ISSUE OCT 27 · 2 FRONT-PAGE STORIES
Every artifact
leaves a trail.
Weekly threat briefings, hands-on write-ups, open-source tools and a field kit for digital forensics.
Read this week's briefingNEXT BRIEFING — · TUESDAYS
THIS WEEK'S BRIEFING
Four CVEs. One under active attack.
The October 27 issue: front-page stories, priority CVEs, a malware spotlight, cases from the archive and new tools.
WEB INFRASTRUCTURE CVE-2026-109618, a memory corruption bug, and CVE-2026-109619, a stale internal request-state bug, each give unauthenticated remote code execution at CVSS v4 9.2.
READ THE FULL ISSUE → | Item | Section | Detail |
|---|---|---|
| PHP2Shell | Front page | CVSS 9.2 ×2 |
| Eight Keys Anyone Could Have Computed | Front page | Trust Infrastructure |
| CVE-2026-111497 | Priority CVE | Critical |
| CVE-2026-110447 | Priority CVE | Active Exploit |
| ARTEX | Malware spotlight | Case study |
| Shellshock · DigiNotar | Archive | 2014 · 2011 |
| VPNFilter · Code Red | Archive | 2018 · 2001 |
| ALEX · CapLoader · ORISA | Tools | + Obliterator 3 |
CASE LOG
Everything written here.
Newsletter stories, long-form Substack write-ups and blog posts, newest first.
WEB INFRASTRUCTURE PHP2Shell PHP2Shell: Two Pre-Auth Flaws in the Runtime Underneath Most of the Web, Disclosed by an Embargo That Broke Early CVE-2026-109618, a memory corruption bug, and CVE-2026-109619, a stale internal request-state bug, each give unauthenticated remote code execution at CVSS v4 9.2. CISA's assessment is that they affect every PHP installation serving web requests — mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed — with mod_php carrying the highest risk. The embargo broke on October 20, ahead of the planned coordinated release; PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 the following day, CISA issued an alert the same day, and both CVEs reached the KEV catalogue on October 26 with an October 29 remediation date. Unsupported branches, PHP 5 among them, are reported affected with no fix coming. TRUST INFRASTRUCTURE Eight Keys Anyone Could Have Computed Eight Keys Anyone Could Have Computed: A Flawed Key Ceremony Put Weak eMudhra Intermediates Into Every Trust Store Private keys for eight eMudhra intermediate CA certificates are compromised — not stolen, but weak enough to derive. eMudhra attributes this to a flaw in its April 2025 key ceremony that produced a second, weak set of keys, and it was that set which went to the browser root programmes; published analysis describes each P-384 private value as below 256, recoverable from the public certificate in under a second. A researcher reported it to the root programmes on the evening of October 17 and it became public on October 20. Chrome and Firefox blocked the intermediates from October 17, Apple from October 19 and Microsoft from October 20. 
ChronosFracture: Why I Built My Own Supertimeline Tool Using AI to build my own tools with modern technologies 
The Day "Skynet" Began Forensic look into the AI launched end-to-end operation for ransomware 
Do As I Say, Not As I Do: CISA, GitHub, and the Very Human Problem of Secrets This is the type of cybersecurity story that makes everyone in the field glare in amazement before they even get through the headline. 
Combining Transformers: The Ultimate Podman Forensics Box "Fusing REMnux and SIFT into a Single, Deployable Noble Workhorse" 
Capturing VM Memory with VirtualBox debugvm and Converting ELF to Raw Format Introduction 
Deploying Your Static Site to Azure: Static Web Apps vs Storage Blobs (And Why I Left Azure Front Door Behind) Hidden costs and infrastructure issues with Azure AFD for Static Sites 
CI/CD Github Pipeline to Azure Blob Storage Keeping your static site update with just a push 
Deploying My Astro Static Site with Azure Adventure to figure out where to deploy 
Forensic Timelining Different method to creating a timeline 
Creating Github-Page is a Pain My method of getting this site to work. 
Getting Started with Astro Learn how to build static sites with Astro's modern web development framework.
ChronosFracture: Why I Built My Own Supertimeline Tool Using AI to build my own tools with modern technologies The Day "Skynet" Began Forensic look into the AI launched end-to-end operation for ransomware Do As I Say, Not As I Do: CISA, GitHub, and the Very Human Problem of Secrets This is the type of cybersecurity story that makes everyone in the field glare in amazement before they even get through the headline. Combining Transformers: The Ultimate Podman Forensics Box "Fusing REMnux and SIFT into a Single, Deployable Noble Workhorse" Capturing VM Memory with VirtualBox debugvm and Converting ELF to Raw Format Introduction Deploying Your Static Site to Azure: Static Web Apps vs Storage Blobs (And Why I Left Azure Front Door Behind) Hidden costs and infrastructure issues with Azure AFD for Static Sites CI/CD Github Pipeline to Azure Blob Storage Keeping your static site update with just a push Deploying My Astro Static Site with Azure Adventure to figure out where to deploy Forensic Timelining Different method to creating a timeline Creating Github-Page is a Pain My method of getting this site to work. Getting Started with Astro Learn how to build static sites with Astro's modern web development framework. FIELD KIT
Tools for the thing you investigate.
16 hand-picked resources across 5 disciplines, plus 6 Linux distributions built for the job. Open the full library →
FROM THE LAB
Built here. Open to everyone.
FLAGSHIP ChronosFracture Shattering the 1:10 barrier. A high-velocity alternative to Plaso for the modern IR landscape PYTHON REPOSITORY Other-Useful-Tools A collection of tools useful for minimal tasks PYTHON REPOSITORY forensic-toolbox A comprehensive Python toolbox for parsing Windows forensic artifacts including Registry hives, Prefetch files, Windows shortcuts (.lnk files) and WIndows Event Logs (.evtx). PYTHON
THE FREE COURSE
Every case has a method. Learn it.
OPEN THE COURSE → 01 / ACQUIRE Capture it without changing it Imaging, hashing and file systems: how NTFS, ext and APFS actually store your evidence. 02 / ANALYZE Read what the system remembers Windows, Linux, memory, network, mobile, email and browser artifacts, and malware. 03 / REPORT Turn the trail into a timeline Timeline building, reporting and advanced topics to take a case from evidence to findings.
STAY ON THE CASE
Free to follow. Pick your depth.
WEEKLYSTART HERE The Briefing Free · every Tuesday
- Front-page stories
- Priority CVE advisories
- A historic case from the archive
- New tools worth trying
LONG-FORM Practical Forensics Free · on Substack
- Tool builds like ChronosFracture
- Memory capture walkthroughs
- Lab setups and lessons learned
BEFORE YOU START
Questions, answered.
When does the newsletter come out?
Every Tuesday. Each issue has front-page stories, priority CVEs, a historic case study and new tools.
How do I submit a malware sample?
Package it in a password-protected ZIP or 7z (password: infected) and send it through the Submit Malware page. You can then follow it on the tracking board.
What do I need to set up a lab?
A machine that can run a virtual machine. Any of the distributions in the field kit, such as SIFT, Tsurugi or CAINE, gives you a ready-made lab.
Can I suggest a resource?
Yes. Use the suggestion link at the bottom of the resources library.