CISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw
ZERO-DAYCVE-2026-41709redteam/daily · 36 sources
- Severity
- High
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 36
What happened
CISA added VMware ESX CVE-2026-41709 (insufficient logging, CVSS 7.6) and Linux kernel CVE-2026-46300 (Fragnesia) to its KEV catalogue. CrowdStrike reports that Warp Panda exploited the ESX flaw as a zero-day in early 2026 to reduce audit log visibility. The Cyber Centre also flagged exploitation of a Siemens Software Center DLL sideloading flaw and Gitea vulnerabilities, and urged administrators to apply updates.
For IT people · Written by AI from 36 sources · Wrong?
What to do
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-110264): 18.11.13, 19.0.10, 19.1.9, or see the CVE page for other lines.
- Update Paloaltonetworks Pan-os to the fixed version for your release line (fixes CVE-2026-109618): 10.2.7, 11.1.4, 11.2.4, or see the CVE page for other lines.
- CVE-2026-109618 is being exploited: treat it as urgent.
- Check whether you use Gitlab: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-110264CVSS 10.0An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to exec
- CVE-2026-109619CVSS 9.2ExploitedPHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on thi
- CVE-2026-109618CVSS 9.2ExploitedPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may r
- CVE-2026-111497CVSS 9.2ExploitedA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execu
- CVE-2026-112438CVSS 8.8A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.
- CVE-2026-112427CVSS 8.1An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause arbitrary code execution.
- CVE-2026-46300CVSS 7.8ExploitedIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache
- CVE-2026-112484CVSS 7.8This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to execute arbitrary code with system privileges.
- CVE-2026-112487CVSS 7.8A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
- CVE-2026-112457CVSS 7.1A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory.
- CVE-2026-112492CVSS 7.0A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
- CVE-2026-112414CVSS 6.5A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted message may lead to a denial-of-service.
- CVE-2026-112415CVSS 6.5An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt pr
- CVE-2026-112455CVSS 5.5An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user da
- CVE-2026-112479CVSS 5.2An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious USB device may be able to cause unexpected system termination or read kernel
- CVE-2026-112471CVSS 4.3A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected process termination.
- CVE-2026-41709CVSS 2.7ExploitedVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
- CVE-2020-8515Exploited
- CVE-2021-23758Exploited
- CVE-2021-27137Exploited
- CVE-2021-3156Exploited
- CVE-2021-31755Exploited
- CVE-2021-33044Exploited
- CVE-2021-33045Exploited
- CVE-2021-38003Exploited
- CVE-2021-4034Exploited
- CVE-2021-43798Exploited
- CVE-2021-44228Exploited
- CVE-2022-0847Exploited
- CVE-2022-0995Exploited
- CVE-2022-1040Exploited
- CVE-2022-22965Exploited
- CVE-2022-27925Exploited
- CVE-2022-47986Exploited
- CVE-2023-22527Exploited
- CVE-2023-25717Exploited
- CVE-2023-27350Exploited
- CVE-2023-27351Exploited
- CVE-2023-4346Exploited
- CVE-2023-46747Exploited
- CVE-2023-49105Exploited
- CVE-2024-21762Exploited
- CVE-2024-42009Exploited
- CVE-2024-4577Exploited
- CVE-2024-55591Exploited
- CVE-2025-24472Exploited
- CVE-2025-24813Exploited
- CVE-2025-25249Exploited
- CVE-2025-31324Exploited
- CVE-2025-32432Exploited
- CVE-2025-3248Exploited
- CVE-2025-39682Exploited
- CVE-2025-39964Exploited
- CVE-2025-43529Exploited
- CVE-2025-49113Exploited
- CVE-2025-55182Exploited
- CVE-2025-5777Exploited
- CVE-2025-62593Exploited
- CVE-2025-66376Exploited
- CVE-2025-68613Exploited
- CVE-2025-68686Exploited
- CVE-2026-0257Exploited
- CVE-2026-0300Exploited
- CVE-2026-0770Exploited
- CVE-2026-110936Exploited
- CVE-2026-114625Exploited
- CVE-2026-12569Exploited
- CVE-2026-15409Exploited
- CVE-2026-15410Exploited
- CVE-2026-16232Exploited
- CVE-2026-16812Exploited
- CVE-2026-18556Exploited
- CVE-2026-18577Exploited
- CVE-2026-19490Exploited
- CVE-2026-20079Exploited
- CVE-2026-20316Exploited
- CVE-2026-20349Exploited
- CVE-2026-21962Exploited
- CVE-2026-25089Exploited
- CVE-2026-3055Exploited
- CVE-2026-33017Exploited
- CVE-2026-33824Exploited
- CVE-2026-34486Exploited
- CVE-2026-34908Exploited
- CVE-2026-34909Exploited
- CVE-2026-34910Exploited
- CVE-2026-35273Exploited
- CVE-2026-39808Exploited
- CVE-2026-39987Exploited
- CVE-2026-42016Exploited
- CVE-2026-42018Exploited
- CVE-2026-42897Exploited
- CVE-2026-45659Exploited
- CVE-2026-46817Exploited
- CVE-2026-48282Exploited
- CVE-2026-48710Exploited
- CVE-2026-48907Exploited
- CVE-2026-48908Exploited
- CVE-2026-48939Exploited
- CVE-2026-49869Exploited
- CVE-2026-50522Exploited
- CVE-2026-53266Exploited
- CVE-2026-53362Exploited
- CVE-2026-5430Exploited
- CVE-2026-55040Exploited
- CVE-2026-55255Exploited
- CVE-2026-56155Exploited
- CVE-2026-56164Exploited
- CVE-2026-56290Exploited
- CVE-2026-56291Exploited
- CVE-2026-58644Exploited
- CVE-2026-58704Exploited
- CVE-2026-59310Exploited
- CVE-2026-59822Exploited
- CVE-2026-60004Exploited
- CVE-2026-60137Exploited
- CVE-2026-63030Exploited
- CVE-2026-63077Exploited
- CVE-2026-64849Exploited
- CVE-2026-65400Exploited
- CVE-2026-65660Exploited
- CVE-2026-66384Exploited
- CVE-2026-67277Exploited
- CVE-2026-67279Exploited
- CVE-2026-68820Exploited
- CVE-2026-71362Exploited
- CVE-2026-72529Exploited
- CVE-2026-72530Exploited
- CVE-2026-7273Exploited
- CVE-2026-72898Exploited
- CVE-2026-73570Exploited
- CVE-2026-75650Exploited
- CVE-2026-76460Exploited
- CVE-2026-76461Exploited
- CVE-2026-76504Exploited
- CVE-2026-8037Exploited
- CVE-2026-81578Exploited
- CVE-2026-81963Exploited
- CVE-2026-82078Exploited
- CVE-2026-82329Exploited
- CVE-2026-83548Exploited
- CVE-2026-83549Exploited
- CVE-2026-8452Exploited
- CVE-2026-84869Exploited
- CVE-2026-85046Exploited
- CVE-2026-85102Exploited
- CVE-2026-85706Exploited
- CVE-2026-85880Exploited
- CVE-2026-86060Exploited
- CVE-2026-86218Exploited
- CVE-2026-86950Exploited
- CVE-2026-87491Exploited
- CVE-2026-87886Exploited
- CVE-2026-87902Exploited
- CVE-2026-88771Exploited
- CVE-2026-88772Exploited
- CVE-2026-9198Exploited
- CVE-2026-93616Exploited
- CVE-2026-93952Exploited
- CVE-2026-94127Exploited
- CVE-2008-4128Exploited
- CVE-2026-9586Exploited
- CVE-2010-3904Exploited
- CVE-2014-6271Exploited
- CVE-2015-3246Exploited
- CVE-2015-5287Exploited
- CVE-2016-4437Exploited
- CVE-2017-0199Exploited
- CVE-2017-7269Exploited
- CVE-2017-7921Exploited
- CVE-2018-0802Exploited
- CVE-2018-14558Exploited
- CVE-2019-0708Exploited
- CVE-2019-1068Exploited
- CVE-2019-18935Exploited
- CVE-2020-0796Exploited
- CVE-2020-1472Exploited
- CVE-2020-1938Exploited
Full story timeline · 262 updates
- Wed 3 NovemberCVE-2020-8515 added to CISA’s exploited listCISA KEV
- CVE-2021-31755 added to CISA’s exploited listCISA KEV
- CVE-2021-38003 added to CISA’s exploited listCISA KEV
- CVE-2016-4437 added to CISA’s exploited listCISA KEV
- CVE-2017-0199 added to CISA’s exploited listCISA KEV
- CVE-2017-7269 added to CISA’s exploited listCISA KEV
- CVE-2018-0802 added to CISA’s exploited listCISA KEV
- CVE-2018-14558 added to CISA’s exploited listCISA KEV
- CVE-2019-0708 added to CISA’s exploited listCISA KEV
- CVE-2019-18935 added to CISA’s exploited listCISA KEV
- CVE-2020-1472 added to CISA’s exploited listCISA KEV
- Fri 10 DecemberCVE-2021-44228 added to CISA’s exploited listCISA KEV
- Fri 28 JanuaryCVE-2014-6271 added to CISA’s exploited listCISA KEV
- Thu 10 FebruaryCVE-2020-0796 added to CISA’s exploited listCISA KEV
- Thu 3 MarchCVE-2020-1938 added to CISA’s exploited listCISA KEV
- Thu 31 MarchCVE-2022-1040 added to CISA’s exploited listCISA KEV
- Mon 4 AprilCVE-2022-22965 added to CISA’s exploited listCISA KEV
- Wed 6 AprilCVE-2021-3156 added to CISA’s exploited listCISA KEV
- Mon 25 AprilCVE-2022-0847 added to CISA’s exploited listCISA KEV
- Mon 27 JuneCVE-2021-4034 added to CISA’s exploited listCISA KEV
- Thu 11 AugustCVE-2022-27925 added to CISA’s exploited listCISA KEV
- Tue 21 FebruaryCVE-2022-47986 added to CISA’s exploited listCISA KEV
- Fri 21 AprilCVE-2023-27350 added to CISA’s exploited listCISA KEV
- Fri 12 MayCVE-2023-25717 added to CISA’s exploited listCISA KEV
- CVE-2010-3904 added to CISA’s exploited listCISA KEV
- Tue 31 OctoberCVE-2023-46747 added to CISA’s exploited listCISA KEV
- Wed 24 JanuaryCVE-2023-22527 added to CISA’s exploited listCISA KEV
- Fri 9 FebruaryCVE-2024-21762 added to CISA’s exploited listCISA KEV
- Wed 12 JuneCVE-2024-4577 added to CISA’s exploited listCISA KEV
- Wed 21 AugustCVE-2021-33044 added to CISA’s exploited listCISA KEV
- CVE-2021-33045 added to CISA’s exploited listCISA KEV
- Tue 14 JanuaryCVE-2024-55591 added to CISA’s exploited listCISA KEV
- Tue 18 MarchCVE-2025-24472 added to CISA’s exploited listCISA KEV
- Tue 1 AprilCVE-2025-24813 added to CISA’s exploited listCISA KEV
- Tue 29 AprilCVE-2025-31324 added to CISA’s exploited listCISA KEV
- Mon 5 MayCVE-2025-3248 added to CISA’s exploited listCISA KEV
- Mon 9 JuneCVE-2024-42009 added to CISA’s exploited listCISA KEV
- Thu 10 JulyCVE-2025-5777 added to CISA’s exploited listCISA KEV
- Thu 9 OctoberCVE-2021-43798 added to CISA’s exploited listCISA KEV
- Fri 5 DecemberCVE-2025-55182 added to CISA’s exploited listCISA KEV
- Mon 15 DecemberCVE-2025-43529 added to CISA’s exploited listCISA KEV
- Fri 20 FebruaryCVE-2025-49113 added to CISA’s exploited listCISA KEV
- Thu 5 MarchCVE-2017-7921 added to CISA’s exploited listCISA KEV
- Wed 11 MarchCVE-2025-68613 added to CISA’s exploited listCISA KEV
- Wed 18 MarchCVE-2025-66376 added to CISA’s exploited listCISA KEV
- Fri 20 MarchCVE-2025-32432 added to CISA’s exploited listCISA KEV
- Wed 25 MarchCVE-2026-33017 added to CISA’s exploited listCISA KEV
- Sun 29 MarchPlease, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)watchTowr Labs
- Mon 30 MarchCVE-2026-3055 added to CISA’s exploited listCISA KEV
- Mon 20 AprilCVE-2023-27351 added to CISA’s exploited listCISA KEV
- Thu 23 AprilCVE-2026-39987 added to CISA’s exploited listCISA KEV
- Wed 6 MayCVE-2026-0300 added to CISA’s exploited listCISA KEV
- Fri 15 MayCVE-2026-42897 added to CISA’s exploited listCISA KEV
- Sat 23 MayCVE-2026-46300 published, CVSS 7.8NVD
- Fri 29 MayCVE-2026-0257 added to CISA’s exploited listCISA KEV
- Fri 12 JuneCVE-2026-35273 added to CISA’s exploited listCISA KEV
- CVE-2026-48907: Unauthenticated RCE in the Joomla Content Editor extensionYesWeHack
- Tue 16 JuneCVE-2026-48907 added to CISA’s exploited listCISA KEV
- Tue 23 JuneCVE-2026-34908 added to CISA’s exploited listCISA KEV
- CVE-2026-34909 added to CISA’s exploited listCISA KEV
- CVE-2026-34910 added to CISA’s exploited listCISA KEV
- Thu 25 JuneCVE-2026-12569 added to CISA’s exploited listCISA KEV
- Mon 29 JuneEnterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)watchTowr Labs
- Tue 30 JuneCitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)watchTowr Labs
- Wed 1 JulyCVE-2026-45659 added to CISA’s exploited listCISA KEV
- The June 2026 Apple Security Update ReviewZero Day Initiative Blog
- Thu 2 JulyIt’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)watchTowr Labs
- Tue 7 JulyCVE-2026-48282 added to CISA’s exploited listCISA KEV
- CVE-2026-48908 added to CISA’s exploited listCISA KEV
- CVE-2026-55255 added to CISA’s exploited listCISA KEV
- CVE-2026-56290 added to CISA’s exploited listCISA KEV
- Fri 10 JulyCVE-2026-48939 added to CISA’s exploited listCISA KEV
- CVE-2026-56291 added to CISA’s exploited listCISA KEV
- Mon 13 JulyCVE-2008-4128 added to CISA’s exploited listCISA KEV
- Tue 14 JulyCVE-2026-15409 added to CISA’s exploited listCISA KEV
- CVE-2026-15410 added to CISA’s exploited listCISA KEV
- CVE-2026-56155 added to CISA’s exploited listCISA KEV
- CVE-2026-56164 added to CISA’s exploited listCISA KEV
- The July 2026 Security Update ReviewZero Day Initiative Blog
- Wed 15 JulyCVE-2023-4346 added to CISA’s exploited listCISA KEV
- CVE-2026-46817 added to CISA’s exploited listCISA KEV
- Thu 16 JulyCVE-2026-25089 added to CISA’s exploited listCISA KEV
- CVE-2026-39808 added to CISA’s exploited listCISA KEV
- CVE-2026-58644 added to CISA’s exploited listCISA KEV
- Fri 17 JulyProxying to Compromise: SonicWall Secure Mobile Access 0-day ExploitationVolexity
- Tue 21 JulyCVE-2021-27137 added to CISA’s exploited listCISA KEV
- CVE-2026-0770 added to CISA’s exploited listCISA KEV
- CVE-2026-60137 added to CISA’s exploited listCISA KEV
- CVE-2026-63030 added to CISA’s exploited listCISA KEV
- Wed 22 JulyCVE-2026-16232 added to CISA’s exploited listCISA KEV
- CVE-2026-50522 added to CISA’s exploited listCISA KEV
- Mon 27 JulyCVE-2025-68686 added to CISA’s exploited listCISA KEV
- CVE-2026-16812 added to CISA’s exploited listCISA KEV
- Wed 29 JulyCVE-2026-20316 added to CISA’s exploited listCISA KEV
- Thu 30 JulyThe July 2026 Apple Security Update ReviewZero Day Initiative Blog
- CVE-2026-41709 published, CVSS 2.7NVD
- Mon 3 AugustCVE-2026-18577 added to CISA’s exploited listCISA KEV
- Tue 4 AugustCVE-2026-18556 added to CISA’s exploited listCISA KEV
- CVE-2026-34486 added to CISA’s exploited listCISA KEV
- CVE-2026-9198 added to CISA’s exploited listCISA KEV
- Wed 5 AugustCVE-2026-63077 added to CISA’s exploited listCISA KEV
- Fri 7 AugustJuly 2026 CVE LandscapeRecorded Future Blog
- CVE-2026-8037 added to CISA’s exploited listCISA KEV
- Mon 10 AugustInside the Metabase SQLi: Exploited in the WildWiz Blog
- Tue 11 AugustCVE-2026-20349 added to CISA’s exploited listCISA KEV
- CVE-2026-68820 added to CISA’s exploited listCISA KEV
- CVE-2026-72898 added to CISA’s exploited listCISA KEV
- The August 2026 Security Update ReviewZero Day Initiative Blog
- Fri 14 AugustYou’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))watchTowr Labs
- Mon 17 AugustCVE-2025-62593 added to CISA’s exploited listCISA KEV
- Tue 18 AugustCVE-2026-33824 added to CISA’s exploited listCISA KEV
- CVE-2026-55040 added to CISA’s exploited listCISA KEV
- CVE-2026-59310 added to CISA’s exploited listCISA KEV
- CVE-2026-65400 added to CISA’s exploited listCISA KEV
- Wed 19 AugustCVE-2026-64849 added to CISA’s exploited listCISA KEV
- Thu 20 AugustCVE-2026-72529 added to CISA’s exploited listCISA KEV
- CVE-2026-72530 added to CISA’s exploited listCISA KEV
- Fri 21 AugustCVE-2026-73570 added to CISA’s exploited listCISA KEV
- Mon 24 AugustCVE-2026-21962 added to CISA’s exploited listCISA KEV
- Tue 25 AugustCVE-2026-60004 added to CISA’s exploited listCISA KEV
- Wed 26 AugustCVE-2021-23758 added to CISA’s exploited listCISA KEV
- CVE-2022-0995 added to CISA’s exploited listCISA KEV
- CVE-2026-8452 added to CISA’s exploited listCISA KEV
- CVE-2015-3246 added to CISA’s exploited listCISA KEV
- CVE-2015-5287 added to CISA’s exploited listCISA KEV
- CVE-2019-1068 added to CISA’s exploited listCISA KEV
- Thu 27 AugustCVE-2023-49105 added to CISA’s exploited listCISA KEV
- CVE-2026-53362 added to CISA’s exploited listCISA KEV
- CVE-2026-66384 added to CISA’s exploited listCISA KEV
- Mon 31 AugustCVE-2026-81578 added to CISA’s exploited listCISA KEV
- CVE-2026-82078 added to CISA’s exploited listCISA KEV
- Wed 2 SeptemberCVE-2026-48710 added to CISA’s exploited listCISA KEV
- CVE-2026-49869 added to CISA’s exploited listCISA KEV
- CVE-2026-59822 added to CISA’s exploited listCISA KEV
- CVE-2026-82329 added to CISA’s exploited listCISA KEV
- CVE-2026-83548 added to CISA’s exploited listCISA KEV
- CVE-2026-83549 added to CISA’s exploited listCISA KEV
- CVE-2026-9586 added to CISA’s exploited listCISA KEV
- Fri 4 SeptemberCVE-2026-85046 added to CISA’s exploited listCISA KEV
- Tue 8 SeptemberAugust 2026 CVE LandscapeRecorded Future Blog
- CVE-2026-75650 added to CISA’s exploited listCISA KEV
- CVE-2026-81963 added to CISA’s exploited listCISA KEV
- CVE-2026-85880 added to CISA’s exploited listCISA KEV
- CVE-2026-86218 added to CISA’s exploited listCISA KEV
- Wed 9 SeptemberCVE-2025-25249 added to CISA’s exploited listCISA KEV
- CVE-2026-19490 added to CISA’s exploited listCISA KEV
- CVE-2026-20079 added to CISA’s exploited listCISA KEV
- CVE-2026-87491 added to CISA’s exploited listCISA KEV
- CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gapYesWeHack
- Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & WindowsVolexity
- Thu 10 SeptemberCVE-2026-67277 added to CISA’s exploited listCISA KEV
- CVE-2026-86060 added to CISA’s exploited listCISA KEV
- Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329Wiz Blog
- Fri 11 SeptemberCVE-2026-42016 added to CISA’s exploited listCISA KEV
- CVE-2026-42018 added to CISA’s exploited listCISA KEV
- CVE-2026-84869 added to CISA’s exploited listCISA KEV
- CVE-2026-85706 added to CISA’s exploited listCISA KEV
- Mon 14 SeptemberCVE-2026-76461 added to CISA’s exploited listCISA KEV
- Wed 16 SeptemberCVE-2026-58704 added to CISA’s exploited listCISA KEV
- CVE-2026-76460 added to CISA’s exploited listCISA KEV
- CVE-2026-87886 added to CISA’s exploited listCISA KEV
- The Apple Security Update Review for September 2026Zero Day Initiative Blog
- Fri 18 SeptemberCVE-2025-39682 added to CISA’s exploited listCISA KEV
- CVE-2025-39964 added to CISA’s exploited listCISA KEV
- CVE-2026-53266 added to CISA’s exploited listCISA KEV
- Mon 21 SeptemberCVE-2026-7273 added to CISA’s exploited listCISA KEV
- Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day ExploitsVolexity
- Tue 22 SeptemberCVE-2026-85102 added to CISA’s exploited listCISA KEV
- CVE-2026-93616 added to CISA’s exploited listCISA KEV
- CVE-2026-93952 added to CISA’s exploited listCISA KEV
- CVE-2026-94127 added to CISA’s exploited listCISA KEV
- Thu 24 SeptemberIs This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)watchTowr Labs
- CVE-2026-5430 added to CISA’s exploited listCISA KEV
- CVE-2026-71362 added to CISA’s exploited listCISA KEV
- Fri 25 SeptemberCVE-2026-65660 added to CISA’s exploited listCISA KEV
- CVE-2026-67279 added to CISA’s exploited listCISA KEV
- CVE-2026-87902 added to CISA’s exploited listCISA KEV
- Sun 27 SeptemberCVE-2026-88771 added to CISA’s exploited listCISA KEV
- CVE-2026-88772 added to CISA’s exploited listCISA KEV
- Mon 28 SeptemberOh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)watchTowr Labs
- Tue 29 SeptemberCVE-2026-86950 added to CISA’s exploited listCISA KEV
- Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)watchTowr Labs
- Wed 30 SeptemberCVE-2026-76504 added to CISA’s exploited listCISA KEV
- Fri 9 OctoberDeath By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)watchTowr Labs
- Tue 13 OctoberSeptember 2026 CVE LandscapeRecorded Future Blog
- Fri 16 OctoberCVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE VulnerabilityZscaler ThreatLabz
- Tue 20 OctoberCVE-2026-110936 added to CISA’s exploited listCISA KEV
- Gitea security advisory (AV26-845) - Update 1Canadian Centre for Cyber Security
- Siemens security advisory (AV26-1063) – Update 1Canadian Centre for Cyber Security
- Wed 21 OctoberPHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediationDatadog Security Labs
- PHP2Shell Exploitation: Two Critical PHP Flaws ExplainedRecorded Future Blog
- Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell NowQualys Threat Research
- Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)Huntress Blog
- php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilitiesTenable Blog
- Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)Orca Security Blog
- CVE-2026-109618 published, CVSS 9.2NVD
- CVE-2026-109619 published, CVSS 9.2NVD
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatchedThe Register (Security)
- Two critical RCEs in PHP coreCisco Talos
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)Kaspersky Securelist
- CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPRapid7 Blog
- Widespread PHP Flaw May Cause Many Site Outages TodayKrebs on Security
- PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites OfflineSocket Blog
- PHP2Shell: How to Protect Your Server | Kaspersky official blogKaspersky Daily
- PHP2Shell: Why many websites had to go offlineMalwarebytes Labs
- PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency PatchesSocket Blog
- CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE AttacksZscaler ThreatLabz
- Thu 22 OctoberPHP blames supply chain security biz Chainguard for putting huge chunks of the web at riskThe Register (Security)
- [remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCEExploit-DB
- Understanding PHP2Shell: Everything you need to know about CVE-2026-109618 & CVE-2026-109619Intigriti
- CVE-2026-110264 published, CVSS 10.0NVD
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosureThe Register (Security)
- New Serious PHP Vulnerabilities Released and PatchedSchneier on Security
- CVE-2026-111497 published, CVSS 9.2NVD
- PHP2Shell puts dozens of UK government services out of serviceThe Register (Security)
- PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code ExecutionArctic Wolf Labs
- PHP2Shell Exposure Depends on More Than Whether You Use PHPHorizon3.ai
- PHP2Shell exploit bypasses protections designed to stop remote code executionThe Register (Security)
- How new PHP vulnerabilities threaten home users | Kaspersky official blogKaspersky Daily
- The adversary economy: How threat actors are reacting to PHP2ShellTenable Blog
- Fri 23 OctoberCVE-2026-114625 added to CISA’s exploited listCISA KEV
- PHP Unveils Critical “Internet-Wide” Vulnerabilities: How Can Web3 Patch Its “Off-Chain Weaknesses”?SlowMist
- PHP2Shell x Burp Suite: Detection in your hands within a day of disclosurePortSwigger Blog
- PHP2Shell: What This Week Tells Us About the Web We BuiltOrca Security Blog
- CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now AvailableHorizon3.ai
- There's a third PHP2Shell bug, but it won't get an emergency fixThe Register (Security)
- Sun 25 OctoberBroccoli2shell: Everything You Need To Know About The Critical Brotli Decoder VulnerabilityWiz Blog
- Mon 26 OctoberCVE-2026-109619 added to CISA’s exploited listCISA KEV
- CVE-2026-109618 added to CISA’s exploited listCISA KEV
- Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You OwnQualys Threat Research
- PHP2Shell: No login, no app code, no warning. What next?The Register (Security)
- PHP2Shell: What to know about two critical PHP flawsESET WeLiveSecurity
- 26th October – Threat Intelligence ReportCheck Point Research
- PHP2Shell: From the attacker’s perspectiveOrca Security Blog
- CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoderRapid7 Blog
- Discover and remediate PHP2Shell exposure with TenableTenable Blog
- CVE-2026-112414 published, CVSS 6.5NVD
- CVE-2026-112415 published, CVSS 6.5NVD
- CVE-2026-112427 published, CVSS 8.1NVD
- CVE-2026-112438 published, CVSS 8.8NVD
- CVE-2026-112455 published, CVSS 5.5NVD
- CVE-2026-112457 published, CVSS 7.1NVD
- CVE-2026-112471 published, CVSS 4.3NVD
- CVE-2026-112479 published, CVSS 5.2NVD
- CVE-2026-112484 published, CVSS 7.8NVD
- CVE-2026-112487 published, CVSS 7.8NVD
- CVE-2026-112492 published, CVSS 7.0NVD
- Tue 27 OctoberCVE-2026-111497 added to CISA’s exploited listCISA KEV
- Apple Patches for October 2026, (Mon, Oct 26th)SANS Internet Storm Center
- CISA confirms PHP2Shell under attack as researchers clock successful exploitsThe Register (Security)
- CVE-2026-35273: SSRF to RCE in Oracle PeopleSoftZero Day Initiative Blog
- Wed 28 OctoberCVE-2026-46300 added to CISA’s exploited listCISA KEV
- CVE-2026-41709 added to CISA’s exploited listCISA KEV
- CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCEZscaler ThreatLabz
- VMware security advisory (AV26-763) – Update 2Canadian Centre for Cyber Security
- Thu 29 OctoberNode2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoderDatadog Security Labs
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail VisibilityThe Hacker News
- U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
- Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewallsHelp Net Security
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)Palo Alto Networks Unit 42
- Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 serversThe Register (Security)
- Sun 1 NovemberHacktober – Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few MoreCyber Security News
Who reported · 36 outlets
watchTowr LabsYesWeHackZero Day Initiative BlogVolexityRecorded Future BlogWiz BlogZscaler ThreatLabzCanadian Centre for Cyber SecurityDatadog Security LabsQualys Threat ResearchHuntress BlogTenable BlogOrca Security BlogThe Register (Security)Cisco TalosKaspersky SecurelistRapid7 BlogKrebs on SecuritySocket BlogKaspersky DailyMalwarebytes LabsExploit-DBIntigritiSchneier on SecurityArctic Wolf LabsHorizon3.aiSlowMistPortSwigger BlogESET WeLiveSecurityCheck Point ResearchSANS Internet Storm CenterThe Hacker NewsSecurity AffairsHelp Net SecurityPalo Alto Networks Unit 42Cyber Security News
Who and what is in it
Companies
Products