PHP2Shell leaks sparked a scramble for answers.
VulnCheck reproduced what we believe are both flaws Oct. 20 and has monitored activity since, observing a failed webshell attempt from a China-based IP.
Research, IOCs and guidance. More updates to come: vulncheck.com/blog/php2shell…
1
913
Old indicators, newer threats.
VulnCheck examined IOCs from a joint advisory on Flax Typhoon-linked activity, uncovering more recent exploitation and shared botnet infrastructure connecting one listed IP to 177 additional IPs.
vulncheck.com/blog/integrity…
3
5
287
ICYMI, VulnCheck analyzed CVE-2026-76504, an exploited Cisco SD-WAN vManage zero-day that lets attackers gain admin access without valid credentials.
Landon Rice breaks down the exploit and detection resources.
vulncheck.com/blog/revenge-o…
4
5
555
ICYMI: VulnCheck’s Kimber D. joined @runZero’s podcast to talk vulnerability disclosure, separating valuable insights from noise, hacker meetup stories and more.
Listen here: runzero.com/resources/runzer…
2
154
Attackers move on their own timeline. VulnCheck’s exploit intelligence helps security teams keep up.
At GovWare in Singapore? Meet our team at Booth B25, Oct. 13–15, to talk about how defenders can act sooner.
Learn more about VulnCheck: vulncheck.com/
1
199
VulnCheck is headed to CyberCon 2026 in Melbourne as a Bronze Exhibitor! Stop by Booth #017 to meet the team and talk exploit intelligence.
October 14-16, 2026 in Melbourne, AU
Details: melbourne2026.cyberconferenc…
3
271
That’s a wrap on the second annual THREATCON1!
Three days of research, tough questions and conversations about helping defenders respond to emerging threats.
Thanks to everyone who made it happen. Stay tuned for podcast episodes, presentations and more!
105
That’s a wrap on day two’s sessions at THREATCON1! Gen. Paul Nakasone (Ret.) opened a day of talks on AI, ransomware, coordinated disclosure, shrinking patching windows and more.
Thanks to our sponsors AWS, Zafran, Carahsoft, Armada and Decipher. On to the afterparty!
137
From ARPANET’s first message and a buffer overflow to CVE and NVD.
At THREATCON1, IBM’s Johnny Shaieb will trace the events, people and changing disclosure culture that shaped modern vulnerability databases.
Explore the history: threatcon1.org/registration
241
At THREATCON1, Intigriti’s Chris Holt will introduce OASIS, a proposed OWASP project combining automated candidate fixes with community validation to produce pull requests maintainers can trust: threatcon1.org/registration
1
110
MCP servers can hold tokens, write files, make outbound requests and execute privileged automation.
At THREATCON1, Pluto Security’s Gil Maman will show how flaws in popular implementations can enable SSRF, arbitrary file writes, account takeover and RCE: threatcon1.org/registration
1
177
Low-quality reports are overwhelming bug bounty programs.
At THREATCON1, Josh Shomo will show how passive data can identify likely exposure without touching a target, and why authorization remains the line between inference and proof.
Register: threatcon1.org/registration
1
120
A handful of suspicious IPs led to a live credential-harvesting operation.
At THREATCON1, VulnCheck’s Adam Powis will show how Canary Intelligence and Target Intelligence traced attacker infrastructure from the first signal to the control plane: threatcon1.org/registration
2
112
More packages than we can count. More vulnerabilities than we can imagine. More malware than we want.
At THREATCON1, Josh Bressers will break down the data behind open source’s biggest challenges, what is being done today and what may come next: threatcon1.org/registration
2
90
“The war room was a coffee mug.”
In a CTF with 6,000+ teams, Rookery ran 36 agents on a laptop and solved 134 of 136 flags by the next morning.
At THREATCON1, Cisco Talos’ Joel Callicrate will show how it thinks, where it breaks and what comes next: threatcon1.org/registration
3
183
Successful exploitation can become reusable operational knowledge.
At THREATCON1, VulnCheck’s Guillermo Menjivar will show how internet canary telemetry becomes insights for detection engineering, threat hunting and incident response.
Register: threatcon1.org/registration
1
1
108
Time-to-exploit is dropping to mere hours. Waiting for active exploitation can leave defenders too late.
At THREATCON1, Adrian Sanabria will present a prioritization framework built from vulnerabilities confirmed to have caused damage or loss: threatcon1.org/registration
140
At THREATCON1, TrendAI’s Taha Siddiqi and Smile Thanapattheerakul will unpack how sandbox failures and flaws like command injection, path traversal and insecure deserialization affect widely used agentic AI platforms.
Register: threatcon1.org/registration
77
No source code. No expert on staff. Just a binary and a deadline.
At THREATCON1, Joe Szczerba will break down real-world reverse engineering and where AI-assisted tools save time, where they do not and where the work still depends on human analysis: threatcon1.org/registration
81
Coordinated disclosure was built for one bug at a time. That world is gone.
At THREATCON1, Patrick Garrity, Tod Beardsley, Shelby Cunningham & @catc0n will get candid about deadlines, vendor silence, undisclosed patches and public PoCs.
Join the panel: threatcon1.org/registration
1
1
130