Tech news · by Ledgi Tech
Curated and fact-checked every morning by the Ledgi Tech newsroom — led by the five stories that matter most to IT teams, each with an analysis of why it matters.
Two days after emergency patches for the critical PHP2Shell bugs, PHP warned of a separate, unpatched code‑execution path (CVE-2026-115560) that requires an uncommon runtime configuration. No...
Attackers compromised LiteLLM’s release pipeline and published a tainted 1.107.0 release to PyPI and Docker that executes before application startup to steal credentials and secrets across...
VulnCheck says it has crafted an exploit for the PHP2Shell flaw (CVE-2026-109618) that achieves remote code execution on ASLR-enabled x86-64 systems running PHP’s recommended production...
GitLab has released emergency updates to Community and Enterprise Edition addressing a dozen issues, including a critical integer overflow (CVE-2026-110264) that could let an unauthenticated...
Netflix has introduced a workload attestation design that lets Apache Spark jobs on Amazon EMR swap their AWS IAM execution role for a short‑lived internal identity issued by its Metatron PKI,...
Kaspersky reports that North Korea’s Lazarus Group is using the NIST-standardized ML-KEM post-quantum cryptographic mechanism to shield command-and-control traffic and payload delivery in a new...
Google is rolling out new Chrome protections under Safe Browsing’s Enhanced Protection that use Gemini to flag deceptive sites and warn users when they copy suspicious commands associated with...
Security firm Claroc found that shared Muse conversations could be discovered at scale via passive DNS because conversation titles were embedded in subdomains under cf.metaaiusercontent.com. Meta...
Japan’s Onamae Desktop Cloud, operated by GMO Internet, confirmed an intrusion in which an unauthorized party installed malicious programs on customer servers, potentially affecting up to 26,739...
Indian certification authority eMudhra said a flaw during an April 2025 key generation ceremony caused ultra-weak private keys — including ones as trivial as the number “4” — to be published to...
Microsoft says state-aligned group Storm-0940 used the ARTEX agentic AI framework to automate reconnaissance, password spraying, and OAuth abuse at 'machine speed' in a supply chain compromise of...
GitLab has issued critical fixes for CVE-2026-110264, a CVSS 10.0 flaw that can enable unauthenticated remote code execution on self-managed servers across all releases since 7.0 (2014). The bug...
Curated daily by the Ledgi Tech newsroom — ledgi.tech