Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
Stories per day · 30 days
1 RSS
Relatedphp2php2shell2rce2abyss1aprelium1full-disclosure1government1ics1incident-response1ohio1php-fpm1plc1s7-15001siemens1simatic1vulnerability1wordpress1
11 stories, newest first · one card per story
Stories tagged #web-server
Ohio auditor takes web server offline after October 25 attack
Keith Faber says monitoring quarantined the threat and he does not believe residents’ or local governments’ financial data is at risk.
1
SIMATIC S7-1500 web server flaws can hijack authorized browser sessions
All listed firmware versions are affected, Siemens is still preparing fixes, and eight CVEs are named.
PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 exploited in the wild
Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4, 8.0 and 8.1 get emergency source backports only.
[0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5)
Researchers disclosed a command-execution chain in Aprelium Abyss Web Server X1 2.16.22.0 before console password setup.
The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.
cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access
Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.
2
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.
USN-8749-1: CivetWeb vulnerabilities
Ubuntu USN-8749-1 patches CivetWeb URI and HTTP request parsing flaws enabling remote DoS or possible code execution.
thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program
The redirect CGI program shipped with thttpd v2.26 has a stack buffer overflow that unauthenticated attackers can trigger for crashes or possible code execution.
ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.