DualScope insights
Public-source assessments, clear uncertainties and practical defensive guidance.
11 articles
The PHP project disclosed two critical remote-code-execution vulnerabilities on October 21. Fixed upstream branches begin at 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Apache mod_php and PHP-FPM have different demonstrated attack conditions; neither a WAF nor an application-framework upgrade substitutes for a patched runtime.
Eight eMudhra intermediate CA certificates have compromised private keys, according to the certifi advisory. Attackers who can intercept a connection may impersonate services to clients that still accept the affected chains. The response must reach application bundles and container images as well as browsers.
CISA added CVE-2026-59310 on 18 August 2026. Its record says a network-reachable VMware vCenter path traversal vulnerability could allow code execution and records known ransomware campaign use as known.
CISA added CVE-2026-45659 to KEV on 1 July 2026. Its record describes SharePoint Server deserialization of untrusted data that allows an authorised attacker to execute code over a network.
CISA added CVE-2026-35273 on 12 June 2026 and describes missing authentication for a critical PeopleSoft Enterprise PeopleTools function that could permit takeover.
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on 29 May 2026. CISA describes an authentication bypass in PAN-OS that can establish an unauthorized VPN connection.
Device code phishing does not need the user's password. It convinces the user to complete a legitimate Microsoft sign-in flow that authorizes the attacker's session. The defensive lesson is uncomfortable: MFA can be present, successful and still produce a compromised token if the wrong flow is allowed in the wrong context.
CISA, the UK NCSC and Cisco describe FIRESTARTER as persistence on Cisco Firepower and Secure Firewall devices running ASA or FTD software. The operational lesson is sharp: if the public indicator is present, an upgrade alone is not enough; Cisco recommends reimaging and upgrading to fixed releases, while a physical cold restart is only a risky temporary mitigation.
DualScope separates raw cybersecurity feeds from reviewed summaries. This article explains the source mix, why official advisories matter, how CISA KEV is used, and what common acronyms mean before they become shorthand in the rest of the site.
Vercel says attackers used access connected to Context.ai to reach internal systems and enumerate non-sensitive environment variables. The deeper lesson is that Open Authorization (OAuth) grants, artificial intelligence (AI) productivity tools, browser sessions and developer platforms now form one connected attack surface.
Reports on the March 2026 Stryker incident describe global disruption, wiped employee devices, and a possible Microsoft Intune remote-wipe path. The lesson is broader than one company: endpoint-management consoles are powerful administrative planes, and destructive actions need stronger guardrails than ordinary helpdesk workflows.