CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
84
Organization
Forescout
- Mentions · 7d1
- Mentions · 30d17
- All mentions21
- First seenSep 2, 2026
- Last mentioned2d ago
Timeline
21 articles · newest firstCISA says attackers chain Plex flaws in Plex2Shell server breaches
Federal agencies must patch or mitigate by October 23; honeypots were hit with a cryptominer.
80
Attackers exploit Siemens Software Center flaw in ClickFix campaign
CVE-2026-110936 let version 3.5.8.7 load attacker files beside a signed binary; 4.0.9.8 fixes it.
74
Siemens Software Center DLL side-loading flaw exploited in ClickFix campaign
CVE-2026-110936 (CVSS 8.4) is fixed in Software Center 4.0.9.8; Siemens lists startup, file and IP indicators.
76
ClickFix attacks exploit Siemens Software Center DLL flaw to deploy a RAT
CVE-2026-110936, CVSS v4 8.4, is fixed in Siemens Software Center 4.0.9.8; abused builds sideloaded archive.dll via a signed copy.
78
ROMULUS ClickFix platform delivers Legion Loader and other malware
Forescout found six servers; PowerShell staging fetches a trojanized MSI or an archive containing Legion Loader.
68
Siemens Software Center DLL flaw exploited in Romulus ClickFix attacks
CVE-2026-110936 let attackers side-load DLLs beside a signed Software Center build; version 4.0.9.8 fixes it.
76
New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
62
Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Forescout says ROMULUS delivers LegionLoader and sideloaded malware through ClickFix traps.
64
Horizon3 Promotes Ellen Sundra to Chief Customer Officer to Advance Customer Success and Security Outcomes
Horizon3 promoted Ellen Sundra to Chief Customer Officer to scale NodeZero customer success.
18
Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.
64
New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
61
ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Forescout found ROMULUS, a reusable ClickFix backend on six servers delivering malware including LegionLoader.
62
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
58
Medical devices patients rely on most are least prepared for quantum attacks
Forescout found only 6% of medical devices support PQC-capable SSH, and 5,500 healthcare systems are exposed.
56
ASOS Confirms Cyberattack, Data Breach
ASOS confirmed a third-party notification platform was hacked, potentially exposing customer names and contact details.
62
Critical Medical Devices Unable to Support PQC Transition
Forescout finds most medical devices cannot adopt post-quantum cryptography, exposing long-lived healthcare data.
56
Only 13% of OT Network Segments Are Fully Isolated: Analysis
Forescout finds only 13% of OT-containing network segments are fully isolated across 209 organizations.
63
Network Segmentation Failures Are Expanding the Corporate Attack Surface
Forescout finds nearly half of OT and medical segments also hold IT or IoT, widening lateral movement.
56
$536 and 8 Hours: AI Learns to Attack a Different PLC
Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.
55
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.
45
Related CVEs
by mentions- CVE-2026-110936<1%8.4DLL Search-Path Hijacking in Siemens Software Center
- CVE-2021-318863%9.8A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All…
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-966562%8.6Admin-Triggered Arbitrary File Write & RCE in Plex Media Server
- CVE-2026-1069313%8.5OS command injection in SiteGuard Server Edition
- CVE-2026-966542%6.9Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- CVE-2026-966552%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-966522%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Appears with
- Romulusmalware · 8
- Forescoutvendor · 6
- Siemensvendor · 6
- LegionLoadermalware · 5
- Siemens Software Centerproduct · 4
- Microsoftvendor · 4
- ChatGPTproduct · 3
- CISAorganization · 3
- PowerShellproduct · 3
- Huntressorganization · 3
- Proofpointorganization · 2
- Ghidraproduct · 2
- Huntress Labsorganization · 2
- Lorem Ipsum Loadermalware · 2
- Satacommalware · 2
- WAGOvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.