When you can patch PHP2Shell depends on your PHP version: 8.2–8.5: today 7.4–8.1: source backports only 5.4–7.3: nothing from the PHP project ~48% of PHP sites have no full release to upgrade to. How to cover the wait 👇

PHP2Shell (CVE-2026-109618/109619): Unauthenticated attackers can run code on a PHP server. No login, no vulnerable app code needed. Patch now: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older: no fix from the PHP project. php.net/archive/2026.php#202…

What is bot detection, in 30 seconds? 🤖 It's how your site tells real visitors from automated ones before they can scrape your content, buy out your stock, or hammer your login page. CrowdSec's WAF Bot Detection does it with fingerprinting and proof of work, without getting in the way of real customers. Watch the quick explainer 👇 Set it up: docs.crowdsec.net/docs/appse… #WAF #botdetection #cybersecurity #opensource

Console notifications now go straight to your inbox. 📨 Notification rules now support email, so you can create a rule without connecting Slack or Discord first. Set a rule, add your address, done. Set up your first rule: app.crowdsec.net/notificatio… Available on Premium.

CrowdSec saw the first requests matching CVE-2026-88771 on September 22, five days before Citrix published it with a fix (and before @watchtowrcyber shared details). It's a CVSS 9.5 flaw in NetScaler ADC and Gateway: no login, default configuration, root on the box. Our signal counts are low, but don't read that as low risk. Careful operators pick their targets first, and two of the addresses we saw went after this CVE and nothing else. Patching won't remove anyone already inside. The full story is in this week's Threat Alert 👉crowdsec.net/vulntracking-re… #cve #cve202688771 #threatalert #cybersecurity

Two visitors hit your site. Same browser, same clicks, same speed. One of them is a bot. Which one? CrowdSec 1.8's WAF can tell, and on October 29, our experts will show you how, live, along with everything else in 1.8. 📅 October 29, 4 PM CET Get a reminder → youtube.com/live/rHKs3yAquQo #webinar #WAF #botdetection #cybersecurity

5 years of data science at CrowdSec, told by Matthieu Mazzolini (Data Team Lead). How do we count our network? Why do we run honeypots, and why only 30? Why are there canaries in our blocklists? And why does the team call malicious IPs "pokemons"? 🙂 An honest look behind our IP reputation, and at what our code really shows, from one of the people who builds it. Read it here: crowdsec.net/blog/5-years-of… #datascience #threatintelligence

The holiday season brings a predictable increase in malicious bot activity, from scraping and scalping to more aggressive attacks. With Black Friday and Christmas approaching, now is a good time to make sure your infrastructure is ready. 🤖 CrowdSec’s bot detection uses fingerprinting and proof of work to distinguish legitimate users from unwanted bots, helping you protect your applications without getting in the way of real customers. Handle distributed attacks, scraping, scalping, and other aggressive automation with a production-ready approach. Learn more → docs.crowdsec.net/docs/next/… #WAF #botdetection #opensource

🚨 CVE-2026-21589 is a critical Atlassian file-read vulnerability in Jira, Confluence, and Bitbucket Data Center, already being targeted in the wild. CrowdSec has tracked 89 unique IPs sending matching requests since October 7. Patching closes the hole. But if your instance was exposed, rotate the Crowd application password and check your Jira admin accounts. Read the latest Threat Alert article to get the analysis → crowdsec.net/vulntracking-re… #cve #cve202621589 #threatalert #Atlassian #Jira #Bitbucket #Confluence

CVSS, EPSS, and KEV tell you which vulnerabilities might get exploited. The Live Exploit Tracker shows you which ones are being exploited right now. It's built on live attacks seen across 250K+ machines in the CrowdSec network. With it, you can: - patch the CVEs that are actually being exploited first (it tracks 700+ of them, across 100+ vendors) - block the IPs exploiting them, with a feed updated several times an hour - plug that Blocklist into what you already run: your CDN, firewall, or cloud provider See it live → crowdsec.net/live-exploit-tr… #vulnerabilitymanagement #threatintelligence