https://vulnpocalypse.dev/feeds/PHP interpreter and PHP application advisories: WordPress, Drupal, Joomla and anything running on PHP-FPM or mod_php.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/ncsc-warns-ai-powered-ransomware-is-highly-likely-to-hit-uk-critical-infrastruct/https://vulnpocalypse.dev/advisories/ncsc-warns-ai-powered-ransomware-is-highly-likely-to-hit-uk-critical-infrastruct/Wed, 11 Nov 2026 12:00:00 +0000The UK NCSC says AI-powered malware is highly likely to feature in ransomware attacks on critical infrastructure by 2028, so patch and fix the basics now.ai-toolsai-toolsenterprisephphttps://vulnpocalypse.dev/advisories/italy-intel471-reports-outlier-rates-of-vulnerability-based-initial-access/https://vulnpocalypse.dev/advisories/italy-intel471-reports-outlier-rates-of-vulnerability-based-initial-access/Wed, 11 Nov 2026 12:00:00 +0000Dark Reading reports Intel471 data showing Italian firms are outliers in sold access via vulnerabilities; patch exposed web systems and retire old PHP.exploitedwebphpenterprisehttps://vulnpocalypse.dev/advisories/wordpress-7-1-4-core-update-race-rce/https://vulnpocalypse.dev/advisories/wordpress-7-1-4-core-update-race-rce/Wed, 11 Nov 2026 12:00:00 +0000Full core updates in WordPress 4.7 to 7.1.3 open a brief unauthenticated RCE window. Update to 7.1.4 or your branch's fix and block wp-content/upgrade.exploitedphpwebhttps://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/https://vulnpocalypse.dev/advisories/panos-php2shell-cve-2026-109618/Wed, 11 Nov 2026 12:00:00 +0000PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train's hotfix and take management off the internet.exploitednetwork-edgephpenterprisehttps://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/https://vulnpocalypse.dev/advisories/freepbx-cyble-reports-inj3ctor3-malware-now-steals-sip-trunk-credentials/Wed, 11 Nov 2026 12:00:00 +0000Cyble reports INJ3CTOR3 malware now exfiltrates FreePBX SIP trunk credentials, so isolate and clean hosts before rotating any secrets.exploitedphpnetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/Wed, 11 Nov 2026 12:00:00 +0000An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/gmo-internet-and-park24-disclose-cyberattacks-and-pay-users-report-says/https://vulnpocalypse.dev/advisories/gmo-internet-and-park24-disclose-cyberattacks-and-pay-users-report-says/Wed, 11 Nov 2026 12:00:00 +0000GMO Internet Group and Park24 say they will compensate users after cyberattacks, Indian Express reports; customers should follow company notices.breachenterprisewebphphttps://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/https://vulnpocalypse.dev/advisories/php2shell-cve-2026-109618-109619/Wed, 11 Nov 2026 12:00:00 +0000Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.exploitedphphttps://vulnpocalypse.dev/advisories/reversinglabs-reports-ai-linked-malware-signals-rising-no-clear-attack-surge/https://vulnpocalypse.dev/advisories/reversinglabs-reports-ai-linked-malware-signals-rising-no-clear-attack-surge/Tue, 10 Nov 2026 12:00:00 +0000ReversingLabs says LLM API references in malicious files are rising but no AI attack surge is shown; review exposure to PHP2Shell CVEs.ai-toolsai-toolsphpvuln-datahttps://vulnpocalypse.dev/advisories/cert-polska-reports-four-widzialnicms-flaws-fixed-in-25/https://vulnpocalypse.dev/advisories/cert-polska-reports-four-widzialnicms-flaws-fixed-in-25/Mon, 09 Nov 2026 12:00:00 +0000CERT Polska reports four vulnerabilities in WidzialniCMS before 2.5, including unauthenticated file upload; upgrade to version 2.5.exploitedwebphphttps://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/https://vulnpocalypse.dev/advisories/stylesmuggler-magento-psk-rat/Mon, 09 Nov 2026 12:00:00 +0000A coordinated campaign abused the Magento StyleSmuggler flaw (CVE-2026-75650) to run code on Adobe Commerce stores and install the PSK Agent Go RAT.breachwebenterprisephphttps://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/https://vulnpocalypse.dev/advisories/suspected-chinese-actor-chains-php2shell-and-fragnesia-to-root-25-pan-os-servers/Mon, 09 Nov 2026 12:00:00 +0000A suspected China-nexus actor chained PHP2Shell with the Fragnesia kernel flaw to root 25 Palo Alto PAN-OS servers, including three in a USai-toolsphpnetwork-edgeenterpriseai-toolshttps://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/Fri, 06 Nov 2026 12:00:00 +0000Rapid7 says new Metasploit modules target Citrix NetScaler, Flowise, SPIP and OpenBullet2 flaws, so check exposure and apply vendor fixes.ai-toolsnetwork-edgeci-cdai-toolsphpopen-sourcewebhttps://vulnpocalypse.dev/advisories/nikkei-reports-japan-to-seek-vulnerability-data-from-us-ai-firms/https://vulnpocalypse.dev/advisories/nikkei-reports-japan-to-seek-vulnerability-data-from-us-ai-firms/Fri, 06 Nov 2026 12:00:00 +0000Nikkei reports Japan wants early access to undisclosed vulnerability data from US AI firms; PHP CVE details are not confirmed, so check PHP patches.ai-toolsphpai-toolsvuln-datahttps://vulnpocalypse.dev/advisories/help-net-security-reports-php2shell-exploitation-in-november-forecast/https://vulnpocalypse.dev/advisories/help-net-security-reports-php2shell-exploitation-in-november-forecast/Fri, 06 Nov 2026 12:00:00 +0000Help Net Security reports in-the-wild exploitation of PHP2Shell PHP flaws; update the PHP runtime and restart the web server.exploitedphpwebenterpriseendpointhttps://vulnpocalypse.dev/advisories/wordfence-reports-weekly-wordpress-vulnerability-roundup-for-oct-26-to-nov-1/https://vulnpocalypse.dev/advisories/wordfence-reports-weekly-wordpress-vulnerability-roundup-for-oct-26-to-nov-1/Thu, 05 Nov 2026 12:00:00 +0000Wordfence reports a weekly WordPress vulnerability roundup for October 26 to November 1, 2026, so check it against your installed WordPress components.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/Thu, 05 Nov 2026 12:00:00 +0000A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.supply-chainai-toolsopen-sourcecloudcryptophpnodejsci-cdhttps://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/https://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/Wed, 04 Nov 2026 12:00:00 +0000Help Net Security reports Impart claims its new AI harness ships tested virtual patches fast; these are vendor claims, so verify them independently.ai-toolsnodejsphpwebai-toolshttps://vulnpocalypse.dev/advisories/idnsec-reports-42-openemr-advisories-fixed-in-850-patch-now/https://vulnpocalypse.dev/advisories/idnsec-reports-42-openemr-advisories-fixed-in-850-patch-now/Wed, 04 Nov 2026 12:00:00 +0000IDNSEC reports 42 OpenEMR advisories credited to its research, fixed in 8.5.0; self-hosted operators should upgrade to 8.5.0.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/https://vulnpocalypse.dev/advisories/cryptopayment-gateway-flaw-exploited/Wed, 04 Nov 2026 12:00:00 +0000CVE-2026-81648, a CVSS 10.0 missing authorization flaw in the CryptoPayment Gateway WordPress plugin, is being exploited and has no fix.exploitedphpwebcryptohttps://vulnpocalypse.dev/advisories/cloudflare-launches-zero-wire-a-public-hub-for-triaging-critical-internet-vulner/https://vulnpocalypse.dev/advisories/cloudflare-launches-zero-wire-a-public-hub-for-triaging-critical-internet-vulner/Wed, 04 Nov 2026 12:00:00 +0000Cloudflare launched Zero Wire on Radar, a public feed of briefings on critical vulnerabilities, with exploitation evidence kept separate from severity.ecosystemvuln-datawebphpcloudhttps://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/https://vulnpocalypse.dev/advisories/palo-alto-networks-ceo-says-ai-is-driving-faster-cyberattacks-etciso-reports/Tue, 03 Nov 2026 12:00:00 +0000Palo Alto Networks CEO says AI is speeding up cyberattacks, ETCISO reports; test exposed infrastructure for known flaws and misconfigurations.ai-toolsai-toolsphpenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/Mon, 02 Nov 2026 12:00:00 +0000October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.ai-toolsphpnodejspypinpmgithub-actionsai-toolscryptocloudhttps://vulnpocalypse.dev/advisories/magento-polyshell-cve-2026-48356/https://vulnpocalypse.dev/advisories/magento-polyshell-cve-2026-48356/Mon, 02 Nov 2026 12:00:00 +0000PolyShell lets attackers upload code to Magento and Adobe Commerce stores and is in CISA KEV. Install the -2026-jul builds, then check CMS blocks and pub/media.exploitedphpwebhttps://vulnpocalypse.dev/advisories/php-session-upload-progress-cve-2026-115560/https://vulnpocalypse.dev/advisories/php-session-upload-progress-cve-2026-115560/Mon, 02 Nov 2026 12:00:00 +0000A new PHP session upload progress RCE needs an unusual setup and has no fix yet. Set session.upload_progress.enabled=0; Windows users install the -1 builds.exploitedphpwebhttps://vulnpocalypse.dev/advisories/collabora-code-nextcloud-cve-2026-110447/https://vulnpocalypse.dev/advisories/collabora-code-nextcloud-cve-2026-110447/Mon, 02 Nov 2026 12:00:00 +0000An unauthenticated command injection in Nextcloud's Built-in CODE Server app is used to drop web shells. Update richdocumentscode to 26.4.303 or remove it.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/updraftcentral-key-compromise/https://vulnpocalypse.dev/advisories/updraftcentral-key-compromise/Mon, 02 Nov 2026 12:00:00 +0000Stolen UpdraftCentral keys let attackers install backdoor plugins on UpdraftPlus sites. Update to 1.26.13 or 2.26.13, delete keys, then hunt for the backdoor.supply-chainphpwebhttps://vulnpocalypse.dev/advisories/rank-math-pro-backdoor/https://vulnpocalypse.dev/advisories/rank-math-pro-backdoor/Mon, 02 Nov 2026 12:00:00 +0000Rank Math PRO 3.0.123 copies fetched 15-16 Oct 2026 held a self-restoring backdoor. Delete the plugin folder, clear three options, install 3.0.124.supply-chainphpwebhttps://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/https://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/Mon, 02 Nov 2026 12:00:00 +0000lightning 2.6.2 and 2.6.3 on PyPI stole credentials on import and spread via GitHub and npm. Check installs, rotate secrets, use 2.6.1 or 2.6.4+.supply-chainpypinpmphpai-toolsci-cdhttps://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/https://vulnpocalypse.dev/advisories/bithumb-daishin-securities-and-mirae-asset-report-hacks-in-new-south-korean-fina/Wed, 28 Oct 2026 12:00:00 +0000Bithumb, Daishin Securities and Mirae Asset reported hacking incidents on Oct 28, 2026, with Daishin confirming exposed customer contact data; root cause isbreachcryptoenterprisewebphphttps://vulnpocalypse.dev/advisories/wordfence-reports-wordpress-vulnerabilities-for-october-12-to-18-2026/https://vulnpocalypse.dev/advisories/wordfence-reports-wordpress-vulnerabilities-for-october-12-to-18-2026/Fri, 23 Oct 2026 12:00:00 +0000Wordfence says it published its weekly WordPress vulnerability report for October 12 to 18, 2026, so check it against the WordPress components you run.exploitedphpwebopen-source