Exploited in the wild · last 30 days

Generated 5 Nov 2026, 05:34 UTC · Live view: news.rogelio.cloud/?view=exploited&show=all&since=30d

Executive summary

14 stories in the last 30 days; 8 (57%) confirmed by official sources.
14 involve vulnerabilities attackers are already exploiting. Patch these first.
Most common topic: Actively exploited (14).
Most reported vendor: Cisco (6 stories).
12 of the listed vulnerabilities are on CISA's exploited list.

Stories

Actively exploited

Breaches & ransomware

Confirmed by official sources

Stories per day

Daily breakdown, last 14 days

Exploited Breach / ransomware Other

Topics

Actively exploited — 14 (100%)

Most reported vendors

Top stories

#	Story	Confidence	Updated
1	Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 Original article	Confirmed 100 Actively exploited	4 Nov 2026
2	PHP2Shell: What to know about two critical PHP flaws Original article	Confirmed 100 Actively exploited	4 Nov 2026
3	CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure Original article	Confirmed 100 Actively exploited	31 Oct 2026
4	CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL) Original article	Confirmed 100 Actively exploited	30 Oct 2026
5	CVE-2026-76418 (Cisco Secure Firewall ASA Software and Cisco Secure FTD Software) added to CISA Known Exploited Vulnerabilities Original article	Confirmed 100 Actively exploited	29 Oct 2026
6	Cisco Expressway Series Security Hardening Release: October 2026 Original article	Confirmed 100 Actively exploited	27 Oct 2026
7	Node2Shell CVEs Original article	Confirmed 100 Actively exploited	26 Oct 2026
8	CVE-2026-110447 (Collabora Collabora Online – Built-in CODE Server) added to CISA Known Exploited Vulnerabilities Original article	Confirmed 100 Actively exploited	23 Oct 2026
9	CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Original article	Reported 80 Actively exploited	4 Nov 2026
10	Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access Original article	Reported 80 Actively exploited	31 Oct 2026
11	CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV Original article	Reported 80 Actively exploited	30 Oct 2026
12	Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw Original article	Reported 70 Actively exploited	30 Oct 2026
13	Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN Original article	Reported 70 Actively exploited	28 Oct 2026
14	Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble Original article	Reported 70 Actively exploited	28 Oct 2026

Vulnerabilities to watch

CVE	Product	Exploited	CVSS	EPSS
CVE-2026-109618	PHP Group PHP	Exploited	—	100.0%
CVE-2026-109619	PHP Group PHP	Exploited	—	100.0%
CVE-2026-20127	Cisco Catalyst SD-WAN Controller and Manager	Exploited	—	87.6%
CVE-2026-111497	Google Brotli	Exploited	—	82.6%
CVE-2026-110447	Collabora Collabora Online – Built-in CODE Server	Exploited	—	73.3%
CVE-2026-97229	GitLab Community Edition and Enterprise Edition	Exploited	—	65.2%
CVE-2026-48356	Adobe Commerce and Magento	Exploited	—	47.5%
CVE-2026-46300	Linux Kernel	Exploited	—	16.1%
CVE-2026-114625	Arista VeloCloud Orchestrator	Exploited	—	1.0%
CVE-2026-119977	WordPress WordPress Core	Exploited	—	1.0%
CVE-2026-118527	Ivanti Connect Secure	Exploited	—	0.8%
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software	Exploited	—	0.8%

Sources: official agencies, vendor security teams and the security press, linked from each story. Confidence scores reflect who reported each story. Tags and summaries are generated automatically and may be incomplete.