Security Signal

← Cyber news feed

Confirmed 100ExploitedFirst seen 23 Oct 2026, 12:00 UTC

PHP2Shell: What to know about two critical PHP flaws

Coverage

HeadlineSourceTypePublished
CVE-2026-114625 (Arista VeloCloud Orchestrator) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial23 Oct 2026, 12:00 UTC
CVE-2026-109618 (PHP Group PHP) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial26 Oct 2026, 12:00 UTC
CVE-2026-109619 (PHP Group PHP) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial26 Oct 2026, 12:00 UTC
CVE-2026-48356 (Adobe Commerce and Magento) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial27 Oct 2026, 12:00 UTC
CVE-2026-111497 (Google Brotli) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial27 Oct 2026, 12:00 UTC
CVE-2026-41709 (Broadcom VMware ESX) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial28 Oct 2026, 12:00 UTC
CVE-2026-46300 (Linux Kernel) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial28 Oct 2026, 12:00 UTC
CVE-2026-97229 (GitLab Community Edition and Enterprise Edition) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial29 Oct 2026, 12:00 UTC
CVE-2026-118527 (Ivanti Connect Secure) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial30 Oct 2026, 12:00 UTC
CVE-2026-111357 (Ivanti Connect Secure) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial30 Oct 2026, 12:00 UTC
CVE-2026-119977 (WordPress WordPress Core) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial3 Nov 2026, 12:00 UTC
CVE-2024-27834 (Apple Multiple Products) added to CISA Known Exploited Vulnerabilities CISA Known Exploited VulnerabilitiesOfficial4 Nov 2026, 12:00 UTC
PHP2Shell: What to know about two critical PHP flaws ESET WeLiveSecurityVendor research26 Oct 2026, 13:25 UTC

Vulnerabilities

CVEExploited (CISA KEV)CVSSEPSS
CVE-2026-114625 Yes, since 23 Oct 2026 — —
CVE-2026-109618 Yes, since 26 Oct 2026 — —
CVE-2026-109619 Yes, since 26 Oct 2026 — —
CVE-2026-48356 Yes, since 27 Oct 2026 — —
CVE-2026-111497 Yes, since 27 Oct 2026 — —
CVE-2026-41709 Yes, since 28 Oct 2026 — —
CVE-2026-46300 Yes, since 28 Oct 2026 — —
CVE-2026-97229 Yes, since 29 Oct 2026 — —
CVE-2026-118527 Yes, since 30 Oct 2026 — —
CVE-2026-111357 Yes, since 30 Oct 2026 — —
CVE-2026-119977 Yes, since 3 Nov 2026 — —
CVE-2024-27834 Yes, since 4 Nov 2026 — —

CVSS from NVD; EPSS is FIRST’s estimate of the chance of exploitation in the next 30 days.

Why this score

Most trusted source90
Independent organisations reporting it (2)+5
Confirmed by an official source or CISA KEV+10
Confidence100 · Confirmed
We link to the original reporting and don’t reproduce it. Read the sources above for the full details.