{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "php",
    "label": "PHP",
    "kind": "language",
    "url": "https://pwn.watch/s/php",
    "feed": "https://pwn.watch/s/php/feed.xml"
  },
  "counts": {
    "incidents": 10,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 8
  },
  "incidents": [
    {
      "slug": "updraftcentral-keys-wordpress-backdoor",
      "title": "TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored",
      "url": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor",
      "json": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "partial",
      "product": "UpdraftPlus / UpdraftCentral (WordPress)",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Sites with stolen UpdraftCentral connection keys"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-18",
      "closedAt": "2026-10-20",
      "updatedAt": "2026-10-20",
      "summary": "UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral."
    },
    {
      "slug": "php2shell-cve-2026-109618-109619",
      "title": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619",
      "json": "https://pwn.watch/i/php2shell-cve-2026-109618-109619.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "PHP",
      "stacks": [
        "php"
      ],
      "cveIds": [
        "CVE-2026-109618",
        "CVE-2026-109619"
      ],
      "affectedVersions": [
        "PHP 5.4 through 8.5.11 (all branches serving web requests); EOL 8.1 and earlier unpatched by the PHP project"
      ],
      "fixedVersions": [
        "8.5.12",
        "8.4.27",
        "8.3.36",
        "8.2.35"
      ],
      "startedAt": "2026-10-17",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:58:57+02:00",
      "summary": "Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning."
    },
    {
      "slug": "rank-math-pro-wordpress-backdoor",
      "title": "Rank Math PRO WordPress plugin download backdoored",
      "url": "https://pwn.watch/i/rank-math-pro-wordpress-backdoor",
      "json": "https://pwn.watch/i/rank-math-pro-wordpress-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Rank Math PRO (WordPress)",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [],
      "affectedVersions": [
        "3.0.123 (compromised download window)"
      ],
      "fixedVersions": [
        "Clean PRO builds after incident"
      ],
      "startedAt": "2026-10-15",
      "closedAt": "2026-10-16",
      "updatedAt": "2026-10-16",
      "summary": "SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild."
    },
    {
      "slug": "wordpress-core-cve-2026-87902",
      "title": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-87902.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [
        "CVE-2026-87902"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-25",
      "closedAt": "2026-09-25",
      "updatedAt": "2026-09-25",
      "summary": "WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25."
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2026-71362",
      "title": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento ",
      "stacks": [
        "php"
      ],
      "cveIds": [
        "CVE-2026-71362"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-24",
      "closedAt": "2026-09-24",
      "updatedAt": "2026-09-24",
      "summary": "Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24."
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2026-75650",
      "title": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento",
      "stacks": [
        "php"
      ],
      "cveIds": [
        "CVE-2026-75650"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-08",
      "closedAt": "2026-09-08",
      "updatedAt": "2026-09-08",
      "summary": "Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Added to CISA KEV on 2026-09-08."
    },
    {
      "slug": "wordpress-core-cve-2026-60137",
      "title": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-60137.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [
        "CVE-2026-60137",
        "CVE-2026-63030"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-21",
      "closedAt": "2026-07-21",
      "updatedAt": "2026-07-21",
      "summary": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation."
    },
    {
      "slug": "joomlack-page-builder-cve-2026-56290",
      "title": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability",
      "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290",
      "json": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Joomlack Page Builder",
      "stacks": [
        "php"
      ],
      "cveIds": [
        "CVE-2026-56290"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-07",
      "closedAt": "2026-07-07",
      "updatedAt": "2026-07-07",
      "summary": "Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. Added to CISA KEV on 2026-07-07."
    },
    {
      "slug": "widget-factory-joomla-content-editor-cve-2026-48907",
      "title": "Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
      "url": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907",
      "json": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Widget Factory Joomla Content Editor ",
      "stacks": [
        "php"
      ],
      "cveIds": [
        "CVE-2026-48907"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-16",
      "closedAt": "2026-06-16",
      "updatedAt": "2026-06-16",
      "summary": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Added to CISA KEV on 2026-06-16."
    },
    {
      "slug": "drupal-core-cve-2026-9082",
      "title": "Drupal Core: Drupal Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/drupal-core-cve-2026-9082",
      "json": "https://pwn.watch/i/drupal-core-cve-2026-9082.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Drupal Core",
      "stacks": [
        "php"
      ],
      "cveIds": [
        "CVE-2026-9082"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-22",
      "closedAt": "2026-05-22",
      "updatedAt": "2026-05-22",
      "summary": "Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22."
    }
  ],
  "changes": [
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established.",
      "body": null,
      "sourceUrl": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts.",
      "body": null,
      "sourceUrl": "https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands.",
      "body": null,
      "sourceUrl": "https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases.",
      "body": null,
      "sourceUrl": "https://www.php.net/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Cloudflare deploys free default WAF rules (request + response signals) for all customers.",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21/22",
      "title": "PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known.",
      "body": null,
      "sourceUrl": "https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "wordpress-core-cve-2026-87902",
      "incidentTitle": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-25",
      "title": "CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2026-71362",
      "incidentTitle": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-24",
      "title": "CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2026-75650",
      "incidentTitle": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-08",
      "title": "CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650"
    },
    {
      "incident": "wordpress-core-cve-2026-60137",
      "incidentTitle": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-21",
      "title": "CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137"
    },
    {
      "incident": "joomlack-page-builder-cve-2026-56290",
      "incidentTitle": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-07",
      "title": "CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290"
    },
    {
      "incident": "widget-factory-joomla-content-editor-cve-2026-48907",
      "incidentTitle": "Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-16",
      "title": "CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907"
    },
    {
      "incident": "drupal-core-cve-2026-9082",
      "incidentTitle": "Drupal Core: Drupal Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-22",
      "title": "CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/drupal-core-cve-2026-9082"
    }
  ]
}