Threats tagged 'mass exploitation'

Two critical use-after-free vulnerabilities in the PHP engine's session.upload_progress feature allow unauthenticated remote code execution by bypassing WAFs during multipart request parsing. Exploit code rapidly spread after the October 21, 2026 patch release, with UNC actors targeting over 70% of unpatched PHP infrastructure globally. Exploitation campaigns include mass scanning, Mirai botnet C2 infrastructure, and session poisoning via WordPress LFI vulnerabilities, affecting public, business, and educational sectors worldwide.