PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites
Two PHP core memory-safety flaws allow remote code execution on 69% of web servers, prompting emergency patches and site outages.
rce
9 stories
CVE-2026-111497: Brotli Decoder Out-of-Bounds Write Enables RCE Across Multiple Platforms
CVE-2026-111497 is an out-of-bounds write in Brotli’s decoder that can lead to remote code execution. Inventory – Identify all systems that use Brotli.
PHP2Shell CVEs Force Immediate Patch for Millions of Sites
Two critical PHP CVEs expose millions of sites to unauthenticated RCE; patches released, scanning activity detected, and mitigation steps outlined.
PHP2Shell RCE Exposes Web Apps – Immediate Patch Required
A remote code execution flaw in PHP2Shell allows attackers to run arbitrary commands on vulnerable servers. Apply the vendor patch before exploitation.
PHP2Shell RCE Exposes Palo Alto GlobalProtect VPN
Palo Alto Networks PAN-OS and Panorama servers exposed to PHP2Shell RCE; update to PHP 8.5.12 or later and apply vendor patches immediately.
GitLab Integer Overflow RCE Affects All Self-Managed Releases Since 2014
A CVSS 10.0 flaw in GitLab’s regex engine lets unauthenticated users run code on self-managed servers from 7.0 onward. Immediate patching is required.
Microsoft Patch Tuesday Zero-Days Exposed
Multiple zero-day flaws were discovered in Microsoft’s October Patch Tuesday, including unauthenticated remote code execution and privilege escalation bugs.
Bricksforge RCE Exploit Enables Unauthenticated Remote Code Execution
A CVSS 10.0 vulnerability (CVE-2026-85097) in the Bricksforge WordPress plugin allows attackers to execute arbitrary PHP code without authentication.
Orkes Conductor CVE-2026-58138: Critical Pre-Auth RCE Actively Exploited
The Orkes Conductor CVE-2026-58138 vulnerability is a critical pre-authentication remote code execution flaw that is being actively exploited.