News

What is new and what to learn from it: plain-language briefs on new vulnerabilities, with how to check your own site and what to patch, and HackerGPT release notes.

• Cybersecurity news this week: SSHole, AI attack agents and two supply-chain breaches

  The security news of 2–9 November 2026 that still matters: an OpenSSH bypass attacked the day after its fix, seven additions to CISA's exploited list, AI agents attacking on their own, and two supply-chain breaches. What happened, and what to check on your own systems.

• CVE-2026-109618

  PHP2Shell (CVE-2026-109618, CVE-2026-109619): What Happened and What to Patch

  Two unauthenticated remote code execution bugs in PHP itself sent governments offline on 21 October 2026. What went wrong inside PHP, why a third of PHP sites have no official fix, how to check your own servers, and what to do today.

• CVE-2026-111497

  HTTP2Shell (CVE-2026-111497): Is Your App Affected, and What to Patch

  A memory-corruption bug in the Brotli decoder, disclosed on 21 October 2026, reaches Node.js, Python HTTP clients, curl and proxies. How it works, how to check your own app in five minutes, and which versions fix it.

• HackerGPT 0.5.7: Stateful CTF Engagements, Concurrent Steering, and Decoupled Browsing

  Explore the latest HackerGPT update featuring stateful memory for CTF engagements, concurrent task steering, and a decoupled, low-latency browsing engine.

• HackerGPT 0.5.0: Advancing Applied Security Training with CTF Mode

  Discover HackerGPT 0.5.0's new CTF Mode. Learn how headless browser automation, traffic interception, and payload management streamline security training.

• Independence from OpenAI

  Today marks a memorable milestone for HackerGPT. We released the Lite version that is self-sufficient. We no longer rely on OpenAI API to answer questions for our users.