PHP2Shell Zero-Day Exploits Force Immediate Patch for Millions of Sites
Two critical PHP flaws, PHP2Shell, allow remote code execution on PHP 8.2.x and 8.3.x sites. Immediate patching and configuration hardening are mandatory.
zero day
9 stories
FortiBleed 2.0 Exposes 40,573 Secrets, PHP2Shell Scanning Continues, and 26 Other Threats Detected
FortiBleed 2.0 uncovered 40,573 exposed credentials, while PHP2Shell scanning continues across 5 million WordPress sites.
Volt Typhoon Silent Train Deploys Four Zero-Day Exploits
China-linked Volt Typhoon leveraged the Silent Train covert network to deliver four zero-day exploits CVE-2024-39717, CVE-2025-8875.
Microsoft Patch Tuesday Zero-Days Exposed
Multiple zero-day flaws were discovered in Microsoft’s October Patch Tuesday, including unauthenticated remote code execution and privilege escalation bugs.
cPanel root vulnerability exposes shared-hosting isolation flaws
The newly disclosed cPanel root vulnerability (CVE-2026-87899) lets any hosting account execute code as root, forcing operators to rethink shared-hosting.
Former Microsoft Researcher Releases BigDiskBuster Zero-Day PoC That Halts Defender Updates
A GitHub-released PoC called BigDiskBuster fills system disks to block Microsoft Defender updates, exposing enterprises to stale protection.
VeloCloud Orchestrator CVE-2026-93952 Actively Exploited in Certificate-Based Deployments
Arista confirms active exploitation of VeloCloud Orchestrator CVE-2026-93952, a CVSS 10.0 remote code path targeting certificate-authenticated Edge devices.
WordPress Click2Shell vulnerability Enables Forced Theme Install and Remote Code Execution
The newly disclosed WordPress Click2Shell vulnerability lets attackers auto-install a theme via a crafted URL and, when chained with a vulnerable theme.
Cisco ISE zero-day Exploits API Endpoint Authentication
Cisco ISE zero-day (CVE-2026-76460) enables an API authentication bypass that can be exploited by unauthenticated actors within minutes of discovery.