Critical
VMware security advisory (AV26-763) – Update 2
Summary coming soon
Our short summary of this story is on its way. Until then, read it at the source below.
Linked
CVE-2026-109618CVE-2026-112438CVE-2026-112427CVE-2026-112484CVE-2026-46300CVE-2026-112457CVE-2026-112455CVE-2026-112471CVE-2026-41709CVE-2018-0802CVE-2018-14558CVE-2019-0708CVE-2019-1068CVE-2019-18935CVE-2020-0796CVE-2020-1472CVE-2020-1938CVE-2020-8515CVE-2021-23758CVE-2021-27137CVE-2021-3156CVE-2021-31755CVE-2021-33044CVE-2021-33045CVE-2021-38003CVE-2021-4034CVE-2021-43798CVE-2021-44228CVE-2022-0847CVE-2022-0995CVE-2022-1040CVE-2022-22965CVE-2022-27925CVE-2022-47986CVE-2023-22527CVE-2023-25717CVE-2023-27350CVE-2023-27351CVE-2023-4346CVE-2023-46747CVE-2023-49105CVE-2024-21762CVE-2024-42009CVE-2024-4577CVE-2024-55591CVE-2025-24472CVE-2025-24813CVE-2025-25249CVE-2025-31324CVE-2025-32432CVE-2025-3248CVE-2025-39682CVE-2025-39964CVE-2025-43529CVE-2025-49113CVE-2025-55182CVE-2025-5777CVE-2025-62593CVE-2025-66376CVE-2025-68613CVE-2025-68686CVE-2026-0257CVE-2026-0300CVE-2026-0770CVE-2026-109619CVE-2026-110936CVE-2026-111497CVE-2026-114625CVE-2026-12569CVE-2026-15409CVE-2026-15410CVE-2026-16232CVE-2026-16812CVE-2026-18556CVE-2026-18577CVE-2026-19490CVE-2026-20079CVE-2026-20316CVE-2026-20349CVE-2026-21962CVE-2026-25089CVE-2026-3055CVE-2026-33017CVE-2026-33824CVE-2026-34486CVE-2026-34908CVE-2026-34909CVE-2026-34910CVE-2026-35273CVE-2026-39808CVE-2026-39987CVE-2026-42016CVE-2026-42018CVE-2026-42897CVE-2026-45659CVE-2026-46817CVE-2026-48282CVE-2026-48710CVE-2026-48907CVE-2026-48908CVE-2026-48939CVE-2026-49869CVE-2026-50522CVE-2026-53266CVE-2026-53362CVE-2026-5430CVE-2026-55040CVE-2026-55255CVE-2026-56155CVE-2026-56164CVE-2026-56290CVE-2026-56291CVE-2026-58644CVE-2026-58704CVE-2026-59310CVE-2026-59822CVE-2026-60004CVE-2026-60137CVE-2026-63030CVE-2026-63077CVE-2026-64849CVE-2026-65400CVE-2026-65660CVE-2026-66384CVE-2026-67277CVE-2026-67279CVE-2026-68820CVE-2026-71362CVE-2026-72529CVE-2026-72530CVE-2026-7273CVE-2026-72898CVE-2026-73570CVE-2026-75650CVE-2026-76460CVE-2026-76461CVE-2026-76504CVE-2026-8037CVE-2026-81578CVE-2026-81963CVE-2026-82078CVE-2026-82329CVE-2026-83548CVE-2026-83549CVE-2026-8452CVE-2026-84869CVE-2026-85046CVE-2026-85102CVE-2026-85706CVE-2026-85880CVE-2026-86060CVE-2026-86218CVE-2026-86950CVE-2026-87491CVE-2026-87886CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-9198CVE-2026-93616CVE-2026-93952CVE-2026-94127CVE-2008-4128CVE-2026-9586CVE-2010-3904CVE-2014-6271CVE-2015-3246CVE-2015-5287CVE-2016-4437CVE-2017-0199CVE-2017-7269CVE-2017-7921
26 sources cover this
- watchTowr Labs · 29 MarPlease, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)(opens the publisher’s site)
- watchTowr Labs · 29 JunEnterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)(opens the publisher’s site)
- watchTowr Labs · 30 JunCitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)(opens the publisher’s site)
- watchTowr Labs · 2 JulIt’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)(opens the publisher’s site)
- Volexity · 17 JulProxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation(opens the publisher’s site)
- Recorded Future Blog · 7 AugJuly 2026 CVE Landscape(opens the publisher’s site)
- Wiz Blog · 10 AugInside the Metabase SQLi: Exploited in the Wild(opens the publisher’s site)
- watchTowr Labs · 14 AugYou’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))(opens the publisher’s site)
- Recorded Future Blog · 8 SeptAugust 2026 CVE Landscape(opens the publisher’s site)
- Volexity · 9 SeptMind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows(opens the publisher’s site)
- Wiz Blog · 10 SeptArtifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329(opens the publisher’s site)
- Volexity · 21 SeptMind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits(opens the publisher’s site)
- watchTowr Labs · 24 SeptIs This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)(opens the publisher’s site)
- watchTowr Labs · 28 SeptOh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)(opens the publisher’s site)
- watchTowr Labs · 29 SeptHere We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)(opens the publisher’s site)
- watchTowr Labs · 9 OctDeath By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)(opens the publisher’s site)
- Recorded Future Blog · 13 OctSeptember 2026 CVE Landscape(opens the publisher’s site)
- Zscaler ThreatLabz · 16 OctCVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability(opens the publisher’s site)
- Canadian Centre for Cyber Security · 20 OctGitea security advisory (AV26-845) - Update 1(opens the publisher’s site)
- Canadian Centre for Cyber Security · 20 OctSiemens security advisory (AV26-1063) – Update 1(opens the publisher’s site)
- Recorded Future Blog · 21 OctPHP2Shell Exploitation: Two Critical PHP Flaws Explained(opens the publisher’s site)
- Qualys Threat Research · 21 OctTwo Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now(opens the publisher’s site)
- Huntress Blog · 21 OctRapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)(opens the publisher’s site)
- Tenable Blog · 21 Octphp2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities(opens the publisher’s site)
- Orca Security Blog · 21 OctCritical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)(opens the publisher’s site)
- The Register (Security) · 21 OctPHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched(opens the publisher’s site)
- Cisco Talos · 21 OctTwo critical RCEs in PHP core(opens the publisher’s site)
- Kaspersky Securelist · 21 OctCritical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)(opens the publisher’s site)
- Krebs on Security · 21 OctWidespread PHP Flaw May Cause Many Site Outages Today(opens the publisher’s site)
- Socket Blog · 21 OctPHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline(opens the publisher’s site)
- Malwarebytes Labs · 21 OctPHP2Shell: Why many websites had to go offline(opens the publisher’s site)
- Socket Blog · 21 OctPHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches(opens the publisher’s site)
- Zscaler ThreatLabz · 21 OctCVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks(opens the publisher’s site)
- The Register (Security) · 22 OctPHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk(opens the publisher’s site)
- The Register (Security) · 22 OctHackers pile on PHP2Shell as AWS reveals attacks began before disclosure(opens the publisher’s site)
- Schneier on Security · 22 OctNew Serious PHP Vulnerabilities Released and Patched(opens the publisher’s site)
- The Register (Security) · 22 OctPHP2Shell puts dozens of UK government services out of service(opens the publisher’s site)
- Arctic Wolf Labs · 22 OctPHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution(opens the publisher’s site)
- Horizon3.ai · 22 OctPHP2Shell Exposure Depends on More Than Whether You Use PHP(opens the publisher’s site)
- The Register (Security) · 22 OctPHP2Shell exploit bypasses protections designed to stop remote code execution(opens the publisher’s site)
- Tenable Blog · 22 OctThe adversary economy: How threat actors are reacting to PHP2Shell(opens the publisher’s site)
- Orca Security Blog · 6dPHP2Shell: What This Week Tells Us About the Web We Built(opens the publisher’s site)
- Horizon3.ai · 6dCVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available(opens the publisher’s site)
- The Register (Security) · 6dThere's a third PHP2Shell bug, but it won't get an emergency fix(opens the publisher’s site)
- Wiz Blog · 4dBroccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability(opens the publisher’s site)
- Qualys Threat Research · 3dCan’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own(opens the publisher’s site)
- The Register (Security) · 3dPHP2Shell: No login, no app code, no warning. What next?(opens the publisher’s site)
- ESET WeLiveSecurity · 3dPHP2Shell: What to know about two critical PHP flaws(opens the publisher’s site)
- Check Point Research · 3d26th October – Threat Intelligence Report(opens the publisher’s site)
- Orca Security Blog · 3dPHP2Shell: From the attacker’s perspective(opens the publisher’s site)
- Tenable Blog · 3dDiscover and remediate PHP2Shell exposure with Tenable(opens the publisher’s site)
- SANS Internet Storm Center · 2dApple Patches for October 2026, (Mon, Oct 26th)(opens the publisher’s site)
- The Register (Security) · 2dCISA confirms PHP2Shell under attack as researchers clock successful exploits(opens the publisher’s site)
- Zscaler ThreatLabz · 1dCVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE(opens the publisher’s site)
- Canadian Centre for Cyber Security · 1dVMware security advisory (AV26-763) – Update 2(opens the publisher’s site)
- The Hacker News · 16hChina-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility(opens the publisher’s site)
- Security Affairs · 6hU.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog(opens the publisher’s site)
- Help Net Security · 6hChinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls(opens the publisher’s site)
- Palo Alto Networks Unit 42 · 4hThreat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)(opens the publisher’s site)
- The Register (Security) · 3hSuspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers(opens the publisher’s site)