Node.js Brotli Decoder Flaw Allows Remote Code Execution in All Supported Versions (CVE-2026-111497)

Scope: Node.js 22.x prior to 22.23.4, 24.x prior to 24.22.1, and 26.x prior to 26.12.1; all end-of-life versions (20.x and earlier) are also exposed and will not be patched


Severity: Red

Read More

PHP2Shell Now Under Active Exploitation Hours After Emergency Patch Shipped (CVE-2026-109618 / CVE-2026-109619)

Scope: PHP branches 8.2 through 8.5, now patched

Severity: Red

Read More

Attackers Abuse UpdraftCentral Connection Keys to Silently Backdoor WordPress Sites (CVE-2026-111862)

Scope: WordPress sites running UpdraftPlus Free or Premium with an active UpdraftCentral connection key

Severity: Red

Read More

GitLab Patches Second CVSS 10.0 Unauthenticated RCE in Nine Days, This One Reaching 12 Years of Releases (CVE-2026-110264)

Scope: GitLab Community Edition and Enterprise Edition, self-managed instances, all versions from 7.0 (2014) through the newly patched releases

Severity: Red

Read More

PHP Ships Emergency Out-of-Cycle Patch Today for Two Critical RCE Flaws After Early Leak (“PHP2Shell”)

Scope: PHP branches 8.2 through 8.5 (older unsupported branches receive no fix)

Severity: Red

Read More

Qilin and INC Ransomware Groups Continue Exploiting Patched Palo Alto Flaw, Now Pivoting Directly to Virtualization Layer (CVE-2026-0257)

Scope: Palo Alto Networks PAN-OS and Prisma Access (patched since May 2026)

Severity: Amber

Read More