Attackers Abuse UpdraftCentral Connection Keys to Silently Backdoor WordPress Sites (CVE-2026-111862)

Scope: WordPress sites running UpdraftPlus Free or Premium with an active UpdraftCentral connection key

Severity: Red

Read More

GitLab Patches Second CVSS 10.0 Unauthenticated RCE in Nine Days, This One Reaching 12 Years of Releases (CVE-2026-110264)

Scope: GitLab Community Edition and Enterprise Edition, self-managed instances, all versions from 7.0 (2014) through the newly patched releases

Severity: Red

Read More

PHP2Shell Now Under Active Exploitation Hours After Emergency Patch Shipped (CVE-2026-109618 / CVE-2026-109619)

Scope: PHP branches 8.2 through 8.5, now patched

Severity: Red

Read More

LMCache Unauthenticated RCE Finally Patched in Version 0.5.6 (CVE-2026-105192)

Scope: LMCache (distributed key-value cache layer for the vLLM inference engine), versions 0.3.9 through 0.5.5 and the 0.5.6 release candidates

Severity: Red

Read More

Qilin and INC Ransomware Groups Continue Exploiting Patched Palo Alto Flaw, Now Pivoting Directly to Virtualization Layer (CVE-2026-0257)

Scope: Palo Alto Networks PAN-OS and Prisma Access (patched since May 2026)

Severity: Amber

Read More

PHP Ships Emergency Out-of-Cycle Patch Today for Two Critical RCE Flaws After Early Leak (“PHP2Shell”)

Scope: PHP branches 8.2 through 8.5 (older unsupported branches receive no fix)

Severity: Red

Read More