data_types_exposed:personal_data × cves:CVE-2026-109618 × limpar

Resultados

2 casos · pág. 1/1

thehackernews.com · há 34min · 28 fontes · 43 atualizações exploit público critical

PHP2Shell: critical PHP RCE flaws CVE-2026-109618/109619 patched; mass exploitation attempts, Potassium Mirai botnet, European sites offline

The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…

CVE-2026-109618 CVE-2026-109619 government transportation

thehackernews.com · há 1d · 4 fontes · 4 atualizações exploit público critical

Attackers abuse UpdraftCentral keys stolen in TeamUpdraft breach to backdoor WordPress sites via malicious plugins

Unknown threat actors breached the TeamUpdraft website on 17-18 October 2026 and likely accessed its customer database, which holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack observed an attacker holding valid UpdraftCentral dashboard keys issuing signed commands to install backdoor plugins on connected …

CVE-2026-10795 CVE-2026-111862 CVE-2026-109618 technology