PHP2Shell exploitation reaches millions of attempts
PHP released emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote-code-execution vulnerabilities affecting PHP installations that serve web requests. Cloudflare says exploitation traffic rose from thousands of attempts before disclosure to millions afterwards.
Why it matters to you
PHP sits beneath many WordPress, Drupal, Joomla and custom SaaS deployments. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, rebuild containers and server images, verify the runtime actually changed and review web, process and outbound-network evidence for exploitation.
Attackers chain four Plex flaws into elevated code execution
CISA warned that attackers are exploiting the Plex2Shell chain against Plex Media Server. The four vulnerabilities can expose an administrator token and progress to elevated code execution; exploitation reports include cryptominer deployment. Versions before 1.43.3.10861 are affected.
Why it matters to you
Home-lab and media servers can become a bridge into trusted networks. Upgrade immediately, remove direct internet exposure, isolate Plex from management and production segments, rotate its token and investigate new libraries, processes, scheduled tasks and outbound connections.
Onamae provider compromise installed malware on up to 26,739 servers
Japan's Onamae Desktop Cloud says an unauthorized party installed malicious programs inside customer server environments. The provider progressively shut down all Desktop Cloud plans, warned that stored data may have been exposed and gave no restart estimate.
Why it matters to you
A clean tenant configuration cannot protect you if the hosting control plane is compromised. Rotate every secret stored on affected servers, rebuild from trusted external images, validate backups outside the provider and maintain a tested route to move DNS, workloads and data elsewhere.
OpenAI models are coming to Google Cloud's enterprise marketplace
OpenAI will offer frontier models including GPT-6 Astra and the Codex coding agent through Google Cloud Model Garden and Marketplace. Customers will be able to use existing cloud commitments and Google's access-control and data-governance services for regulated workloads.
Why it matters to you
A second major distribution route can simplify procurement, but billing portability is not technical portability. Keep prompts, evaluations and tool interfaces provider-neutral; verify retention, regional processing, identity boundaries and whether governance settings follow the model across hosting channels.
New Southeast Asian cable adds 16 fibre pairs on a geopolitically routed path
The US-backed MViSTA subsea cable will link Malaysia, Vietnam, Singapore and Thailand over approximately 2,500 kilometres. Developers expect 16 fibre pairs, a late-2028 launch and a supplier choice between NEC and Alcatel Submarine Networks; the planned route avoids disputed South China Sea areas.
Why it matters to you
International resilience depends on physical route, landing stations, repair access and political exposure—not only advertised capacity. When selecting regional cloud or transit providers, check whether supposedly independent paths share the same cable, landing point or jurisdiction.