Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
Stories per day · 30 days
3 RSS
23 stories, newest first · one card per story
Stories tagged #in-the-wild
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Attackers are exploiting critical Bricksforge flaw CVE-2026-85097 for unauthenticated file upload and code execution.
1
The AI app builder your team trusts has a root-level backdoor
Attackers actively exploit unauthenticated RCE CVE-2026-0768 (CVSS 9.8) in internet-facing Langflow instances to run code as root and steal credentials.
8
Anthropic Mythos Found A Bug in Rejetto HFS. Attackers Are Now Exploiting It.
Attackers are exploiting CVE-2026-61500, a critical Rejetto HFS authentication-bypass and code-execution flaw found with Anthropic Mythos.
Apple Patches CoreGraphics Zero Day Exploited in Attacks
Apple patched CVE-2026-86950, a CoreGraphics zero-day reportedly exploited against targeted iOS users.
2
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunnel into networks.
Citrix admins warned to shut down NetScalers over 2 exploited zero-days
Agencies warn Citrix admins to take NetScalers offline after two unpatched RCE zero-days were exploited.
Roundcube Webmail Vulnerability in Attackers’ Crosshairs
Attackers exploit unauthenticated SQL injection CVE-2026-48842 in Roundcube webmail's virtuser_query plugin; Canadian Cyber Centre confirms in-the-wild exploitation, 500,000+ servers exposed.
AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS
MikroTrick chains two MikroTik RouterOS flaws for unauthenticated admin access, with exploitation seen before patches.
WordPress security advisory (AV26-952)
WordPress before 7.1.2 is under active attack via CVE-2026-87902, an unauthenticated path traversal that can yield remote code execution.
2
Critical Orkes Conductor Vulnerability Exploited in Attacks
Attackers actively exploit CVE-2026-58138 (CVSS 9.8), an unauthenticated RCE in Orkes Conductor via malicious JavaScript or Python expressions in inline workflows.
4
Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.
1
More JFrog Artifactory bugs under attack, and all 3 have patches
Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.
3
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.
4
Adobe security advisory (AV26-808) – Update 1
Canada's Cyber Centre updated Adobe advisory AV26-808 to flag that CVE-2026-71362 in Adobe Commerce is being exploited in the wild.
Google fixes the seventh actively exploited Chrome zero-day of 2026
Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.
Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491)
Google patched actively exploited Chrome zero-day CVE-2026-87491, a V8 out-of-bounds write enabling sandboxed code execution, in Chrome 153.0.8010.36+.
1
Back-to-back N-able bugs send admins on a patching spree
CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.
2
Google security advisory (AV26-883) – Update 1
Google patched actively exploited Chrome flaw CVE-2026-85046 in Chrome 152.0.7977.82; CISA added it to the KEV catalog, urging updates.
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
1
Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019
Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
2
Inside the Metabase SQLi: Exploited in the Wild
Wiz reverse engineers Metabase SQLi CVE-2026-72898, exploited in the wild, using AI to speed defenses.
3