Attackers probe WordPress core race; 62,969 attempts in a day
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
1
Stories per day · 30 days
Relatedphp12php2shell10remote-code-execution5rce4cisa2wordpress2active-exploitation1audio1aws1claude-code1cloudflare1digital-museum1emergency-patch1exploit1file-upload1game1generative-ai1honeypot1
14 stories, newest first · one card per story
Stories tagged #web
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
PHP2Shell patches are out; exploit attempts seen, no confirmed hits
Memory-safety flaws in PHP back to about 5.4 can yield remote code execution, and some sites cannot patch in place.
Blog argues php2shell is unlikely to be mass-exploited
A public PoC needs four hits on one PHP worker plus the exact build, which the author says is slow to brute-force.
Amazon says PHP2Shell exploitation began four days before patches
CVE-2026-109618 and CVE-2026-109619 allow remote code execution; Amazon now calls them broadly exploited.
Attackers exploited critical PHP flaws days before patches landed
AWS honeypots logged PHP2Shell attempts on October 17, four days before Wednesday's disclosure, and exploitation is now described as broad.
PHP core flaws allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, each score CVSS 9.2; emergency patches are out.
PHP emergency patches fix two critical unauthenticated RCE flaws
Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP2Shell flaws draw early attacks; emergency PHP updates out
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.
Critical PHP flaws let unauthenticated attackers run code on web servers
CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.
CISA urges immediate patch of critical php2shell RCE flaws
Unauthenticated remote code execution hits every PHP install serving web requests; fixed builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
PHP Foundation to patch two critical vulnerabilities in PHP
The October 20, 2026 notice names no CVE identifiers, affected versions, fixed releases, or known exploitation.
CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone
Catalyst::Seal before 0.03 can let one request bypass authorization on a later request (CVE-2026-85491).
[20260802] - Core - Improper CORS origin validation
Joomla patches CVE-2026-71573, improper CORS origin validation in CMS requests, in versions 5.4.8 and 6.1.3.