CISA puts PHP2Shell in KEV while public evidence of successful attacks is still contested, MeshCentral ships an emergency fix for an active exploit, and Apple brings an exploited CoreGraphics fix to iOS 18.
An exploited Electrum flaw, AWS and Oracle deadlines for the eMudhra distrust, the first PAN-OS PHP2Shell hotfixes, and two governance takeovers in DeFi.
An exploited Collabora CODE app in KEV, a third PHP session bug, the Brotli flaw reaching Python and Envoy, an Okta Access Gateway chain, and 72 ArubaOS fixes.
An exploited VeloCloud SQL injection, a Node.js Brotli bug with a working RCE demo, a now-reliable PHP2Shell exploit, and Railway’s secrets breach.
LiteLLM shipped a backdoored release, PHP2Shell attempts predate disclosure, GitLab fixed a CVSS 10, and Oracle issued an out-of-band Java fix.