Skip to main content

Node.js Brotli Decoder Flaw Allows Remote Code Execution in All Supported Versions (CVE-2026-111497)

Scope: Node.js 22.x prior to 22.23.4, 24.x prior to 24.22.1, and 26.x prior to 26.12.1; al

Attackers Abuse UpdraftCentral Connection Keys to Silently Backdoor WordPress Sites (CVE-2026-111862)

Scope: WordPress sites running UpdraftPlus Free or Premium with an active UpdraftCentral c

GitLab Patches Second CVSS 10.0 Unauthenticated RCE in Nine Days, This One Reaching 12 Years of Releases (CVE-2026-110264)

Scope: GitLab Community Edition and Enterprise Edition, self-managed instances, all versio

PHP2Shell Now Under Active Exploitation Hours After Emergency Patch Shipped (CVE-2026-109618 / CVE-2026-109619)

Scope: PHP branches 8.2 through 8.5, now patched

LMCache Unauthenticated RCE Finally Patched in Version 0.5.6 (CVE-2026-105192)

Scope: LMCache (distributed key-value cache layer for the vLLM inference engine), versions

Qilin and INC Ransomware Groups Continue Exploiting Patched Palo Alto Flaw, Now Pivoting Directly to Virtualization Layer (CVE-2026-0257)

Scope: Palo Alto Networks PAN-OS and Prisma Access (patched since May 2026)

PHP Ships Emergency Out-of-Cycle Patch Today for Two Critical RCE Flaws After Early Leak (“PHP2Shell”)

Scope: PHP branches 8.2 through 8.5 (older unsupported branches receive no fix)

Subscribe to Advisories