Actively exploited

Stories about vulnerabilities attackers are using now, including new entries in CISA’s Known Exploited Vulnerabilities catalogue.

1. Confirmed 100Exploited6 h ago

   Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026

   Source: Cisco Security Advisories
   CVE-2026-111497
2. Confirmed 100Exploited13 h ago

   PHP2Shell: What to know about two critical PHP flaws

   2 sources: CISA Known Exploited Vulnerabilities, ESET WeLiveSecurity
   CVE-2026-114625CVE-2026-109618CVE-2026-109619CVE-2026-48356CVE-2026-111497CVE-2026-41709+6 more
3. Reported 80Exploited19 h ago

   CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

   Source: The Hacker News
   CVE-2026-119977
4. Reported 80Exploited5 days ago

   Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

   Source: The Hacker News
   CVE-2026-111357
5. Confirmed 100Exploited5 days ago

   CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

   2 sources: AWS Security Bulletins, Palo Alto Networks Security Advisories
   CVE-2026-111497
6. Confirmed 100Exploited5 days ago

   CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)

   3 sources: Unit 42, Palo Alto Networks Security Advisories, Cisco Security Advisories
   CVE-2026-109618CVE-2026-109619
7. Reported 70Actively exploited6 days ago

   Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

   Source: The Hacker News
   CVE-2026-118539
8. Reported 80Exploited6 days ago

   CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

   Source: The Hacker News
   CVE-2026-97229
9. Confirmed 100Exploited7 days ago

   CVE-2026-76418 (Cisco Secure Firewall ASA Software and Cisco Secure FTD Software) added to CISA Known Exploited Vulnerabilities

   Source: CISA Known Exploited Vulnerabilities
   CVE-2026-76418
10. Reported 70Exploited7 days ago

    Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

    Source: Cisco Talos
    CVE-2026-20127
11. Reported 70Actively exploited7 days ago

    Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

    Source: The Register (Security)
12. Confirmed 100Actively exploited8 days ago

    Cisco Expressway Series Security Hardening Release: October 2026

    Source: Cisco Security Advisories
13. Confirmed 100Exploited10 days ago

    Node2Shell CVEs

    Source: Fortinet PSIRT
    CVE-2026-111497CVE-2026-105482CVE-2026-105483CVE-2026-106069CVE-2026-105481CVE-2026-106072
14. Confirmed 100Exploited13 days ago

    CVE-2026-110447 (Collabora Collabora Online – Built-in CODE Server) added to CISA Known Exploited Vulnerabilities

    Source: CISA Known Exploited Vulnerabilities
    CVE-2026-110447