pwn.watch: PHP incident updates https://pwn.watch/t/php Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Searchlight Cyber releases the open-source php2shell-scanner, which actively triggers the memory-exhaustion condition (mod_php and PHP-FPM) instead of relying on version banners; it warns the probes are inherently risky. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port). https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:AWS CISO CJ Moses: PHP2Shell is now being broadly exploited in the wild, with first attempts on Oct 17 and varied payloads suggesting multiple actors. VirusTotal tracks 5.1M+ exposed PHP hosts (about 3.8M with an open port). Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: UK tech minister Baroness Lloyd tells the House of Lords that 32 UK government services are unavailable and four partly unavailable, largely as precautions while patches are applied; no confirmed compromise of central government systems. The NCSC sent 50,000 warnings. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:UK tech minister Baroness Lloyd tells the House of Lords that 32 UK government services are unavailable and four partly unavailable, largely as precautions while patches are applied; no confirmed compromise of central government systems. The NCSC sent 50,000 warnings. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Citrix: NetScaler is affected because its management portal runs on PHP (NSIP GUI, management-enabled SNIPs, Cluster IP GUI) on all supported versions; the fix is pending. Restrict GUI/API management access to trusted networks now. NetScaler Console and SVM are not affected. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Citrix: NetScaler is affected because its management portal runs on PHP (NSIP GUI, management-enabled SNIPs, Cluster IP GUI) on all supported versions; the fix is pending. Restrict GUI/API management access to trusted networks now. NetScaler Console and SVM are not affected. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Distro packages: Debian shipped fixes on the evening of Oct 21; Fedora, Gentoo, Ubuntu and Red Hat followed, then Slackware and SUSE. heise says there are still no reports of successful attacks despite massive exploitation attempts. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.heise.de/en/news/php2shell-Updates-roll-out-as-websites-go-offline-and-attacks-begin-11496464.html Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Vendor roundup: Palo Alto Networks says upcoming PAN-OS releases will fix PHP2Shell (rated CVSS 8.7 for its products, workarounds published, no known attacks); Sophos took its legacy MyUTM portal offline after finding a vulnerable PHP; Cisco lists 30+ products under review with none known affected; Fortinet says two dozen products are not impacted and is still checking others. Ubuntu, Debian, cPanel, Plesk and DirectAdmin have shipped fixes. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:QNAP: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 / h6.0.x / h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus QuMagie, Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS are affected; fixed versions are still to be announced. EOL Download Station and the PHP extensions app won't be fixed, so uninstall them. Restrict NAS web access until firmware lands. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.forum-nas.fr/threads/vuln%C3%A9rabilit%C3%A9s-dans-php-php2shell-affectant-plusieurs-produits-qnap.27227/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: OX Security: of 2.2M+ publicly exposed PHP instances it tracked, only 14,151 visible on Shodan were patched 24 hours after disclosure (99.3% still unpatched, by its measurement). https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:OX Security: of 2.2M+ publicly exposed PHP instances it tracked, only 14,151 visible on Shodan were patched 24 hours after disclosure (99.3% still unpatched, by its measurement). Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.ox.security/blog/php2shell-24-hours-in-99-3-of-measurable-php-instances-are-still-unpatched/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:CrowdStrike says its testing confirmed a single unauthenticated POST makes an Apache mod_php worker run an attacker-chosen command, with no vulnerable app code needed. Red Hat rates both bugs lower (8.1), saying reliable exploitation needs precise heap manipulation. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Cloudflare says attackers are tweaking payloads to slip past its WAF rules, using feedback from blocked requests. Amazon advises investigating suspicious activity back to at least Oct 17. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Amazon: PHP2Shell is now broadly exploited in the wild. Cloudflare's Matthew Prince reports attempts went from thousands pre-announcement to millions; watchTowr says the sprayed PoCs it sees don't achieve RCE. Censys counted ~1.57M unpatched internet-facing PHP hosts on Oct 21. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: UK: 32 government services are offline and four partly down as a precaution (the OBR among them; DVLA, police and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet also reported disruption). The minister says there is no confirmed compromise of UK public-sector systems. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:UK: 32 government services are offline and four partly down as a precaution (the OBR among them; DVLA, police and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet also reported disruption). The minister says there is no confirmed compromise of UK public-sector systems. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Japan: after PM Sanae Takaichi urged site owners on X to patch or suspend services, MUFG halted some online-banking transactions, Mizuho and Daiwa Securities ran emergency maintenance, and regional banks (Shizuoka, Aomori Michinoku, Yamanashi Chuo, San-in Godo) paused apps or services. Parts of the Health and Finance Ministry sites and Sapporo city's site went offline. The Japan Bankers Association says the interbank settlement network is unaffected, and no unauthorized access is confirmed. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Japan: after PM Sanae Takaichi urged site owners on X to patch or suspend services, MUFG halted some online-banking transactions, Mizuho and Daiwa Securities ran emergency maintenance, and regional banks (Shizuoka, Aomori Michinoku, Yamanashi Chuo, San-in Godo) paused apps or services. Parts of the Health and Finance Ministry sites and Sapporo city's site went offline. The Japan Bankers Association says the interbank settlement network is unaffected, and no unauthorized access is confirmed. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.japantimes.co.jp/business/2026/10/22/tech/japan-php-vulnerabilities/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.php.net/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Cloudflare deploys free default WAF rules (request + response signals) for all customers. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Cloudflare deploys free default WAF rules (request + response signals) for all customers. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation says Chainguard published patched images at 07:41 UTC, six-plus hours before the coordinated release; Chainguard says exploitation was already under way. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21/22:PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Governments and big sites go offline as a precaution: Germany's ITZBund pulled several federal sites, France took prefecture sites offline, Belgium's foreign ministry, the Netherlands (Overheid.nl, Port of Rotterdam, hospitals) and Finland's Valtori shut public web services, the Czech government site went dark at 17:00 UTC, and Wikimedia and the Internet Archive took systems down to patch. Most said no incidents were known. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.investing.com/news/stock-market-news/factboxwebsites-taken-offline-over-php-risks-4963631 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:AWS publishes AWS WAF mitigation rules (block PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, cap body size); AWS stresses patching is the only complete fix. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation blames Chainguard for breaking the embargo: it published built images with the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release. Chainguard CEO Dan Lorenc says it shipped because people were already being hit, and that its honeypots caught IPs from China and Russia targeting the bugs. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-20:Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. Tue, 20 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Status: live, partial [high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). https://pwn.watch/i/wordpress-core-cve-2026-87902 wordpress-core-cve-2026-87902:2026-09-25:CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability : CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362 adobe-commerce-and-magento-cve-2026-71362:2026-09-24:CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). Thu, 24 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability: CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650 adobe-commerce-and-magento-cve-2026-75650:2026-09-08:CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched [high] WordPress Core: WordPress Core SQL Injection Vulnerability: CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). https://pwn.watch/i/wordpress-core-cve-2026-60137 wordpress-core-cve-2026-60137:2026-07-21:CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). Tue, 21 Jul 2026 00:00:00 GMT high Status: closed, patched [high] Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability: CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10). https://pwn.watch/i/joomlack-page-builder-cve-2026-56290 joomlack-page-builder-cve-2026-56290:2026-07-07:CISA added CVE-2026-56290 to the KEV catalog (due 2026-07-10). Tue, 07 Jul 2026 00:00:00 GMT high Status: closed, patched [high] Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability: CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19). https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907 widget-factory-joomla-content-editor-cve-2026-48907:2026-06-16:CISA added CVE-2026-48907 to the KEV catalog (due 2026-06-19). Tue, 16 Jun 2026 00:00:00 GMT high Status: closed, patched [high] Drupal Core: Drupal Core SQL Injection Vulnerability: CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27). https://pwn.watch/i/drupal-core-cve-2026-9082 drupal-core-cve-2026-9082:2026-05-22:CISA added CVE-2026-9082 to the KEV catalog (due 2026-05-27). Fri, 22 May 2026 00:00:00 GMT high Status: closed, patched [critical] Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability: CISA added CVE-2025-54236 to the KEV catalog (due 2025-11-14). https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236 adobe-commerce-and-magento-cve-2025-54236:2025-10-24:CISA added CVE-2025-54236 to the KEV catalog (due 2025-11-14). Fri, 24 Oct 2025 00:00:00 GMT critical Status: closed, patched [high] Adminer: Server-Side Request Forgery Vulnerability: CISA added CVE-2021-21311 to the KEV catalog (due 2025-10-20). https://pwn.watch/i/adminer-cve-2021-21311 adminer-cve-2021-21311:2025-09-29:CISA added CVE-2021-21311 to the KEV catalog (due 2025-10-20). Mon, 29 Sep 2025 00:00:00 GMT high Status: closed, patched [critical] PHPMailer: PHPMailer Command Injection Vulnerability: CISA added CVE-2016-10033 to the KEV catalog (due 2025-07-28). https://pwn.watch/i/phpmailer-cve-2016-10033 phpmailer-cve-2016-10033:2025-07-07:CISA added CVE-2016-10033 to the KEV catalog (due 2025-07-28). Mon, 07 Jul 2025 00:00:00 GMT critical Status: closed, patched [critical] Roundcube Webmail: Webmail Cross-Site Scripting Vulnerability: CISA added CVE-2024-42009 to the KEV catalog (due 2025-06-30). https://pwn.watch/i/roundcube-webmail-cve-2024-42009 roundcube-webmail-cve-2024-42009:2025-06-09:CISA added CVE-2024-42009 to the KEV catalog (due 2025-06-30). Mon, 09 Jun 2025 00:00:00 GMT critical Status: closed, patched [critical] Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939): CISA added CVE-2024-56145 to the KEV catalog (due 2025-06-23). https://pwn.watch/i/craft-cms-cve-2024-56145 craft-cms-cve-2024-56145:2025-06-02:CISA added CVE-2024-56145 to the KEV catalog (due 2025-06-23). Mon, 02 Jun 2025 00:00:00 GMT critical Status: closed, patched [critical] Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939): CISA added CVE-2025-35939 to the KEV catalog (due 2025-06-23). https://pwn.watch/i/craft-cms-cve-2024-56145 craft-cms-cve-2024-56145:2025-06-02:CISA added CVE-2025-35939 to the KEV catalog (due 2025-06-23). Mon, 02 Jun 2025 00:00:00 GMT critical Status: closed, patched [critical] Yiiframework Yii: Yii Improper Protection of Alternate Path Vulnerability: CISA added CVE-2024-58136 to the KEV catalog (due 2025-05-23). https://pwn.watch/i/yiiframework-yii-cve-2024-58136 yiiframework-yii-cve-2024-58136:2025-05-02:CISA added CVE-2024-58136 to the KEV catalog (due 2025-05-23). Fri, 02 May 2025 00:00:00 GMT critical Status: closed, patched [high] Craft CMS: Code Injection Vulnerability: CISA added CVE-2025-23209 to the KEV catalog (due 2025-03-13). https://pwn.watch/i/craft-cms-cve-2025-23209 craft-cms-cve-2025-23209:2025-02-20:CISA added CVE-2025-23209 to the KEV catalog (due 2025-03-13). Thu, 20 Feb 2025 00:00:00 GMT high Status: closed, patched [critical] ProjectSend Improper Authentication: CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24) https://pwn.watch/i/projectsend-cve-2024-11680 projectsend-cve-2024-11680:2024-12-03:CISA added CVE-2024-11680 to the KEV catalog (federal deadline 2024-12-24) Tue, 03 Dec 2024 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [critical] ProjectSend Improper Authentication: CVE-2024-11680 published https://pwn.watch/i/projectsend-cve-2024-11680 projectsend-cve-2024-11680:2024-11-26:CVE-2024-11680 published Tue, 26 Nov 2024 00:00:00 GMT critical Source: https://nvd.nist.gov/vuln/detail/CVE-2024-11680 Status: closed, patched [medium] RoundCube Webmail Cross-Site Scripting (XSS): CISA added CVE-2024-37383 to the KEV catalog (federal deadline 2024-11-14) https://pwn.watch/i/roundcube-webmail-cve-2024-37383 roundcube-webmail-cve-2024-37383:2024-10-24:CISA added CVE-2024-37383 to the KEV catalog (federal deadline 2024-11-14) Thu, 24 Oct 2024 00:00:00 GMT medium Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [critical] LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000): Patchstack publishes details https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000 litespeed-cache-privilege-escalation-cve-2024-28000:2024-08-21:Patchstack publishes details Wed, 21 Aug 2024 00:00:00 GMT critical Source: https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/ Status: closed, patched [critical] LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000): LiteSpeed Cache 6.4 released with the fix https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000 litespeed-cache-privilege-escalation-cve-2024-28000:2024-08-13:LiteSpeed Cache 6.4 released with the fix Tue, 13 Aug 2024 00:00:00 GMT critical Source: https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/ Status: closed, patched [critical] Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE): CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07) https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102 adobe-commerce-and-magento-open-source-cve-2024-34102:2024-07-17:CISA added CVE-2024-34102 to the KEV catalog (federal deadline 2024-08-07) Wed, 17 Jul 2024 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [medium] Roundcube Webmail Cross-Site Scripting (XSS): CISA added CVE-2020-13965 to the KEV catalog (federal deadline 2024-07-17) https://pwn.watch/i/roundcube-webmail-cve-2020-13965 roundcube-webmail-cve-2020-13965:2024-06-26:CISA added CVE-2020-13965 to the KEV catalog (federal deadline 2024-07-17) Wed, 26 Jun 2024 00:00:00 GMT medium Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [critical] Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE): CVE-2024-34102 published https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102 adobe-commerce-and-magento-open-source-cve-2024-34102:2024-06-13:CVE-2024-34102 published Thu, 13 Jun 2024 00:00:00 GMT critical Source: https://nvd.nist.gov/vuln/detail/CVE-2024-34102 Status: closed, patched [critical] PHP-CGI argument injection on Windows (CVE-2024-4577): CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03) https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577 php-cgi-argument-injection-cve-2024-4577:2024-06-12:CISA added CVE-2024-4577 to the KEV catalog (federal deadline 2024-07-03) Wed, 12 Jun 2024 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [critical] PHP-CGI argument injection on Windows (CVE-2024-4577): CVE-2024-4577 published https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577 php-cgi-argument-injection-cve-2024-4577:2024-06-09:CVE-2024-4577 published Sun, 09 Jun 2024 00:00:00 GMT critical Source: https://nvd.nist.gov/vuln/detail/CVE-2024-4577 Status: closed, patched [medium] RoundCube Webmail Cross-Site Scripting (XSS): CVE-2024-37383 published https://pwn.watch/i/roundcube-webmail-cve-2024-37383 roundcube-webmail-cve-2024-37383:2024-06-07:CVE-2024-37383 published Fri, 07 Jun 2024 00:00:00 GMT medium Source: https://nvd.nist.gov/vuln/detail/CVE-2024-37383 Status: closed, patched [critical] PHP-CGI argument injection on Windows (CVE-2024-4577): DEVCORE discloses CVE-2024-4577; fixed PHP releases available https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577 php-cgi-argument-injection-cve-2024-4577:2024-06-06:DEVCORE discloses CVE-2024-4577; fixed PHP releases available Thu, 06 Jun 2024 00:00:00 GMT critical Source: https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ Status: closed, patched [medium] Roundcube Webmail Persistent Cross-Site Scripting (XSS): CISA added CVE-2023-43770 to the KEV catalog (federal deadline 2024-03-04) https://pwn.watch/i/roundcube-webmail-cve-2023-43770 roundcube-webmail-cve-2023-43770:2024-02-12:CISA added CVE-2023-43770 to the KEV catalog (federal deadline 2024-03-04) Mon, 12 Feb 2024 00:00:00 GMT medium Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [high] Laravel Deserialization of Untrusted Data: CISA added CVE-2018-15133 to the KEV catalog (federal deadline 2024-02-06) https://pwn.watch/i/laravel-framework-cve-2018-15133 laravel-framework-cve-2018-15133:2024-01-16:CISA added CVE-2018-15133 to the KEV catalog (federal deadline 2024-02-06) Tue, 16 Jan 2024 00:00:00 GMT high Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [medium] Joomla! Improper Access Control: CISA added CVE-2023-23752 to the KEV catalog (federal deadline 2024-01-29) https://pwn.watch/i/joomla-cve-2023-23752 joomla-cve-2023-23752:2024-01-08:CISA added CVE-2023-23752 to the KEV catalog (federal deadline 2024-01-29) Mon, 08 Jan 2024 00:00:00 GMT medium Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: closed, patched [high] ownCloud graphapi: Information Disclosure (CVE-2023-49103): CISA added CVE-2023-49103 to the KEV catalog (due 2023-12-21). https://pwn.watch/i/owncloud-graphapi-cve-2023-49103 owncloud-graphapi-cve-2023-49103:2023-11-30:CISA added CVE-2023-49103 to the KEV catalog (due 2023-12-21). Thu, 30 Nov 2023 00:00:00 GMT high Status: closed, patched [medium] Roundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631): CISA added CVE-2023-5631 to the KEV catalog (due 2023-11-16). https://pwn.watch/i/roundcube-webmail-cve-2023-5631 roundcube-webmail-cve-2023-5631:2023-10-26:CISA added CVE-2023-5631 to the KEV catalog (due 2023-11-16). Thu, 26 Oct 2023 00:00:00 GMT medium Status: closed, patched