We are now seeing php2shell exploited in the wild at scale. Most of the attacks we observe abuse PHP's session upload-progress path, and we expect more exploit paths to appear before and after the fix ships.
Search
15 results for “ssvc”
-
Cisco released 14 security advisories. Given that no one cares about anything but php2shell, I'm happy to say that these were not exploited and are not important right now.
https://sec.cloudapps.cisco.com/security/center/publicationListing.x
-
watchTowr is observing active exploitation attempts of both CVE-2026-109618 and CVE-2026-109619.
https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
-
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.
-
Notices 353 security fixes in Chrome
OwO what's this?https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
No zero-days at least, but this amount of CVEs in one patch appears to be the new normal.
-
Get ready for PHP security updates tomorrow to address CVE-2026-109618 and CVE-2026-109619 (the leaked RCE CVEs with CVSSv4 9.2 scores)
https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018/ -
Educated guess placeholder: 6 for the KEV
-
Symantec: APT28 (GRU Unit 26165) Targets Defense Firms in Two NATO Countries
https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
-
"Threat actor? In my Siemens? It's more likely than you think"
Siemens has reported that CVE-2026-110936 is being exploited in the wild.
https://www.cyber.gc.ca/en/alerts-advisories/siemens-security-advisory-av26-1063
-
Active Exploitation of CVE-2026-110936 in Siemens Software Center
Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.
Attributed to Romulus multi-platform ClickFix campaign, this advisory contains IOC
-
For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:
https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/
-
Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
- CVE-2026-96652 (5.3 med) Plex Media Server SSRF
- CVE-2026-96654 (6.9 med) Plex Media Server URL injection
- CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
- CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write
-
SiteGuard exploited zero-day: CVE-2026-106931 (CVSS4: 8.5 high) SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
English translation:
A vulnerability (CVE-2026-106931) allowing OS command injection has been discovered in the statistics function of SiteGuard Server Edition. Exploitation has already been confirmed.
-
@todb ?? Rejected Reason: This CVE ID was unused by the CNA.