22nd Oct 2026
Critical PHP vulnerabilities: our infrastructure is patched
On 21 October 2026 the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They can allow an attacker to run code on a server without logging in, through any PHP that serves websites: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
Status at MMITech
Our ...
11th Aug 2026
Infrastructure fully patched against Zapscape, SCTPhantom and TONTOU vulnerabilities
In early August 2026, five security advisories were published affecting the Proxmox platform and the Linux kernel:
Zapscape (CVE-2026-64561, PSA-2026-00036-1), a use-after-free in the shadow MMU emulation code of KVM on x86_64. Under the right nested virtualization conditions, a privileged attacker inside a guest can corrupt host kernel memory, ...
26th Jul 2026
Infrastructure fully patched against GhostLock and IPv6 fragmentation kernel vulnerabilities
Two further serious Linux kernel vulnerabilities were publicly disclosed in early July 2026: GhostLock (CVE-2026-43499), a use-after-free in the kernel futex priority-inheritance code that lets any unprivileged local user gain root and escape containers, disclosed with a working proof of concept as part of the IonStack research series, and ...
10th Jul 2026
Infrastructure fully patched against Januscape and Bad Epoll kernel vulnerabilities
On 9 July 2026, two high-severity Linux kernel vulnerabilities were publicly disclosed: Januscape (CVE-2026-53359), a KVM guest-to-host escape affecting both Intel and AMD systems, and Bad Epoll (CVE-2026-46242), a local privilege escalation with a public proof-of-concept exploit.
We treated both with the highest priority. Our entire ...
