{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:40:31.642Z",
  "tag": {
    "id": "apache",
    "label": "Apache",
    "isStack": false,
    "url": "https://pwn.watch/t/apache",
    "feed": "https://pwn.watch/t/apache/feed.xml"
  },
  "counts": {
    "incidents": 14,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 13
  },
  "incidents": [
    {
      "slug": "php2shell-cve-2026-109618-109619",
      "title": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619",
      "json": "https://pwn.watch/i/php2shell-cve-2026-109618-109619.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "PHP",
      "tags": [
        "php",
        "apache",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-109618",
        "CVE-2026-109619"
      ],
      "affectedVersions": [
        "PHP 5.4 through 8.5.11 (all branches serving web requests); EOL 8.1 and earlier unpatched by the PHP project"
      ],
      "fixedVersions": [
        "8.5.12",
        "8.4.27",
        "8.3.36",
        "8.2.35"
      ],
      "startedAt": "2026-10-17",
      "closedAt": null,
      "updatedAt": "2026-10-22T19:39:46+02:00",
      "summary": "Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.",
      "xPost": null
    },
    {
      "slug": "apache-tomcat-cve-2026-34486",
      "title": "Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
      "url": "https://pwn.watch/i/apache-tomcat-cve-2026-34486",
      "json": "https://pwn.watch/i/apache-tomcat-cve-2026-34486.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apache Tomcat",
      "tags": [
        "java",
        "apache",
        "tomcat",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-34486"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-04",
      "closedAt": "2026-08-04",
      "updatedAt": "2026-08-04",
      "summary": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04.",
      "xPost": null
    },
    {
      "slug": "apache-activemq-cve-2026-34197",
      "title": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability",
      "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197",
      "json": "https://pwn.watch/i/apache-activemq-cve-2026-34197.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apache ActiveMQ",
      "tags": [
        "java",
        "apache",
        "activemq",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-34197"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-16",
      "closedAt": "2026-04-16",
      "updatedAt": "2026-04-16",
      "summary": "Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16.",
      "xPost": null
    },
    {
      "slug": "apache-http-server-cve-2024-38475",
      "title": "Apache HTTP Server: HTTP Server Improper Escaping of Output Vulnerability",
      "url": "https://pwn.watch/i/apache-http-server-cve-2024-38475",
      "json": "https://pwn.watch/i/apache-http-server-cve-2024-38475.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache HTTP Server",
      "tags": [
        "apache",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-38475"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-05-01",
      "closedAt": "2025-05-01",
      "updatedAt": "2025-05-01",
      "summary": "Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Added to CISA KEV on 2025-05-01.",
      "xPost": null
    },
    {
      "slug": "apache-tomcat-cve-2025-24813",
      "title": "Apache Tomcat: Tomcat Path Equivalence Vulnerability",
      "url": "https://pwn.watch/i/apache-tomcat-cve-2025-24813",
      "json": "https://pwn.watch/i/apache-tomcat-cve-2025-24813.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache Tomcat",
      "tags": [
        "java",
        "apache",
        "tomcat",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-24813"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-04-01",
      "closedAt": "2025-04-01",
      "updatedAt": "2025-04-01",
      "summary": "Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486. Added to CISA KEV on 2025-04-01.",
      "xPost": null
    },
    {
      "slug": "apache-ofbiz-cve-2024-45195",
      "title": "Apache OFBiz: OFBiz Forced Browsing Vulnerability",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-45195",
      "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-45195.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache OFBiz",
      "tags": [
        "java",
        "apache",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-45195"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-04",
      "closedAt": "2025-02-04",
      "updatedAt": "2025-02-04",
      "summary": "Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. Added to CISA KEV on 2025-02-04.",
      "xPost": null
    },
    {
      "slug": "apache-ofbiz-cve-2024-38856",
      "title": "Apache OFBiz Incorrect Authorization",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856",
      "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apache OFBiz",
      "tags": [
        "java",
        "apache",
        "ofbiz",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-38856"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-05",
      "closedAt": "2024-08-27",
      "updatedAt": "2024-08-27",
      "summary": "Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Added to the CISA KEV catalog on 2024-08-27.",
      "xPost": null
    },
    {
      "slug": "apache-flink-cve-2020-17519",
      "title": "Apache Flink Improper Access Control",
      "url": "https://pwn.watch/i/apache-flink-cve-2020-17519",
      "json": "https://pwn.watch/i/apache-flink-cve-2020-17519.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache Flink",
      "tags": [
        "java",
        "apache",
        "flink",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2020-17519"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-05-23",
      "closedAt": "2024-05-23",
      "updatedAt": "2024-05-23",
      "summary": "Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Added to the CISA KEV catalog on 2024-05-23. CVE-2020-17519 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "apache-ofbiz-cve-2024-32113",
      "title": "Apache OFBiz Path Traversal",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113",
      "json": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache OFBiz",
      "tags": [
        "java",
        "apache",
        "ofbiz",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-32113"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-05-08",
      "closedAt": "2024-08-07",
      "updatedAt": "2024-08-07",
      "summary": "Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-07.",
      "xPost": null
    },
    {
      "slug": "apache-hugegraph-server-cve-2024-27348",
      "title": "Apache HugeGraph-Server Improper Access Control",
      "url": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348",
      "json": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache HugeGraph-Server",
      "tags": [
        "java",
        "apache",
        "hugegraph",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-27348"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-04-22",
      "closedAt": "2024-09-18",
      "updatedAt": "2024-09-18",
      "summary": "Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.",
      "xPost": null
    },
    {
      "slug": "apache-superset-cve-2023-27524",
      "title": "Apache Superset Insecure Default Initialization of Resource",
      "url": "https://pwn.watch/i/apache-superset-cve-2023-27524",
      "json": "https://pwn.watch/i/apache-superset-cve-2023-27524.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apache Superset",
      "tags": [
        "python",
        "apache",
        "superset",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-27524"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-08",
      "closedAt": "2024-01-08",
      "updatedAt": "2024-01-08",
      "summary": "Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "apache-activemq-openwire-rce-cve-2023-46604",
      "title": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604",
      "json": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache ActiveMQ (Java OpenWire brokers and clients)",
      "tags": [
        "java",
        "apache",
        "activemq",
        "rce",
        "deserialization",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-46604"
      ],
      "affectedVersions": [
        "See vendor advisory"
      ],
      "fixedVersions": [
        "5.15.16",
        "5.16.7",
        "5.17.6",
        "5.18.3"
      ],
      "startedAt": "2023-10-27",
      "closedAt": "2023-11-02",
      "updatedAt": "2023-11-02",
      "summary": "A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.",
      "xPost": null
    },
    {
      "slug": "apache-rocketmq-cve-2023-33246",
      "title": "Apache RocketMQ: Command Execution (CVE-2023-33246)",
      "url": "https://pwn.watch/i/apache-rocketmq-cve-2023-33246",
      "json": "https://pwn.watch/i/apache-rocketmq-cve-2023-33246.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apache RocketMQ",
      "tags": [
        "java",
        "apache",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-33246"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-06",
      "closedAt": "2023-09-06",
      "updatedAt": "2023-09-06",
      "summary": "Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. Added to CISA KEV on 2023-09-06.",
      "xPost": null
    },
    {
      "slug": "apache-spark-cve-2022-33891",
      "title": "Apache Spark: Command Injection (CVE-2022-33891)",
      "url": "https://pwn.watch/i/apache-spark-cve-2022-33891",
      "json": "https://pwn.watch/i/apache-spark-cve-2022-33891.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apache Spark",
      "tags": [
        "java",
        "apache",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2022-33891"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-07",
      "closedAt": "2023-03-07",
      "updatedAt": "2023-03-07",
      "summary": "Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. Added to CISA KEV on 2023-03-07.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "CFEngine",
      "handle": "cfengine",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1372576585023377411/ZsifG3ft_bigger.jpg",
      "text": "CFEngine 3.24.6 and 3.27.3 have been released to address the recent PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619), popularly dubbed PHP2Shell. Read more:\n\nhttps://t.co/pNOF1MWTZV",
      "date": "2026-10-22T17:23:55.000Z",
      "url": "https://x.com/cfengine/status/2113320458363793491",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "CrowdSec",
      "handle": "Crowd_Security",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1323565720098263041/1l9LNG8w_bigger.jpg",
      "text": "Can't patch every box today? The CrowdSec WAF has free, tentative virtual patches for both CVEs:\n\ncscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109618\ncscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109619\n\nA stopgap, not a fix: still update PHP.",
      "date": "2026-10-22T15:53:55.000Z",
      "url": "https://x.com/Crowd_Security/status/2113297809902354714",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Zed Attack Proxy",
      "handle": "zaproxy",
      "avatarUrl": "https://pbs.twimg.com/profile_images/935515807949434880/T8RuttbQ_bigger.jpg",
      "text": "Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP\nPHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.\nhttps://t.co/9G4DtEhMM6\n#php2shell",
      "date": "2026-10-22T15:43:23.000Z",
      "url": "https://x.com/zaproxy/status/2113295172385861906",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "George Kurtz",
      "handle": "George_Kurtz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/626477904650637312/81MQqLz9_bigger.jpg",
      "text": "#PHP2Shell is a big one. Here are my takeaways.\n\n1. These flaws reach back more than a decade. PHP’s maintainers identified one underlying problem in 2024, but its full impact wasn’t clear until AI-assisted research demonstrated its exploitability. What seems impractical to exploit today could easily be exploitable tomorrow as models advance.\n\n2. Much of the web runs on PHP, and a lot of it is on versions that are out of support. Some get a source backport you must build yourself. Some get nothing. Attackers aren't hunting the servers you just patched. They're hunting the ones you forgot you own. There is going to be a very long tail on remediating these vulnerabilities, and we will see many downstream breaches over the coming months.\n\n3. The patching window has completely collapsed. While we’ve exponentially found more vulnerabilities and exponentially created more patches, we’ve hit the sound barrier on operationally rolling them out. Even more concerning is the increase in exploitation occurring before or on the day of disclosure. When a flaw gets exploited, almost 90% of the time it’s hit on or before the day it’s disclosed. As defenders, you need to be looking at your watch, not a calendar!\n\n4. Coordinated disclosure in open source is really hard. It runs on trust, not contracts. There were many people in the loop, and for good reason. Lots of great people doing incredible work. However, I expect leaked disclosures will be the norm, not the exception, as we move forward in the Agent-state era.\n\nThe @a16z chart below says it all.",
      "date": "2026-10-22T14:51:29.000Z",
      "url": "https://x.com/George_Kurtz/status/2113282095342592366",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVPfySNXsAAKkIg.jpg"
        }
      ],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Appwrite",
      "handle": "appwrite",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2039591646095093760/w0wOnRMo_bigger.jpg",
      "text": "An update on PHP2Shell and the eMudhra certificate compromise.\n\nWe've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region.\n \nHere's what we've checked and what self-hosted users should do. 🧵",
      "date": "2026-10-22T12:46:16.000Z",
      "url": "https://x.com/appwrite/status/2113250583998316980",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "ピクシブ株式会社 pixiv Inc.",
      "handle": "pixiv_corp",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1046601582714867713/ExVB0Dlo_bigger.jpg",
      "text": "【#pixiv_inside】\nPHP 8.5.12の緊急リリースに\npixivはどう対応したか\nhttps://t.co/zYpXH9HWOy\n\nPHPにて緊急セキュリティリリースが予告され\npixivも対応しました。\n\nセキュリティアップデート公開から\npixivメンテナンス明けまで約30分の対応を\nビルド・デプロイ基盤も踏まえながら説明します✍️",
      "date": "2026-10-22T10:41:42.000Z",
      "url": "https://x.com/pixiv_corp/status/2113219235975762423",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Werner Vogels",
      "handle": "Werner",
      "avatarUrl": "https://pbs.twimg.com/profile_images/563188960394891264/z3-Rh11q_bigger.jpeg",
      "text": "Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) https://t.co/TW2zDAFV6K",
      "date": "2026-10-22T10:36:28.000Z",
      "url": "https://x.com/Werner/status/2113217918742000089",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Matthew Prince 🌥",
      "handle": "eastdakota",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2332322635/zhx7hflmmcxdaj0tk9f8_bigger.jpeg",
      "text": "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.",
      "date": "2026-10-22T01:25:51.000Z",
      "url": "https://x.com/eastdakota/status/2113079352682570051",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Matthew Prince 🌥",
      "handle": "eastdakota",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2332322635/zhx7hflmmcxdaj0tk9f8_bigger.jpeg",
      "text": "Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.\n\ntl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.",
      "date": "2026-10-21T15:44:45.000Z",
      "url": "https://x.com/eastdakota/status/2112933115215905229",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Cloudflare",
      "handle": "Cloudflare",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2110452337764413440/6WKZL9q3_bigger.jpg",
      "text": "Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://t.co/OQG4x6x858",
      "date": "2026-10-21T14:16:59.000Z",
      "url": "https://x.com/Cloudflare/status/2112911026437935381",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Huntress",
      "handle": "HuntressLabs",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2078261992297807872/_K7T5OWR_bigger.jpg",
      "text": "Huntress is aware of reports circulating regarding two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in several versions of PHP (versions 5, 6, 7, and 8). 🧵",
      "date": "2026-10-20T23:19:46.000Z",
      "url": "https://x.com/HuntressLabs/status/2112685233275318290",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Eric Taylor",
      "handle": "bcs_erictaylor",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1667335479958577153/qsT-tCdx_bigger.jpg",
      "text": "PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)\n\nInformation about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm https://t.co/PKEZK7yYVe",
      "date": "2026-10-20T22:48:50.000Z",
      "url": "https://x.com/bcs_erictaylor/status/2112677451520164300",
      "media": [
        {
          "type": "video",
          "url": "https://pbs.twimg.com/amplify_video_thumb/2112677297119494144/img/YEWSU7iLnuASqo71.jpg"
        }
      ],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Florian Roth ⚡️",
      "handle": "cyb3rops",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2112872660900126720/DRb9x1-S_bigger.jpg",
      "text": "more info \n\nby PHP\nhttps://t.co/HwLQHSn1IE\n\nCVE-2026-109618 \nCVE-2026-109619",
      "date": "2026-10-20T20:09:51.000Z",
      "url": "https://x.com/cyb3rops/status/2112637442939359386",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "H4x0r.DZ",
      "handle": "h4x0r_dz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2095309566607335424/CEEo9AX7_bigger.jpg",
      "text": "if this affects the default installation of PHP \nWe are fucked up \n\nCVE-2026-109618\nCVE-2026-109619 \nPHP RCEs with a CVSS score of 10.0 ☠️\n\nhttps://t.co/kr47MzTvIj https://t.co/NDq0mppHoT",
      "date": "2026-10-20T19:02:09.000Z",
      "url": "https://x.com/h4x0r_dz/status/2112620404309184734",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVGJDyOXIAA3bgf.jpg"
        }
      ],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "watchTowr",
      "handle": "watchtowrcyber",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1943602243380576256/ka4fHHmU_bigger.jpg",
      "text": "yes, we mean CVE-2026-109618 and CVE-2026-109619",
      "date": "2026-10-20T18:35:38.000Z",
      "url": "https://x.com/watchtowrcyber/status/2112613730848809170",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    }
  ],
  "changes": [
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established.",
      "body": null,
      "sourceUrl": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port).",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "UK tech minister Baroness Lloyd tells the House of Lords that 32 UK government services are unavailable and four partly unavailable, largely as precautions while patches are applied; no confirmed compromise of central government systems. The NCSC sent 50,000 warnings.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Citrix: NetScaler is affected because its management portal runs on PHP (NSIP GUI, management-enabled SNIPs, Cluster IP GUI) on all supported versions; the fix is pending. Restrict GUI/API management access to trusted networks now. NetScaler Console and SVM are not affected.",
      "body": null,
      "sourceUrl": "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts.",
      "body": null,
      "sourceUrl": "https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands.",
      "body": null,
      "sourceUrl": "https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "OX Security: of 2.2M+ publicly exposed PHP instances it tracked, only 14,151 visible on Shodan were patched 24 hours after disclosure (99.3% still unpatched, by its measurement).",
      "body": null,
      "sourceUrl": "https://www.ox.security/blog/php2shell-24-hours-in-99-3-of-measurable-php-instances-are-still-unpatched/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "UK: 32 government services are offline and four partly down as a precaution (the OBR among them; DVLA, police and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet also reported disruption). The minister says there is no confirmed compromise of UK public-sector systems.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Japan: after PM Sanae Takaichi urged site owners on X to patch or suspend services, MUFG halted some online-banking transactions, Mizuho and Daiwa Securities ran emergency maintenance, and regional banks (Shizuoka, Aomori Michinoku, Yamanashi Chuo, San-in Godo) paused apps or services. Parts of the Health and Finance Ministry sites and Sapporo city's site went offline. The Japan Bankers Association says the interbank settlement network is unaffected, and no unauthorized access is confirmed.",
      "body": null,
      "sourceUrl": "https://www.japantimes.co.jp/business/2026/10/22/tech/japan-php-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases.",
      "body": null,
      "sourceUrl": "https://www.php.net/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Cloudflare deploys free default WAF rules (request + response signals) for all customers.",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21/22",
      "title": "PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known.",
      "body": null,
      "sourceUrl": "https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "apache-tomcat-cve-2026-34486",
      "incidentTitle": "Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-04",
      "title": "CISA added CVE-2026-34486 to the KEV catalog (due 2026-08-07).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-tomcat-cve-2026-34486"
    },
    {
      "incident": "apache-activemq-cve-2026-34197",
      "incidentTitle": "Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-16",
      "title": "CISA added CVE-2026-34197 to the KEV catalog (due 2026-04-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-activemq-cve-2026-34197"
    },
    {
      "incident": "apache-http-server-cve-2024-38475",
      "incidentTitle": "Apache HTTP Server: HTTP Server Improper Escaping of Output Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-01",
      "title": "CISA added CVE-2024-38475 to the KEV catalog (due 2025-05-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-http-server-cve-2024-38475"
    },
    {
      "incident": "apache-tomcat-cve-2025-24813",
      "incidentTitle": "Apache Tomcat: Tomcat Path Equivalence Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-01",
      "title": "CISA added CVE-2025-24813 to the KEV catalog (due 2025-04-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-tomcat-cve-2025-24813"
    },
    {
      "incident": "apache-ofbiz-cve-2024-45195",
      "incidentTitle": "Apache OFBiz: OFBiz Forced Browsing Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-04",
      "title": "CISA added CVE-2024-45195 to the KEV catalog (due 2025-02-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-45195"
    },
    {
      "incident": "apache-hugegraph-server-cve-2024-27348",
      "incidentTitle": "Apache HugeGraph-Server Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-18",
      "title": "CISA added CVE-2024-27348 to the KEV catalog (federal deadline 2024-10-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348"
    },
    {
      "incident": "apache-ofbiz-cve-2024-38856",
      "incidentTitle": "Apache OFBiz Incorrect Authorization",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-27",
      "title": "CISA added CVE-2024-38856 to the KEV catalog (federal deadline 2024-09-17)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856"
    },
    {
      "incident": "apache-ofbiz-cve-2024-32113",
      "incidentTitle": "Apache OFBiz Path Traversal",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-07",
      "title": "CISA added CVE-2024-32113 to the KEV catalog (federal deadline 2024-08-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113"
    },
    {
      "incident": "apache-ofbiz-cve-2024-38856",
      "incidentTitle": "Apache OFBiz Incorrect Authorization",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-05",
      "title": "CVE-2024-38856 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38856",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-38856"
    },
    {
      "incident": "apache-flink-cve-2020-17519",
      "incidentTitle": "Apache Flink Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-23",
      "title": "CISA added CVE-2020-17519 to the KEV catalog (federal deadline 2024-06-13)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apache-flink-cve-2020-17519"
    },
    {
      "incident": "apache-ofbiz-cve-2024-32113",
      "incidentTitle": "Apache OFBiz Path Traversal",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-08",
      "title": "CVE-2024-32113 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-32113",
      "url": "https://pwn.watch/i/apache-ofbiz-cve-2024-32113"
    },
    {
      "incident": "apache-hugegraph-server-cve-2024-27348",
      "incidentTitle": "Apache HugeGraph-Server Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-22",
      "title": "CVE-2024-27348 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27348",
      "url": "https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348"
    },
    {
      "incident": "apache-superset-cve-2023-27524",
      "incidentTitle": "Apache Superset Insecure Default Initialization of Resource",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-08",
      "title": "CISA added CVE-2023-27524 to the KEV catalog (federal deadline 2024-01-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apache-superset-cve-2023-27524"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-02",
      "title": "CISA adds CVE-2023-46604 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-01",
      "title": "Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware",
      "body": null,
      "sourceUrl": "https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-apache-activemq-cve-2023-46604/",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-activemq-openwire-rce-cve-2023-46604",
      "incidentTitle": "Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-27",
      "title": "Apache publishes the CVE-2023-46604 announcement; fixed releases already out",
      "body": null,
      "sourceUrl": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt",
      "url": "https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604"
    },
    {
      "incident": "apache-rocketmq-cve-2023-33246",
      "incidentTitle": "Apache RocketMQ: Command Execution (CVE-2023-33246)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-06",
      "title": "CISA added CVE-2023-33246 to the KEV catalog (due 2023-09-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-rocketmq-cve-2023-33246"
    },
    {
      "incident": "apache-spark-cve-2022-33891",
      "incidentTitle": "Apache Spark: Command Injection (CVE-2022-33891)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-07",
      "title": "CISA added CVE-2022-33891 to the KEV catalog (due 2023-03-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apache-spark-cve-2022-33891"
    }
  ]
}