CybersecurityOS

🛡️ Building the operating system for cybersecurity careers. Trusted by 30K+ learners. Clear roadmaps. Practical skills. Free access ⬇️

[CybersecurityOS @cybersecurityos]

❌Stop collecting advice.
✅Start building clarity.

Practical operating systems, playbooks, and coaching to think, lead, and win in cybersecurity; whether you’re breaking in, stepping up, or securing a growing business.

Find your path + Get the free toolkit

https://t.co/IsSoRcyDIa

[CybersecurityOS @cybersecurityos]

Security leaders: your awareness training isn't failing because people are careless.

It's failing because it's annual, generic, and 45 minutes long.

Short. Monthly. Role-specific.

Resources I use: https://t.co/u2maL5iCWI

[CybersecurityOS @cybersecurityos]

😅😅😅DRAAAAAKKKKEEEE

[CybersecurityOS @cybersecurityos]

Urgent: Railway Security Disclosure - Rotate Credentials

https://t.co/bojsWOmgjM

What you should do

Immediately revoke and reissue all environment variables, including any API keys, stored in Railway.

If you have any credentials on an external registry

Review logs for those services for unusual activity.

[CybersecurityOS @cybersecurityos]

More CVEs ≠ more risk.

Discovery isn't exploitation.

Analysts who can explain that difference to leadership get promoted. The ones who panic at the totals don't.

I break down what actually matters every Sunday. Free: https://t.co/5kkpJpiRF8

[CybersecurityOS @cybersecurityos]

❌Stop collecting advice.
✅Start building clarity.

Practical operating systems, playbooks, and coaching to think, lead, and win in cybersecurity; whether you’re breaking in, stepping up, or securing a growing business.

Find your path + Get the free toolkit

https://t.co/IsSoRcyDIa

[Cloudflare Developers @CloudflareDev]

⚠️ Vulnerability alert: php2shell

Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.

If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default.

Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.

https://t.co/3xLjlkUX8u

[Tib3rius @0xTib3rius]

This week.

[CybersecurityOS @cybersecurityos]

PHP2Shell: What We Know About CVE-2026-109618 and CVE-2026-109619, and What to Do Today https://t.co/C85oMwVyhh via @cybersecurityos

[CybersecurityOS @cybersecurityos]

More CVEs ≠ more risk.

Discovery isn't exploitation.

Analysts who can explain that difference to leadership get promoted. The ones who panic at the totals don't.

I break down what actually matters every Sunday. Free: https://t.co/5kkpJpiRF8

[ProjectDiscovery @pdiscoveryio]

We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them.

Commands plus prompts for your coding agent.

We also started https://t.co/cS3OLalm2K

It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.

Read: https://t.co/NulWPp67qo

[CybersecurityOS @cybersecurityos]

Urgent: Railway Security Disclosure - Rotate Credentials

https://t.co/bojsWOmgjM

What you should do

Immediately revoke and reissue all environment variables, including any API keys, stored in Railway.

If you have any credentials on an external registry

Review logs for those services for unusual activity.

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[Juraj Bednar🏴💛🌘 @jurbed]

I highly recommend cloudflare's security audit skill: https://t.co/Mu6Dm0fzk8

Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.

[Burp Suite @Burp_Suite]

🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.

Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:

🟧 ActiveScan++ v2.0.13 (https://t.co/fkhECQ6wtD)
🟧 Bambda scan checks (https://t.co/PxPcj5uDYX)
🟧 BChecks (https://t.co/i8c8WiDnvb)

Start scanning for the vulnerability now → https://t.co/fkhECQ6wtD

[CybersecurityOS @cybersecurityos]

😅😅😅DRAAAAAKKKKEEEE

[bluehuecat @bluehuecat]

#PHP2Shell

[Wiz @wiz_io]

AI tools helped find one of the most severe online bugs ever #php2shell

In our latest episode of Crying Out Cloud, Amitai Cohen sits down with @sagitz_ (Wiz Research) and Thai Duong (@calif_io) to unpack the massive PHP2Shell vulnerability

https://t.co/n4pfiXjDNC

[The Hacker News @TheHackersNews]

‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge.

The flaws can enable unauthenticated code execution and expose server memory.

👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619)

Details ➜ https://t.co/jJT7p6lala

[CybersecurityOS @cybersecurityos]

What's one thing you wish you knew before starting in cybersecurity?

Drop it below. Someone just starting needs to read it.

[CybersecurityOS @cybersecurityos]

What's one thing you wish you knew before starting in cybersecurity?

Drop it below. Someone just starting needs to read it.

[Wiz @wiz_io]

🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.