{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "php",
    "label": "PHP",
    "isStack": true,
    "url": "https://pwn.watch/t/php",
    "feed": "https://pwn.watch/t/php/feed.xml"
  },
  "counts": {
    "incidents": 28,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 26
  },
  "incidents": [
    {
      "slug": "updraftcentral-keys-wordpress-backdoor",
      "title": "TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored",
      "url": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor",
      "json": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "partial",
      "product": "UpdraftPlus / UpdraftCentral (WordPress)",
      "tags": [
        "php",
        "wordpress",
        "updraftplus",
        "supply-chain",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Sites with stolen UpdraftCentral connection keys"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-18",
      "closedAt": "2026-10-20",
      "updatedAt": "2026-10-20",
      "summary": "UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.",
      "xPost": null
    },
    {
      "slug": "php2shell-cve-2026-109618-109619",
      "title": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619",
      "json": "https://pwn.watch/i/php2shell-cve-2026-109618-109619.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "PHP",
      "tags": [
        "php",
        "apache",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-109618",
        "CVE-2026-109619"
      ],
      "affectedVersions": [
        "PHP 5.4 through 8.5.11 (all branches serving web requests); EOL 8.1 and earlier unpatched by the PHP project"
      ],
      "fixedVersions": [
        "8.5.12",
        "8.4.27",
        "8.3.36",
        "8.2.35"
      ],
      "startedAt": "2026-10-17",
      "closedAt": null,
      "updatedAt": "2026-10-22T18:22:51+02:00",
      "summary": "Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.",
      "xPost": null
    },
    {
      "slug": "rank-math-pro-wordpress-backdoor",
      "title": "Rank Math PRO WordPress plugin download backdoored",
      "url": "https://pwn.watch/i/rank-math-pro-wordpress-backdoor",
      "json": "https://pwn.watch/i/rank-math-pro-wordpress-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Rank Math PRO (WordPress)",
      "tags": [
        "php",
        "wordpress",
        "rank-math",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "3.0.123 (compromised download window)"
      ],
      "fixedVersions": [
        "Clean PRO builds after incident"
      ],
      "startedAt": "2026-10-15",
      "closedAt": "2026-10-16",
      "updatedAt": "2026-10-16",
      "summary": "SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild.",
      "xPost": null
    },
    {
      "slug": "wordpress-core-cve-2026-87902",
      "title": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-87902.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "tags": [
        "php",
        "wordpress",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-87902"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-25",
      "closedAt": "2026-09-25",
      "updatedAt": "2026-09-25",
      "summary": "WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2026-71362",
      "title": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento ",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-71362"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-24",
      "closedAt": "2026-09-24",
      "updatedAt": "2026-09-24",
      "summary": "Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2026-75650",
      "title": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-75650"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-08",
      "closedAt": "2026-09-08",
      "updatedAt": "2026-09-08",
      "summary": "Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Added to CISA KEV on 2026-09-08.",
      "xPost": null
    },
    {
      "slug": "wordpress-core-cve-2026-60137",
      "title": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-60137.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "tags": [
        "php",
        "wordpress",
        "cisa-kev",
        "rce",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-60137",
        "CVE-2026-63030"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-21",
      "closedAt": "2026-07-21",
      "updatedAt": "2026-07-21",
      "summary": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "joomlack-page-builder-cve-2026-56290",
      "title": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability",
      "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290",
      "json": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Joomlack Page Builder",
      "tags": [
        "php",
        "cisa-kev",
        "rce",
        "joomla"
      ],
      "cveIds": [
        "CVE-2026-56290"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-07",
      "closedAt": "2026-07-07",
      "updatedAt": "2026-07-07",
      "summary": "Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. Added to CISA KEV on 2026-07-07.",
      "xPost": null
    },
    {
      "slug": "widget-factory-joomla-content-editor-cve-2026-48907",
      "title": "Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
      "url": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907",
      "json": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Widget Factory Joomla Content Editor ",
      "tags": [
        "php",
        "joomla",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-48907"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-16",
      "closedAt": "2026-06-16",
      "updatedAt": "2026-06-16",
      "summary": "Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Added to CISA KEV on 2026-06-16.",
      "xPost": null
    },
    {
      "slug": "drupal-core-cve-2026-9082",
      "title": "Drupal Core: Drupal Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/drupal-core-cve-2026-9082",
      "json": "https://pwn.watch/i/drupal-core-cve-2026-9082.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Drupal Core",
      "tags": [
        "php",
        "drupal",
        "cisa-kev",
        "rce",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-9082"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-22",
      "closedAt": "2026-05-22",
      "updatedAt": "2026-05-22",
      "summary": "Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-cve-2025-54236",
      "title": "Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-54236"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-24",
      "closedAt": "2025-10-24",
      "updatedAt": "2025-10-24",
      "summary": "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. Added to CISA KEV on 2025-10-24.",
      "xPost": null
    },
    {
      "slug": "adminer-cve-2021-21311",
      "title": "Adminer: Server-Side Request Forgery Vulnerability",
      "url": "https://pwn.watch/i/adminer-cve-2021-21311",
      "json": "https://pwn.watch/i/adminer-cve-2021-21311.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Adminer",
      "tags": [
        "php",
        "adminer",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2021-21311"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-09-29",
      "updatedAt": "2025-09-29",
      "summary": "Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information. Added to CISA KEV on 2025-09-29.",
      "xPost": null
    },
    {
      "slug": "phpmailer-cve-2016-10033",
      "title": "PHPMailer: PHPMailer Command Injection Vulnerability",
      "url": "https://pwn.watch/i/phpmailer-cve-2016-10033",
      "json": "https://pwn.watch/i/phpmailer-cve-2016-10033.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "PHPMailer",
      "tags": [
        "php",
        "phpmailer",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2016-10033"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-07-07",
      "closedAt": "2025-07-07",
      "updatedAt": "2025-07-07",
      "summary": "PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. Added to CISA KEV on 2025-07-07.",
      "xPost": null
    },
    {
      "slug": "roundcube-webmail-cve-2024-42009",
      "title": "Roundcube Webmail: Webmail Cross-Site Scripting Vulnerability",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2024-42009",
      "json": "https://pwn.watch/i/roundcube-webmail-cve-2024-42009.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Roundcube Webmail",
      "tags": [
        "php",
        "roundcube",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-42009"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-09",
      "closedAt": "2025-06-09",
      "updatedAt": "2025-06-09",
      "summary": "RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. Added to CISA KEV on 2025-06-09.",
      "xPost": null
    },
    {
      "slug": "craft-cms-cve-2024-56145",
      "title": "Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)",
      "url": "https://pwn.watch/i/craft-cms-cve-2024-56145",
      "json": "https://pwn.watch/i/craft-cms-cve-2024-56145.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Craft CMS",
      "tags": [
        "php",
        "craft-cms",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-56145",
        "CVE-2025-35939"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-02",
      "closedAt": "2025-06-02",
      "updatedAt": "2025-06-02",
      "summary": "CVE-2024-56145: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled. CVE-2025-35939: Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. Added to CISA KEV on 2025-06-02.",
      "xPost": null
    },
    {
      "slug": "yiiframework-yii-cve-2024-58136",
      "title": "Yiiframework Yii: Yii Improper Protection of Alternate Path Vulnerability",
      "url": "https://pwn.watch/i/yiiframework-yii-cve-2024-58136",
      "json": "https://pwn.watch/i/yiiframework-yii-cve-2024-58136.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Yiiframework Yii",
      "tags": [
        "php",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-58136"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-05-02",
      "closedAt": "2025-05-02",
      "updatedAt": "2025-05-02",
      "summary": "Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432. Added to CISA KEV on 2025-05-02.",
      "xPost": null
    },
    {
      "slug": "craft-cms-cve-2025-23209",
      "title": "Craft CMS: Code Injection Vulnerability",
      "url": "https://pwn.watch/i/craft-cms-cve-2025-23209",
      "json": "https://pwn.watch/i/craft-cms-cve-2025-23209.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Craft CMS",
      "tags": [
        "php",
        "craft-cms",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-23209"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-20",
      "closedAt": "2025-02-20",
      "updatedAt": "2025-02-20",
      "summary": "Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution. Added to CISA KEV on 2025-02-20.",
      "xPost": null
    },
    {
      "slug": "projectsend-cve-2024-11680",
      "title": "ProjectSend Improper Authentication",
      "url": "https://pwn.watch/i/projectsend-cve-2024-11680",
      "json": "https://pwn.watch/i/projectsend-cve-2024-11680.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "ProjectSend",
      "tags": [
        "php",
        "projectsend",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-11680"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-26",
      "closedAt": "2024-12-03",
      "updatedAt": "2024-12-03",
      "summary": "ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.",
      "xPost": null
    },
    {
      "slug": "litespeed-cache-privilege-escalation-cve-2024-28000",
      "title": "LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)",
      "url": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000",
      "json": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "LiteSpeed Cache (WordPress plugin)",
      "tags": [
        "wordpress",
        "php",
        "litespeed",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2024-28000"
      ],
      "affectedVersions": [
        "< 6.4 (Patchstack)"
      ],
      "fixedVersions": [
        "6.4"
      ],
      "startedAt": "2024-08-13",
      "closedAt": "2024-08-21",
      "updatedAt": "2024-08-21",
      "summary": "A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.",
      "xPost": null
    },
    {
      "slug": "roundcube-webmail-cve-2020-13965",
      "title": "Roundcube Webmail Cross-Site Scripting (XSS)",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2020-13965",
      "json": "https://pwn.watch/i/roundcube-webmail-cve-2020-13965.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Roundcube Webmail",
      "tags": [
        "php",
        "roundcube",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2020-13965"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-26",
      "closedAt": "2024-06-26",
      "updatedAt": "2024-06-26",
      "summary": "Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. Added to the CISA KEV catalog on 2024-06-26. CVE-2020-13965 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "adobe-commerce-and-magento-open-source-cve-2024-34102",
      "title": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102",
      "json": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Adobe Commerce and Magento Open Source",
      "tags": [
        "php",
        "adobe",
        "magento",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-34102"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-13",
      "closedAt": "2024-07-17",
      "updatedAt": "2024-07-17",
      "summary": "Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-07-17.",
      "xPost": null
    },
    {
      "slug": "roundcube-webmail-cve-2024-37383",
      "title": "RoundCube Webmail Cross-Site Scripting (XSS)",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2024-37383",
      "json": "https://pwn.watch/i/roundcube-webmail-cve-2024-37383.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Roundcube Webmail",
      "tags": [
        "php",
        "roundcube",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-37383"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-07",
      "closedAt": "2024-10-24",
      "updatedAt": "2024-10-24",
      "summary": "RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code. Added to the CISA KEV catalog on 2024-10-24.",
      "xPost": null
    },
    {
      "slug": "php-cgi-argument-injection-cve-2024-4577",
      "title": "PHP-CGI argument injection on Windows (CVE-2024-4577)",
      "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577",
      "json": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "PHP Group PHP",
      "tags": [
        "php",
        "windows",
        "rce",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-4577"
      ],
      "affectedVersions": [
        "PHP < 8.3.8, < 8.2.20, < 8.1.29 (GitHub advisory); exploitable on Windows in CGI mode"
      ],
      "fixedVersions": [
        "8.3.8",
        "8.2.20",
        "8.1.29"
      ],
      "startedAt": "2024-06-06",
      "closedAt": "2024-06-12",
      "updatedAt": "2024-06-12",
      "summary": "A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "roundcube-webmail-cve-2023-43770",
      "title": "Roundcube Webmail Persistent Cross-Site Scripting (XSS)",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2023-43770",
      "json": "https://pwn.watch/i/roundcube-webmail-cve-2023-43770.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Roundcube Webmail",
      "tags": [
        "php",
        "roundcube",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-43770"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-02-12",
      "closedAt": "2024-02-12",
      "updatedAt": "2024-02-12",
      "summary": "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages. Added to the CISA KEV catalog on 2024-02-12. CVE-2023-43770 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "laravel-framework-cve-2018-15133",
      "title": "Laravel Deserialization of Untrusted Data",
      "url": "https://pwn.watch/i/laravel-framework-cve-2018-15133",
      "json": "https://pwn.watch/i/laravel-framework-cve-2018-15133.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Laravel Framework",
      "tags": [
        "php",
        "laravel",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2018-15133"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-16",
      "closedAt": "2024-01-16",
      "updatedAt": "2024-01-16",
      "summary": "Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable). Added to the CISA KEV catalog on 2024-01-16. CVE-2018-15133 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "joomla-cve-2023-23752",
      "title": "Joomla! Improper Access Control",
      "url": "https://pwn.watch/i/joomla-cve-2023-23752",
      "json": "https://pwn.watch/i/joomla-cve-2023-23752.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Joomla!",
      "tags": [
        "php",
        "joomla",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-23752"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-08",
      "closedAt": "2024-01-08",
      "updatedAt": "2024-01-08",
      "summary": "Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-23752 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "owncloud-graphapi-cve-2023-49103",
      "title": "ownCloud graphapi: Information Disclosure (CVE-2023-49103)",
      "url": "https://pwn.watch/i/owncloud-graphapi-cve-2023-49103",
      "json": "https://pwn.watch/i/owncloud-graphapi-cve-2023-49103.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ownCloud graphapi",
      "tags": [
        "php",
        "owncloud",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-49103"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-11-30",
      "closedAt": "2023-11-30",
      "updatedAt": "2023-11-30",
      "summary": "ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials. Added to CISA KEV on 2023-11-30.",
      "xPost": null
    },
    {
      "slug": "roundcube-webmail-cve-2023-5631",
      "title": "Roundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631)",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2023-5631",
      "json": "https://pwn.watch/i/roundcube-webmail-cve-2023-5631.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Roundcube Webmail",
      "tags": [
        "php",
        "roundcube",
        "cisa-kev",
        "xss"
      ],
      "cveIds": [
        "CVE-2023-5631"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-26",
      "closedAt": "2023-10-26",
      "updatedAt": "2023-10-26",
      "summary": "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. Added to CISA KEV on 2023-10-26.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "CrowdSec",
      "handle": "Crowd_Security",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1323565720098263041/1l9LNG8w_bigger.jpg",
      "text": "Can't patch every box today? The CrowdSec WAF has free, tentative virtual patches for both CVEs:\n\ncscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109618\ncscli appsec-rules install crowdsecurity/vpatch-CVE-2026-109619\n\nA stopgap, not a fix: still update PHP.",
      "date": "2026-10-22T15:53:55.000Z",
      "url": "https://x.com/Crowd_Security/status/2113297809902354714",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Zed Attack Proxy",
      "handle": "zaproxy",
      "avatarUrl": "https://pbs.twimg.com/profile_images/935515807949434880/T8RuttbQ_bigger.jpg",
      "text": "Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP\nPHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.\nhttps://t.co/9G4DtEhMM6\n#php2shell",
      "date": "2026-10-22T15:43:23.000Z",
      "url": "https://x.com/zaproxy/status/2113295172385861906",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "George Kurtz",
      "handle": "George_Kurtz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/626477904650637312/81MQqLz9_bigger.jpg",
      "text": "#PHP2Shell is a big one. Here are my takeaways.\n\n1. These flaws reach back more than a decade. PHP’s maintainers identified one underlying problem in 2024, but its full impact wasn’t clear until AI-assisted research demonstrated its exploitability. What seems impractical to exploit today could easily be exploitable tomorrow as models advance.\n\n2. Much of the web runs on PHP, and a lot of it is on versions that are out of support. Some get a source backport you must build yourself. Some get nothing. Attackers aren't hunting the servers you just patched. They're hunting the ones you forgot you own. There is going to be a very long tail on remediating these vulnerabilities, and we will see many downstream breaches over the coming months.\n\n3. The patching window has completely collapsed. While we’ve exponentially found more vulnerabilities and exponentially created more patches, we’ve hit the sound barrier on operationally rolling them out. Even more concerning is the increase in exploitation occurring before or on the day of disclosure. When a flaw gets exploited, almost 90% of the time it’s hit on or before the day it’s disclosed. As defenders, you need to be looking at your watch, not a calendar!\n\n4. Coordinated disclosure in open source is really hard. It runs on trust, not contracts. There were many people in the loop, and for good reason. Lots of great people doing incredible work. However, I expect leaked disclosures will be the norm, not the exception, as we move forward in the Agent-state era.\n\nThe @a16z chart below says it all.",
      "date": "2026-10-22T14:51:29.000Z",
      "url": "https://x.com/George_Kurtz/status/2113282095342592366",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVPfySNXsAAKkIg.jpg"
        }
      ],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Appwrite",
      "handle": "appwrite",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2039591646095093760/w0wOnRMo_bigger.jpg",
      "text": "An update on PHP2Shell and the eMudhra certificate compromise.\n\nWe've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region.\n \nHere's what we've checked and what self-hosted users should do. 🧵",
      "date": "2026-10-22T12:46:16.000Z",
      "url": "https://x.com/appwrite/status/2113250583998316980",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "ピクシブ株式会社 pixiv Inc.",
      "handle": "pixiv_corp",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1046601582714867713/ExVB0Dlo_bigger.jpg",
      "text": "【#pixiv_inside】\nPHP 8.5.12の緊急リリースに\npixivはどう対応したか\nhttps://t.co/zYpXH9HWOy\n\nPHPにて緊急セキュリティリリースが予告され\npixivも対応しました。\n\nセキュリティアップデート公開から\npixivメンテナンス明けまで約30分の対応を\nビルド・デプロイ基盤も踏まえながら説明します✍️",
      "date": "2026-10-22T10:41:42.000Z",
      "url": "https://x.com/pixiv_corp/status/2113219235975762423",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Werner Vogels",
      "handle": "Werner",
      "avatarUrl": "https://pbs.twimg.com/profile_images/563188960394891264/z3-Rh11q_bigger.jpeg",
      "text": "Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) https://t.co/TW2zDAFV6K",
      "date": "2026-10-22T10:36:28.000Z",
      "url": "https://x.com/Werner/status/2113217918742000089",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Matthew Prince 🌥",
      "handle": "eastdakota",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2332322635/zhx7hflmmcxdaj0tk9f8_bigger.jpeg",
      "text": "Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.\n\ntl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.",
      "date": "2026-10-21T15:44:45.000Z",
      "url": "https://x.com/eastdakota/status/2112933115215905229",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Cloudflare",
      "handle": "Cloudflare",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2110452337764413440/6WKZL9q3_bigger.jpg",
      "text": "Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://t.co/OQG4x6x858",
      "date": "2026-10-21T14:16:59.000Z",
      "url": "https://x.com/Cloudflare/status/2112911026437935381",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Huntress",
      "handle": "HuntressLabs",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2078261992297807872/_K7T5OWR_bigger.jpg",
      "text": "Huntress is aware of reports circulating regarding two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in several versions of PHP (versions 5, 6, 7, and 8). 🧵",
      "date": "2026-10-20T23:19:46.000Z",
      "url": "https://x.com/HuntressLabs/status/2112685233275318290",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Eric Taylor",
      "handle": "bcs_erictaylor",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1667335479958577153/qsT-tCdx_bigger.jpg",
      "text": "PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)\n\nInformation about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm https://t.co/PKEZK7yYVe",
      "date": "2026-10-20T22:48:50.000Z",
      "url": "https://x.com/bcs_erictaylor/status/2112677451520164300",
      "media": [
        {
          "type": "video",
          "url": "https://pbs.twimg.com/amplify_video_thumb/2112677297119494144/img/YEWSU7iLnuASqo71.jpg"
        }
      ],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "Florian Roth ⚡️",
      "handle": "cyb3rops",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2112872660900126720/DRb9x1-S_bigger.jpg",
      "text": "more info \n\nby PHP\nhttps://t.co/HwLQHSn1IE\n\nCVE-2026-109618 \nCVE-2026-109619",
      "date": "2026-10-20T20:09:51.000Z",
      "url": "https://x.com/cyb3rops/status/2112637442939359386",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "H4x0r.DZ",
      "handle": "h4x0r_dz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2095309566607335424/CEEo9AX7_bigger.jpg",
      "text": "if this affects the default installation of PHP \nWe are fucked up \n\nCVE-2026-109618\nCVE-2026-109619 \nPHP RCEs with a CVSS score of 10.0 ☠️\n\nhttps://t.co/kr47MzTvIj https://t.co/NDq0mppHoT",
      "date": "2026-10-20T19:02:09.000Z",
      "url": "https://x.com/h4x0r_dz/status/2112620404309184734",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVGJDyOXIAA3bgf.jpg"
        }
      ],
      "incident": "php2shell-cve-2026-109618-109619"
    },
    {
      "authorName": "watchTowr",
      "handle": "watchtowrcyber",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1943602243380576256/ka4fHHmU_bigger.jpg",
      "text": "yes, we mean CVE-2026-109618 and CVE-2026-109619",
      "date": "2026-10-20T18:35:38.000Z",
      "url": "https://x.com/watchtowrcyber/status/2112613730848809170",
      "media": [],
      "incident": "php2shell-cve-2026-109618-109619"
    }
  ],
  "changes": [
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established.",
      "body": null,
      "sourceUrl": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port).",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "UK tech minister Baroness Lloyd tells the House of Lords that 32 UK government services are unavailable and four partly unavailable, largely as precautions while patches are applied; no confirmed compromise of central government systems. The NCSC sent 50,000 warnings.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Citrix: NetScaler is affected because its management portal runs on PHP (NSIP GUI, management-enabled SNIPs, Cluster IP GUI) on all supported versions; the fix is pending. Restrict GUI/API management access to trusted networks now. NetScaler Console and SVM are not affected.",
      "body": null,
      "sourceUrl": "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts.",
      "body": null,
      "sourceUrl": "https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands.",
      "body": null,
      "sourceUrl": "https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "OX Security: of 2.2M+ publicly exposed PHP instances it tracked, only 14,151 visible on Shodan were patched 24 hours after disclosure (99.3% still unpatched, by its measurement).",
      "body": null,
      "sourceUrl": "https://www.ox.security/blog/php2shell-24-hours-in-99-3-of-measurable-php-instances-are-still-unpatched/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "UK: 32 government services are offline and four partly down as a precaution (the OBR among them; DVLA, police and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet also reported disruption). The minister says there is no confirmed compromise of UK public-sector systems.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Japan: after PM Sanae Takaichi urged site owners on X to patch or suspend services, MUFG halted some online-banking transactions, Mizuho and Daiwa Securities ran emergency maintenance, and regional banks (Shizuoka, Aomori Michinoku, Yamanashi Chuo, San-in Godo) paused apps or services. Parts of the Health and Finance Ministry sites and Sapporo city's site went offline. The Japan Bankers Association says the interbank settlement network is unaffected, and no unauthorized access is confirmed.",
      "body": null,
      "sourceUrl": "https://www.japantimes.co.jp/business/2026/10/22/tech/japan-php-vulnerabilities/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases.",
      "body": null,
      "sourceUrl": "https://www.php.net/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Cloudflare deploys free default WAF rules (request + response signals) for all customers.",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21/22",
      "title": "PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known.",
      "body": null,
      "sourceUrl": "https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure.",
      "body": null,
      "sourceUrl": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "php2shell-cve-2026-109618-109619",
      "incidentTitle": "PHP2Shell: critical unauthenticated RCE in PHP core",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-17",
      "title": "AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/php2shell-cve-2026-109618-109619"
    },
    {
      "incident": "wordpress-core-cve-2026-87902",
      "incidentTitle": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-25",
      "title": "CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2026-71362",
      "incidentTitle": "Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-24",
      "title": "CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2026-75650",
      "incidentTitle": "Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-08",
      "title": "CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650"
    },
    {
      "incident": "wordpress-core-cve-2026-60137",
      "incidentTitle": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-21",
      "title": "CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137"
    },
    {
      "incident": "joomlack-page-builder-cve-2026-56290",
      "incidentTitle": "Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-07",
      "title": "CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/joomlack-page-builder-cve-2026-56290"
    },
    {
      "incident": "widget-factory-joomla-content-editor-cve-2026-48907",
      "incidentTitle": "Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-16",
      "title": "CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907"
    },
    {
      "incident": "drupal-core-cve-2026-9082",
      "incidentTitle": "Drupal Core: Drupal Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-22",
      "title": "CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/drupal-core-cve-2026-9082"
    },
    {
      "incident": "adobe-commerce-and-magento-cve-2025-54236",
      "incidentTitle": "Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-24",
      "title": "CISA added CVE-2025-54236 to the KEV catalog (due 2025-11-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236"
    },
    {
      "incident": "adminer-cve-2021-21311",
      "incidentTitle": "Adminer: Server-Side Request Forgery Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "CISA added CVE-2021-21311 to the KEV catalog (due 2025-10-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/adminer-cve-2021-21311"
    },
    {
      "incident": "phpmailer-cve-2016-10033",
      "incidentTitle": "PHPMailer: PHPMailer Command Injection Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-07",
      "title": "CISA added CVE-2016-10033 to the KEV catalog (due 2025-07-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/phpmailer-cve-2016-10033"
    },
    {
      "incident": "roundcube-webmail-cve-2024-42009",
      "incidentTitle": "Roundcube Webmail: Webmail Cross-Site Scripting Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-09",
      "title": "CISA added CVE-2024-42009 to the KEV catalog (due 2025-06-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2024-42009"
    },
    {
      "incident": "craft-cms-cve-2024-56145",
      "incidentTitle": "Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-02",
      "title": "CISA added CVE-2024-56145 to the KEV catalog (due 2025-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/craft-cms-cve-2024-56145"
    },
    {
      "incident": "craft-cms-cve-2024-56145",
      "incidentTitle": "Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-02",
      "title": "CISA added CVE-2025-35939 to the KEV catalog (due 2025-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/craft-cms-cve-2024-56145"
    },
    {
      "incident": "yiiframework-yii-cve-2024-58136",
      "incidentTitle": "Yiiframework Yii: Yii Improper Protection of Alternate Path Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-02",
      "title": "CISA added CVE-2024-58136 to the KEV catalog (due 2025-05-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/yiiframework-yii-cve-2024-58136"
    },
    {
      "incident": "craft-cms-cve-2025-23209",
      "incidentTitle": "Craft CMS: Code Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-20",
      "title": "CISA added CVE-2025-23209 to the KEV catalog (due 2025-03-13).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/craft-cms-cve-2025-23209"
    },
    {
      "incident": "projectsend-cve-2024-11680",
      "incidentTitle": "ProjectSend Improper Authentication",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/projectsend-cve-2024-11680"
    },
    {
      "incident": "projectsend-cve-2024-11680",
      "incidentTitle": "ProjectSend Improper Authentication",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-26",
      "title": "CVE-2024-11680 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-11680",
      "url": "https://pwn.watch/i/projectsend-cve-2024-11680"
    },
    {
      "incident": "roundcube-webmail-cve-2024-37383",
      "incidentTitle": "RoundCube Webmail Cross-Site Scripting (XSS)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-24",
      "title": "CISA added CVE-2024-37383 to the KEV catalog (federal deadline 2024-11-14)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2024-37383"
    },
    {
      "incident": "litespeed-cache-privilege-escalation-cve-2024-28000",
      "incidentTitle": "LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-21",
      "title": "Patchstack publishes details",
      "body": null,
      "sourceUrl": "https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/",
      "url": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000"
    },
    {
      "incident": "litespeed-cache-privilege-escalation-cve-2024-28000",
      "incidentTitle": "LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-13",
      "title": "LiteSpeed Cache 6.4 released with the fix",
      "body": null,
      "sourceUrl": "https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/",
      "url": "https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000"
    },
    {
      "incident": "adobe-commerce-and-magento-open-source-cve-2024-34102",
      "incidentTitle": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-17",
      "title": "CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102"
    },
    {
      "incident": "roundcube-webmail-cve-2020-13965",
      "incidentTitle": "Roundcube Webmail Cross-Site Scripting (XSS)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-26",
      "title": "CISA added CVE-2020-13965 to the KEV catalog (federal deadline 2024-07-17)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2020-13965"
    },
    {
      "incident": "adobe-commerce-and-magento-open-source-cve-2024-34102",
      "incidentTitle": "Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-13",
      "title": "CVE-2024-34102 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-34102",
      "url": "https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102"
    },
    {
      "incident": "php-cgi-argument-injection-cve-2024-4577",
      "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-12",
      "title": "CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577"
    },
    {
      "incident": "php-cgi-argument-injection-cve-2024-4577",
      "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-09",
      "title": "CVE-2024-4577 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577",
      "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577"
    },
    {
      "incident": "roundcube-webmail-cve-2024-37383",
      "incidentTitle": "RoundCube Webmail Cross-Site Scripting (XSS)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-07",
      "title": "CVE-2024-37383 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-37383",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2024-37383"
    },
    {
      "incident": "php-cgi-argument-injection-cve-2024-4577",
      "incidentTitle": "PHP-CGI argument injection on Windows (CVE-2024-4577)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-06",
      "title": "DEVCORE discloses CVE-2024-4577; fixed PHP releases available",
      "body": null,
      "sourceUrl": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/",
      "url": "https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577"
    },
    {
      "incident": "roundcube-webmail-cve-2023-43770",
      "incidentTitle": "Roundcube Webmail Persistent Cross-Site Scripting (XSS)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-12",
      "title": "CISA added CVE-2023-43770 to the KEV catalog (federal deadline 2024-03-04)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2023-43770"
    },
    {
      "incident": "laravel-framework-cve-2018-15133",
      "incidentTitle": "Laravel Deserialization of Untrusted Data",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-16",
      "title": "CISA added CVE-2018-15133 to the KEV catalog (federal deadline 2024-02-06)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/laravel-framework-cve-2018-15133"
    },
    {
      "incident": "joomla-cve-2023-23752",
      "incidentTitle": "Joomla! Improper Access Control",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-08",
      "title": "CISA added CVE-2023-23752 to the KEV catalog (federal deadline 2024-01-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/joomla-cve-2023-23752"
    },
    {
      "incident": "owncloud-graphapi-cve-2023-49103",
      "incidentTitle": "ownCloud graphapi: Information Disclosure (CVE-2023-49103)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-30",
      "title": "CISA added CVE-2023-49103 to the KEV catalog (due 2023-12-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/owncloud-graphapi-cve-2023-49103"
    },
    {
      "incident": "roundcube-webmail-cve-2023-5631",
      "incidentTitle": "Roundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-26",
      "title": "CISA added CVE-2023-5631 to the KEV catalog (due 2023-11-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/roundcube-webmail-cve-2023-5631"
    }
  ]
}