AWS Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) starting on October 17, 2026, four days before the public disclosure and patch release on October 21, 2026. Multiple actors used anonymized infrastructure to target honeypots and real systems, with proof-of-concept exploits appearing immediately after the embargo lifted. Fixed PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address these vulnerabilities, with backports available for versions 7.4 through 8.1. The event highlights the shrinking window between patch release and exploitation and the need for proactive detection and investigation starting before public disclosure.
A critical vulnerability (CVE-2026-102785) affects the YOOtheme Pro extension for Joomla versions 5.0.0 through 5.0.52. The flaw involves an unauthenticated remote code execution via an image transformation handler that improperly validates request signatures. Attackers can reuse legitimate signatures to inject additional image operations, traverse directories, and upload a malicious PNG/PHP polyglot file to a publicly accessible media directory.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. These bugs were discovered in August 2026 and patched by PHP on October 21, 2026, with updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Exploitation attempts were detected before and after the patch release, including mass exploitation attempts shortly after fixes were published. Multiple vendors and governments have issued advisories urging immediate patching and thorough discovery of PHP installations, including those embedded in other software. Some organizations temporarily took affected sites offline to mitigate risk. Security firms have released detections and mitigations, and many vendors are reviewing their products for exposure. The vulnerabilities require precise conditions for exploitation but have been actively targeted in the wild.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A missing authorization vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin versions up to 3.1.2. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation information is provided in the available data. There are no known exploits in the wild at this time.
fzf versions 0.36.0 through 0.74.5 contain an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the single-threaded --listen HTTP server by sending large POST requests, causing it to block for about 30 seconds per request due to quadratic string concatenation.
PHP2Shell refers to two critical remote code execution vulnerabilities in PHP disclosed in October 2026. Exploitation attempts began days before official patches were released, with mass scanning and exploitation activity observed immediately after patch publication. Although multiple proof-of-concept exploits circulated rapidly, many were ineffective or caused crashes rather than successful exploitation. The vulnerabilities affect a large number of internet-facing PHP servers, many running end-of-life versions. US cybersecurity authorities have urged immediate patching to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the risk. The vulnerabilities have been compared in impact potential to Log4Shell due to widespread presence and forgotten PHP infrastructure. Mitigations include applying patches promptly and restricting web-facing process permissions as a temporary control.
A vulnerability in webpack-dev-server versions 5.1.0 up to but not including 5.2.7, and 6.0.0 up to but not including 6.1.0, allows unauthenticated attackers to cause the server to disclose sensitive information via error messages. This occurs because the open-editor endpoint improperly validates the Host header, leading to an exception that reveals absolute filesystem paths, module locations, and source line numbers in HTTP 500 responses. The server continues running without denial of service. The issue is fixed in versions 5.2.7 and 6.1.0.
A vulnerability in webpack-dev-server versions before 5.2.7 and in 6.0.0 allows malicious web pages visited by developers to open cross-origin WebSocket connections through the dev server. This occurs because the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating Host or Origin headers, bypassing allowedHosts protections. The issue is fixed in versions 5.2.7 and 6.1.0.
An authorization bypass vulnerability exists in myCred up to version 4.0.0-beta.1 due to incorrectly configured access control security levels that can be exploited via a user-controlled key. This vulnerability allows an attacker with limited privileges to bypass authorization checks, potentially leading to integrity and availability impacts. The CVSS score is 5.4, indicating a medium severity level.
Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.
This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
A stored cross-site scripting (XSS) vulnerability exists in H5P through version 1.17.9 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No patch or remediation details are provided in the available data.
ACF Extended versions up to 0.9.2.7 are affected by a Path Traversal vulnerability that allows improper limitation of pathnames to restricted directories. This vulnerability can lead to limited integrity and availability impacts without confidentiality loss. The CVSS score is 6.5, indicating a medium severity level. No patch or remediation information is currently provided.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.6.6 contain a policy bypass vulnerability in the browser CDP discovery feature. This flaw allows acceptance of WebSocket URLs that should be blocked by OpenClaw policies, potentially enabling attackers with lower-trust access to reach restricted network destinations. The vulnerability is rated high severity with a CVSS score of 8.5. No known exploits have been reported in the wild. A patch is available to address this issue.
CVE-2026-114702 is a stored cross-site scripting (XSS) vulnerability in the nicdark ND Shortcodes For Visual Composer plugin. It affects versions from 0 up to and including 7.8. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with impacts on confidentiality, integrity, and availability. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in yoomoney ЮKassa для WooCommerce yookassa, affecting versions up to 2.17.3. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation information is currently available.
A missing authorization vulnerability exists in WP Sunshine Sunshine Photo Cart up to version 3.7.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation information is currently provided.