Kev

CISA puts PHP2Shell in KEV while public evidence of successful attacks is still contested, MeshCentral ships an emergency fix for an active exploit, and Apple brings an exploited CoreGraphics fix to iOS 18.

KEV says path traversal and file upload. Everyone else — including CISA’s own CWE field — says JWT signature bypass.

Adobe shipped a hotfix for the Magento flaw exploited since 4 September. Applying it is the easy half.