Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents

Oct 25, 2026

0 new incidents, 1 with updates.

Updated

  • LiveCriticalPartly patched

    PHP2Shell: critical unauthenticated RCE in PHP core

    Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (QNAP shipped NAS firmware fixes Oct 24; other appliance vendors are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.

    PHPSince Oct 17, 2026

Sponsored

Buy sponsor slot · $149/mo