Remote profile

A new CVSS 10 unauthenticated RCE just dropped in self-managed GitLab (different flaw than the October 12 patch), PHP's critical vulnerability is still being actively exploited, and eMudra — a trusted certificate authority — was caught issuing TLS certs signed with keys as weak as the number 4.

Jake and Jess break down what to patch now, why 'no evidence of exploitation yet' isn't a defensible position, and a simple framework for prioritizing patches without turning everything into a fire drill.

Watch: https://youtu.be/ngXN3PGOCeY

@malwarejake @Secitup

Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates as high as a CVSS 10. On today's Breach Please, Richy fills in for Jake and joins Jess to break down why these bugs hit vendor appliances hardest, how to actually hunt down PHP you didn't know you had without a reliable CMDB, and their one real disagreement: wait for the CISA KEV, or patch now if you're internet-facing?

@malwarejake @Secitup

Watch: https://youtu.be/ocIIAfLlfIM