PHP Vulnerabilities CVE-2026-109618 / CVE-2026-109619 (PHP2Shell): Critical RCE Flaws Under Attack
On 21 October 2026 PHP fixed two critical flaws (CVSS 9.2) allowing unauthenticated remote code execution. Exploitation attempts have been seen since 17 October and a confirmed intrusion at a European government agency was reported; mass successful exploitation is not confirmed. Update 25 October: no patch yet for the new CVE-2026-115560.
Read more →
Exchange Server Vulnerability CVE-2026-70571: Critical RCE, last patch for 2016/2019
Microsoft fixed the critical Exchange Server remote code execution flaw CVE-2026-70571 (CVSS 8.1) with its 13 October 2026 updates. For Exchange 2016/2019 this is the last security update available, offered only to Period 2 ESU-enrolled organizations.
Read more →
Veeam Backup & Replication Vulnerability CVE-2025-64393: RCE via the Backup Viewer Role
CVE-2025-64393 (CVSS 9.4) in Veeam Backup & Replication 12 lets a user with the Backup Viewer role run code on the backup server. Fixed in build 12.3.2.4934.
Read more →
Citrix NetScaler Vulnerability CVE-2026-88779: SAML Zero-Day
CVE-2026-88779 (CVSS 8.7) affects Citrix NetScaler appliances that use SAML and is actively exploited. Fixed versions, the disputed impact and post-exploitation traces from 88771.
Read more →
FortiMail Vulnerability CVE-2026-104286 Exploited as a Zero-Day
FortiMail flaw CVE-2026-104286 (CVSS 9.8) in the IBE web feature is exploited as a zero-day. No fixed release yet. Affected versions, the workaround and IoCs.
Read more →
Microsoft SharePoint Server Vulnerability: CVE-2026-65660 Is Being Exploited
CVE-2026-65660 lets an authenticated attacker inject and run code on on-premises Microsoft SharePoint Server. The score is CVSS 8.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 11 August 2026, and the fix was announced…
Read more →
Citrix NetScaler Vulnerability: CVE-2026-88771 and CVE-2026-88772
On 27 September 2026, Citrix disclosed unauthenticated remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway. For CVE-2026-88771 and CVE-2026-88772, advisory CTX697096 gives a CVSS v4.0 score of 9.5. Citrix says it has observed exploitation on unpatched…
Read more →
WordPress Vulnerability CVE-2026-87902 Exploited: Update to 7.1.2
Critical WordPress core vulnerability CVE-2026-87902 (CVSS 9.2) was exploited within hours of the patch. Affected versions, how to check your site, IoCs and what to do now.
Read more →
Check Point Vulnerability: CVE-2026-85102 Actively Exploited
Check Point confirms active exploitation of CVE-2026-85102 and CVE-2026-93616 (CVSS 9.8), affecting VPN gateways and management servers. Affected versions and patching steps.
Read more →