Cve.now: a Free CVE Feed for Agents

,

cve.now is a free, public vulnerability feed that consolidates data from multiple sources including the CVE List, GitHub Advisory Database, OSV, NVD, and others, providing up-to-date summaries and severity ratings for vulnerabilities. It supports integration with coding agents via an MCP server and offers features like stack checking through lockfile uploads, customizable vulnerability feeds, and multiple subscription formats. The platform requires no login or API key and aims to simplify tracking known security issues across diverse software ecosystems.

https://cve.now/

Pwn.watch · Live Security Incidents

,

Pwn.watch tracks live security incidents, reporting 43 ongoing patchable vulnerabilities and 20 breaches, including critical zero-day exploits with some lacking patches. Notable recent findings include an unpatched remote code execution in an abandoned Popcorn Time fork affecting millions of devices, leaked unpatched Linux kernel bugs with public exploit details, and a browser extension leaking cryptocurrency private keys for over 20 months. The platform highlights that while many critical flaws have been patched (e.g., in PHP, Chrome, Okta, and Citrix products), several remain actively exploited or unpatched, urging timely updates and mitigations.

https://pwn.watch/

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

,

PHP has identified a new remote code execution vulnerability (CVE-2026-115560) affecting web applications with a rare configuration involving the session upload progress feature and session serialization settings. Unlike the recent critical PHP2Shell flaws patched on October 21, this issue is considered unlikely to be exploited and will be addressed in a routine future release; meanwhile, PHP advises disabling session upload progress as a mitigation. Exploitation attempts continue against the earlier PHP2Shell vulnerabilities, but no attacks targeting this new issue have been reported.

https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

, ,

Threat actors have launched millions of attempts to exploit the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 8.2 to 8.5, aiming to deploy a Mirai botnet variant called Potassium. Despite widespread scanning and exploit attempts, no successful remote code execution or payload deployment has been confirmed, indicating difficulties in weaponizing the flaws effectively; patching has been urged as more than 34 million PHP services remain vulnerable, with significant impacts leading to precautionary website shutdowns globally.

https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

,

Security researchers at Imperva demonstrated a remote code execution exploit, dubbed “Node2Shell,” targeting an official Node.js 24.22.0 build by using crafted malicious Brotli data to trigger a vulnerability in the bundled Brotli decoder (CVE-2026-111497). The flaw affects Node.js versions 22.x, 24.x, and 26.x lines, allowing attackers to execute arbitrary code via Brotli-compressed HTTP request or response bodies, and has been fixed in Node.js 24.22.1 by adopting an upstream Brotli patch that rejects malformed streams. Users and service providers are urged to update to patched Node.js releases and limit untrusted Brotli traffic, as no workaround exists within Node.js itself.

https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html

A New Extortion Gang Is Naming Companies on the Dark Web and Counting Down to Data Leaks

,

A newly identified extortion gang called ScarlettGroup is publicly naming companies on a dark web leak site accompanied by countdown timers that pressure targets into negotiating before alleged stolen data is released. Active since September 2026, the group’s operations span multiple industries, but no confirmed breach details, malware deployment, or intrusion methods have been established by researchers at Foresiet. Organizations named by ScarlettGroup are advised to independently verify claims, strengthen access controls, and prepare incident response without relying solely on the gang’s public threats.

https://cybersecuritynews.com/a-new-extortion-gang/

PHP2Shell Exploit Tooling Found on Exposed Attacker Server

, ,

SOCRadar researchers discovered PHP2Shell exploit tooling on an exposed attacker-controlled server, including a lab-tested remote code execution chain targeting PHP 8.4.26 running as Apache mod_php and scripts scanning about 20 public websites for vulnerable configurations. Though none of the tested sites met the exploit’s preconditions or showed evidence of compromise, the findings highlight that only patching PHP removes the risk, as hardened settings alone can block this attack chain. Additional tools on the server suggest a financially motivated operator conducting wider reconnaissance and intrusion activities beyond PHP exploitation.

https://socradar.io/blog/php2shell-exploit-tooling-attacker-server/

How Likely Is Successful Mass Exploitation of PHP2SHELL?

, ,

The PHP2SHELL vulnerability presents a high-alert scenario with near-certain mass denial-of-service (DoS) and plausible mass memory disclosure across millions of PHP servers due to its unauthenticated, default-on nature affecting a decade of versions. However, reliable mass remote code execution (RCE) exploitation is significantly more complex and limited by multiple variables such as server API (SAPI) type, memory configuration, architecture, and worker affinity, making universal RCE unlikely but feasible in specific dominant stacks like default LAMP with WordPress on x86_64. Organizations are urged to patch promptly, harden systems, monitor detection signals like worker crashes and anomalous cookies, and maintain asset inventories to assess the blast radius and prepare for ongoing threat evolution.

https://www.pwndefend.com/2026/10/21/how-likely-is-mass-exploitation-of-php2shell/

PHP Blames Supply Chain Security Biz Chainguard for Putting Huge Chunks of the Web at Risk

, ,

PHP developers have accused supply chain security company Chainguard of prematurely releasing patches for critical PHP vulnerabilities known as PHP2shell, disrupting a coordinated vulnerability disclosure and potentially putting many websites at risk. The vulnerabilities, found using AI tools and tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on servers running PHP versions dating back over a decade. Chainguard’s CEO defended the early patch release, citing evidence of active exploitation, but PHP maintainers criticized the move for undermining coordination efforts amid a complex and high-impact security incident.

https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

,

Two critical remote code execution vulnerabilities with CVSS score 9.0 were publicly disclosed in the Linux kernel’s KSMBD SMB server before fixes were available. One flaw allows unauthenticated attacks via crafted SMB1/SMB2 packet handling, while the other exploits an integer underflow in SMB Direct transport requiring an RDMA interface; neither has a patch in the mainline kernel yet. These issues expose Linux servers running KSMBD to significant risk until mitigations are released and deployed.

https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

,

Amazon’s Threat Intelligence team detected an attempt to exploit the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) four days before their public disclosure, targeting its MadPot honeypot from an anonymized IP address. These flaws affect PHP versions 7.x and 8.x, allowing unauthenticated remote code execution with virtually no detectable traces, prompting worldwide cybersecurity agencies to urge immediate patching as exploitation attempts by multiple threat actors have since increased significantly.

https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

, ,

Attackers hijacked over 300 Tor exit relays in early October 2026, modifying their exit policies to intercept SSH connections by redirecting them to malicious servers that stole login passwords when users accepted fake host keys. The compromise was linked to the Ebury backdoor, installed via stolen credentials on relay operator servers, enabling persistent access and interception of encrypted SSH traffic tunneled through Tor; the Tor Project identified and removed the malicious relays by October 5. Operators affected are advised to check for signs of compromise, treat any passwords entered during the attack window as stolen, and reinstall systems after removing infected relays.

https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

,

GitLab has released patches for a critical vulnerability (CVE-2026-110264) rated CVSS 10.0 that allows unauthenticated remote code execution on self-managed servers across all versions since 7.0 (2014). The flaw stems from an integer overflow in GitLab’s patched version of the Ruby Onigmo regular-expression compiler, and while no exploitation has been reported so far, immediate updates are necessary as no workaround exists and multiple affected versions require upgrading.

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

,

PHP has released emergency patches for two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affecting nearly all versions from PHP 5.4 onward. These flaws, rated 9.2 CVSS, allow unauthenticated attackers to execute code on web servers at the runtime level, with the highest risk on Apache mod_php setups; active exploitation attempts have already been observed, prompting urgent updates to PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fully protect servers. The PHP Foundation acknowledged delayed fixes due to past challenges but emphasized that patching is the only reliable mitigation, as configuration workarounds do not fully prevent exploitation.

https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html

Cloudflare Deploys Protections Against Php2shell Vulnerability

,

Cloudflare has implemented new Web Application Firewall (WAF) protections to defend against the php2shell vulnerability, a critical PHP exploit that allows attackers to execute arbitrary code on affected servers. These protective rules detect and block attempts to exploit this vulnerability, helping to safeguard websites from potential compromise without requiring immediate patching. This deployment enhances security for Cloudflare customers by mitigating risks posed by active exploits targeting php2shell flaws.

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Scroll to Top