cisco #CrowdStrike #Dell #Google #HPE #IBM #Meta #PaloAltoNetworks

https://t.co/JunhRYBxth

[The Exploit HQ @TheExploitHQ]

Full brief, chapters and every primary source:
https://t.co/NGu8S7OGry

Primary sources:
- PHP: https://t.co/OBCMnXXkKC
- Palo Alto Networks PAN-OS: https://t.co/zDti5PACNk
- Plex Media Server / EG Secure Solutions SiteGuard / Siemens Software Center: https://t.co/PZnvWMzNWq
- SafePay Ransomware Group: https://t.co/rKIjaVUSQt

[The Exploit HQ @TheExploitHQ]

CISA issued an alert strongly urging organizations to immediately patch critical php2shell remote code execution vulnerabilities in PHP.

Immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or take unpatched PHP-based web systems offline.

[!] ACTIVELY EXPLOITED
- PHP - CVE-2026-109618, CVE-2026-109619 (remote code execution)
- Palo Alto Networks PAN-OS - CVE-2026-0257 (CISA KEV, ransomware) - Plex Media Server / EG Secure Solutions SiteGuard / Siemens Software Center - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-106931, CVE-2026-110936 (CISA KEV)
- SafePay Ransomware Group - CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 (ransomware)

[!] DEVELOPING
- The Node.js project announced security releases resolving a high-severity out-of-bounds write vulnerability in its Brotli decoder permitting remote code execution (CVE-2026-111497)
- Microsoft Threat Intelligence reported that Chinese state-aligned group Storm-0940 leveraged the ARTEX agentic AI framework to automate attacks following a ConnectWise supply-chain compromise

[>] Full 9-min brief with sources in the first reply. #CyberSecurity #ThreatIntel #Microsoft #Node #SafePay #PHP #php2shell

[The Exploit HQ @TheExploitHQ]

@kalilinux https://t.co/LtSMi49TbF