Attackers exploited a pair of critical PHP flaws dubbed PHP2Shell, along with a new Check Point zero-day (CVE-2026-123039), to breach Security Gateway appliances and escalate to root access. Starting October 30, they first struck Israeli organizations and then expanded globally on November 2, installing webshells and a TSGA backdoor before using network scanning tools to pivot into VMware ESXi hosts and deploy a destructive wiper called destroy_v6.
bleepingcomputer.com
· 2026-11-13
CISA confirmed active exploitation of a high-severity flaw in Cisco BroadWorks, a cloud platform telecom carriers and MSPs use to deliver hosted PBX and collaboration services. The bug, an XXE weakness in the Open Client Interface XML Parser, lets unauthenticated remote attackers extract sensitive configuration data via crafted XML messages, and Cisco patched it in August. CISA has added it to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to remediate by November 24 under Binding Operational Directive 26-04.
bleepingcomputer.com
· 2026-11-11
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
bleepingcomputer.com
· 2026-10-30
CISA added CVE-2026-46300, a Linux kernel privilege-escalation bug dubbed Fragnesia, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by Saturday. The flaw, found in the XFRM ESP-in-TCP subsystem, grants root access and can reportedly be chained with two critical PHP vulnerabilities known as PHP2Shell to install webshells on unpatched systems.
bleepingcomputer.com
· 2026-10-29
CISA has confirmed active exploitation of two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to achieve remote code execution on unpatched systems. PHP issued patches on October 21, and CISA has ordered federal civilian agencies to secure their systems by Thursday under Binding Operational Directive 26-04.
bleepingcomputer.com
· 2026-10-27
Eclypsium's September InfraTrust Pulse report logged 158 new security advisories across 17 vendors between August 25 and September 17, covering 1,699 vulnerabilities. Of these, 42 were rated critical, eight scored a maximum 10.0 severity, 71 could be exploited remotely without authentication, and five advisories included flaws later added to CISA's Known Exploited Vulnerabilities catalog. The report singles out a maximum-severity Cisco Secure Firewall Management Center authentication bypass, CVE-2026-20079, which Cisco confirmed on September 9 was being actively exploited, allowing attackers to run commands as root without credentials.
bleepingcomputer.com
· 2026-09-23
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog after confirming active attacks. The flaw allows unauthenticated LAN attackers to run OS commands via crafted HTTP requests, and federal agencies must secure affected devices by Thursday under Binding Operational Directive 26-04. Zyxel issued firmware fixes on June 16 but has not yet updated its advisory to acknowledge exploitation.
bleepingcomputer.com
· 2026-09-22
GoKawiil