This week, we dive into PHP2Shell, a critical PHP exploit chain that has gone from proof-of-concept to active exploitation, with attackers reportedly compromising 25 servers, including enterprise firewalls.
We break down the technical details behind CVE-2026-109618 and CVE-2026-109619, exploring how attackers exploit PHP memory corruption, bypass Address Space Layout Randomisation (ASLR), manipulate function pointers and chain vulnerabilities to achieve remote code execution and root access. We also examine how suspected Chinese-linked attackers used these techniques to breach firewall infrastructure and pivot towards Active Directory.
Next, we investigate a major TLS certificate security failure, where eight certificate authority keys were generated with dangerously weak cryptographic values, potentially allowing attackers to forge trusted digital certificates and impersonate legitimate services.
Finally, we head into orbit, where a commercial satellite has photographed China's secretive Shenlong spaceplane, raising fascinating questions about orbital surveillance, satellite tracking and the growing role of space in national security.
In this episode: PHP2Shell, remote code execution (RCE), ASLR bypasses, Linux privilege escalation, Active Directory attacks, TLS certificate vulnerabilities, cryptography, and space-based intelligence.
Technical cybersecurity news explained so you can understand not just what happened, but how the technology and attacks actually work.
Thanks for listening.
Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.
For contact or story tips, email: [cyberinvestigationsau@gmail.com](mailto:cyberinvestigationsau@gmail.com)
Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.
