PHP schedules emergency fixes for two critical RCE flaws
watchTowr reproduced CVE-2026-109618 privately, while PHP has not confirmed scope or published a workaround.
Stories per day · 30 days
2 RSS
Relatedphp6remote-code-execution4php2shell3emergency-patch2rce2cert-eu1cvss1embargo1eol1pre-disclosure1
20 stories, newest first · one card per story
Stories tagged #watchtowr
Leaked PHP2Shell flaws may allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619 both score 9.2; WatchTowr and Huntress report no exploitation yet.
PHP to ship emergency fixes for two critical RCE flaws rated 9.2
Only branches 8.2 through 8.5 can be patched; affected versions and exploit details remain unconfirmed.
PHP schedules October 21 fixes for two flaws rated 9.2
watchTowr cites CVE-2026-109618 and CVE-2026-109619, but PHP has not confirmed identifiers or scope.
PHP warns of two critical flaws, patches due October 21
Each flaw is rated CVSS v4.0 9.2; PHP has not confirmed CVE IDs, versions, or remote code execution.
4
PHP warns of two critical flaws, emergency patches due October 21
watchTowr says CVE-2026-109618 and CVE-2026-109619 are real RCEs and has not seen exploitation.
2
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
watchTowr details a PaperCut pre-auth RCE chain exploited in the wild and repeated patch bypasses.
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
watchTowr dissects CVE-2026-88772, an in-the-wild-exploited pre-auth DTLS memory overflow in Citrix NetScaler enabling RCE, one of eight fixed flaws.
Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks
watchTowr warns two unpatched Citrix NetScaler RCE zero-days are allegedly exploited, without Citrix confirmation.
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.
4
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
watchTowr observed active exploitation of CVE-2026-5430, a WSO2 API Manager JWT bypass using forged admin tokens, risking credential theft and account takeover.
5
Perfect-10 GitLab bug under attack days after patch lands
CISA confirms active exploitation of CVSS 10.0 GitLab path traversal flaw CVE-2026-85706 days after patches shipped, enabling unauthenticated arbitrary file reads.
2
GitLab’s critical flaw is already drawing internet-wide probes
GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.
4
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab patched CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal enabling arbitrary file reads, already probed in the wild.
2
GitLab Vulnerability Exploited One Day After Disclosure
WatchTowr observed in-the-wild exploitation of critical GitLab path traversal CVE-2026-85706 one day after disclosure, letting unauthenticated attackers read arbitrary files.
5
CISA Added JFrog Artifactory Vulnerability to its Known Exploited Vulnerabilities Catalog (CVE-2026-82329)
CISA added the actively exploited JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) to its KEV catalog; unauthenticated attackers gain admin access.
1
Another Artifactory CVE under attack by AI agents or humans
Attackers are actively exploiting CVE-2026-82329, a critical JFrog Artifactory authentication bypass, minting admin tokens on exposed servers days after patch release.
1
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.
2
GeoServer Zero-Day Is Already Being Probed. That’s the Problem
Unpatched GeoServer zero-day enabling SQL injection and possible RCE is being actively probed across exposed systems.
9