The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
A high-severity unauthenticated race condition vulnerability in WordPress's Core update process allows remote code execution. The flaw arises from predictable, web-accessible staging directories during updates, enabling attackers to exploit a narrow time window while WordPress unpacks updates. WordPress 7.1.4 and earlier branches have been patched to randomize staging directories and prevent unsafe configuration promotion. Exploitation attempts began shortly after patch release, but no successful compromises have been reported.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.
TRUST#GRAFT is a sophisticated malware attack targeting authenticated WordPress administrator browser sessions. It uses JavaScript loaders that mimic Cloudflare verification screens to fingerprint browsers, harvest credentials, and profile environments. Upon detecting an active WordPress admin session, it extracts CSRF tokens and uploads a malicious plugin disguised as 'Web Media Optimizer.' The PHP backdoor persists by copying itself to the must-use plugins directory, injects remote JavaScript into public pages, provides token-gated admin access, and hides from standard plugin management interfaces. This attack leverages existing trusted sessions without authentication bypass and involves coordinated infrastructure across multiple domains.
Two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affect PHP versions back to 5.4 and impact widely used web applications such as WordPress, Drupal, and Joomla. These vulnerabilities involve memory management and error handling components of PHP and allow unauthenticated attackers to execute arbitrary code. Exploitation attempts have been detected in the wild shortly after patches were released. The flaws also enable reading sensitive process memory, potentially exposing credentials and secrets. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and backports for 7.4, 8.0, and 8.1. The PHP Foundation and security firms urge immediate patching due to the severity and active exploitation attempts.
Two critical unauthenticated remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP core versions since 5.4. These flaws, collectively dubbed “php2shell,” can be triggered by a plain HTTP request before any application code runs. The vulnerabilities arise from improper handling of out-of-memory conditions and use-after-free stale internal states. The impact spans the entire PHP ecosystem, including popular applications like WordPress, Drupal, Magento, and others. PHP 8.1 and older versions are end-of-life and will not receive patches, while PHP 8.2 support ends December 31, 2026. No active exploitation has been observed as of October 21, 2026. Cisco Talos recommends immediate upgrading to fixed releases and provides intrusion prevention signatures for detection. Some configuration mitigations may reduce exposure but do not fully protect against these vulnerabilities.
A threat actor breached TeamUpdraft's infrastructure, compromising UpdraftCentral connection keys used to manage WordPress sites remotely. These stolen keys have been used to backdoor connected WordPress sites by installing malicious plugins that grant attackers administrator privileges. The breach affects an estimated 10% of UpdraftPlus users with UpdraftCentral or Migrator keys, potentially impacting around 400,000 websites. The vendor responded by revoking affected keys and releasing patched versions of UpdraftPlus. Users are advised to update to the latest versions and remove existing UpdraftCentral keys from their sites to mitigate risk.
Some downloads of the Rank Math PRO WordPress plugin from the official vendor website were compromised to include malware that planted hidden backdoors in a supply-chain attack. This incident was reported recently and involves the distribution of malicious plugin versions that could allow unauthorized access to affected websites.
The Rank Math PRO WordPress plugin version 3.0.123 was compromised in a supply chain attack, with malware injected into packages distributed between October 15 and October 16, 2026. The malicious code could allow attackers to take over websites where the plugin was activated. The malware is persistent, recreating hidden backdoors and modifying files and settings to maintain access. Rank Math released a clean version 3.0.124 immediately after discovering the compromise. Users who installed or activated version 3.0.123 during the affected window should consider their sites compromised and restore from clean backups or follow detailed cleanup steps.
A critical vulnerability (CVE-2026-85097) in the Bricksforge WordPress plugin allows unauthenticated attackers to upload arbitrary files and execute malicious code, potentially taking full control of affected WordPress websites. The flaw affects versions 3.1.8.9 and earlier and was patched in version 3.1.8.10. Exploitation attempts have been observed in the wild since October 7, 2026, involving automated attacks from multiple IP addresses. Bricksforge is a commercial add-on used by approximately 6,000 websites. The vulnerability has a CVSS score of 9.8, indicating critical severity.
Stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins are being exploited to install backdoors and create rogue administrator accounts. The attacks deliver malicious JavaScript payloads that execute in the context of authenticated administrators, allowing the installation of a malicious plugin and creation of hidden admin accounts. These backdoors persist even after removal of the malicious plugin. The vulnerabilities require an authenticated session to exploit and affect Ninja Forms versions 3.15.3 and older and WPC Product Bundles for WooCommerce versions 8.6.6 and older. Site administrators are advised to upgrade to Ninja Forms 3.15.4 or later and WPC Product Bundles for WooCommerce 8.6.7 or later. Existing infections require manual cleanup as updates do not remove backdoors.
TIKTOUK is a credential collection toolkit targeting WordPress sites. It includes modules that identify WordPress installations, extract exposed configuration files and database credentials, decrypt email credentials from SMTP plugins, and harvest secrets from client-side JavaScript. The toolkit sends all collected data to a centralized controller. Real-world incidents have revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys that could be abused.
A path traversal vulnerability affects WordPress version 7.0.2 and version 7.0.6, as well as versions prior to 7.1.2. This vulnerability could allow an attacker to access files outside the intended directory structure.
Sensors detected a small number of scans targeting the 'wordfence-waf.php' script, which is part of the Wordfence security solution for WordPress sites. These scans use minimal HTTP headers and target sites by IP address rather than hostname. The purpose appears to be enumeration of Wordfence-protected sites or attempts to bypass Wordfence protections. The scanned file does not expose secrets but is part of Wordfence's Extended Protection feature designed to prevent bypass. No active exploitation or vulnerabilities have been reported in these scans.
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]
WordPress patched a vulnerability called Click2Shell that allowed attackers to automatically install and preview inactive themes via specially crafted URLs. This flaw could lead to remote code execution (RCE) by abusing how theme slugs are interpreted differently by the themes API and JavaScript in an administrator's browser. Attackers could force installation of attacker-selected themes fetched from the official WordPress.org catalog without administrator consent. Some inactive third-party themes could be exploited for PHP code execution during the Customizer preview, enabling attackers to execute code under the WordPress server account without needing an attacker WordPress account. The vulnerability was fixed in WordPress version 7.1.1 and backported to versions as early as 4.7.
Click2Shell is a cross-site request forgery (CSRF) vulnerability in WordPress Core up to version 7.1.0 that allows unauthenticated attackers to execute arbitrary PHP code on the server by forcing the installation of a theme from the official WordPress.org catalog. The attack requires a logged-in administrator to visit a crafted URL, which triggers the execution of PHP code via an inactive theme during a Customizer preview. This vulnerability was fixed in WordPress version 7.1.1 by escaping the theme slug and restricting jQuery selectors. The flaw enables remote code execution that could lead to file manipulation, data access, and creation of rogue admin accounts.