Critical CVSS 9.2 Exploited
PHP PHP2Shell: remote code execution in PHP Affected 8.2 < 8.2.35 · 8.3 < 8.3.36 · 8.4 < 8.4.27 · 8.5 < 8.5.12. PHP 7.4, 8.0 and 8.1 have no official fixed release. What to do Update PHP today and restart PHP-FPM. On 7.4–8.1, migrate or ask your provider for a backport. 9.2CVSS v4 PHP2Shell lets attackers take over a server and is already being exploited. Enter your domain or server IP: we read what your site shows any visitor and tell you whether your PHP version is vulnerable, whether it's losing support and what to do.
Check my PHP now Critical CVSS 10.0 Exploited
WordPress · Bricksforge Bricksforge: site takeover without logging in Affected Bricksforge plugin before 3.1.8.10. Attacks since October 7. What to do Update Bricksforge to 3.1.8.10 and review admin users and new files. Critical Exploited CISA KEV
Ahsay AhsayCBS Ahsay backup software: auth bypass and command injection Affected AhsayCBS servers without the vendor patch. What to do Patch AhsayCBS and verify your backups weren't tampered with. Critical CVSS 8.6 Exploited CISA KEV
Ivanti Connect Secure Ivanti VPN: bypass login and run commands Affected Ivanti Connect Secure before 25.1.3.0. What to do Update to 25.1.3.0, 25.1.3.1 or 22.8R2.5 and review suspicious access. Critical Exploited CISA KEV
Palo Alto PAN-OS Palo Alto firewall: code injection as root Affected PAN-OS; versions in the Palo Alto advisory. Requires an authenticated user. What to do Check the vendor advisory and patch the firewall. Critical Exploited CISA KEV
Cisco Secure Email Gateway Cisco Secure Email Gateway: writes files without authentication Affected Cisco Secure Email Gateway; versions in the Cisco advisory. What to do Patch per the Cisco advisory. Critical CVSS 9.3 Exploited CISA KEV
Atlassian Data Center Jira, Confluence and Bitbucket Data Center Affected Jira, Confluence, Bitbucket, Crowd and Bamboo Data Center, several versions. What to do Update: Jira 9.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1. Critical CVSS 9.3 Exploited CISA KEV
BeyondTrust Remote Support BeyondTrust Remote Support: authentication bypass Affected BeyondTrust Remote Support up to 26.2.3. What to do Apply the patch from BeyondTrust advisory bt26-05. Critical CVSS 9.2
Laravel Laravel: log in as another user without a token Affected laravel/framework < 12.68.0 and 13.x < 13.29.0 with the “token” guard on MySQL/MariaDB. Laravel 11 gets no patch. What to do composer update laravel/framework to 12.68.0 or 13.29.0. On Laravel 11, migrate. High Exploited
WordPress Backdoor campaign using UpdraftCentral keys Affected WordPress sites with exposed UpdraftCentral keys; attackers install fake plugins (99 names found). What to do Revoke and regenerate UpdraftCentral keys and review plugins you didn't install. High CVSS 8.8 Exploited CISA KEV
Windows Windows Shell: bypasses the downloaded-file warning Affected Windows 10, 11 and Server 2012 R2–2025 without the October update. What to do Install the October cumulative update on every PC and server. High Exploited CISA KEV
Nextcloud · Collabora Online Collabora Online in Nextcloud: command injection Affected Collabora CODE server bundled with Nextcloud. What to do Update Collabora Online / CODE on your Nextcloud. High
PHP 8.2 PHP 8.2 stops getting patches on December 31 Affected Every system on PHP 8.2 or older. 8.1 has had no patches since December 2025. What to do Plan the move to PHP 8.4 before year end: review Composer dependencies and extensions. High CVSS 8.1
nginx nginx: heap overflow with alias Affected nginx before 1.30.6 and 1.31.0–1.31.6, when the config combines alias with $request_filename. What to do Update to 1.30.6 or 1.31.7. Meanwhile, avoid alias together with $request_filename. High CVSS 8.1
SharePoint Server SharePoint Server: privilege escalation Affected SharePoint Server Subscription Edition before 16.0.20326.20190. What to do Install the October patch on on-premises SharePoint. Medium CVSS 5.4 Exploited CISA KEV
Fortinet FortiOS FortiOS: admin flaw now exploited Affected FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9 and all of 7.2, 7.0 and 6.4. Requires an authenticated admin. What to do Update to 7.6.5, 7.4.10 or 8.0; restrict admin access and review admin accounts. Medium
PHP Second PHP flaw, still unpatched Affected Sites that switch session.serialize_handler to “php” at runtime with upload progress enabled. What to do Until the patch ships: session.upload_progress.enabled = 0 in php.ini. Medium CVSS 6.5
Laravel · Livewire Laravel and Livewire: two authorization flaws Affected Laravel 12.45–12.67 and 13.x < 13.27.0 (a read endpoint can delete a related table). Livewire 4.3.0–4.4.7 (#[Authorize] bypass). What to do Update laravel/framework, and livewire/livewire to 4.4.8 or later. Medium
Symfony Symfony: three flaws in http-foundation, expression-language and yaml Affected Symfony components; Laravel also uses http-foundation (ReDoS via Cache-Control). What to do composer update symfony/* to the versions in the October 15 advisory. Medium CVSS 7.5
WordPress WordPress 7.1.3 (7 fixes) and unpatched Music Store plugin Affected WordPress 7.1.2 or older. Music Store ≤ 1.4.7: file read without login, no fixed version published. What to do Confirm 7.1.3 was applied. If you use Music Store, disable it until a fix ships. Info
OpenSSH OpenSSH 10.6: hardening release Affected OpenSSH 10.5 or older. Improves sftp path validation and tunnel forwarding. What to do Update with your distribution's package and make sure port 22 isn't open to the whole internet.
