Live· 14 threats on fire this week· last check 2026-10-25 08:36 UTC

Everything we’re tracking.

One entry per event, merged from every source that reports it. Written by a model from the sources, labelled as such, then checked by the analyst on the ones that matter.

SeveritySignalCategorySourcesFirst publicSocialAffects you

Wednesday, Oct 21

critical9.2ExploitedPHP2Shellphp2shellPHP: stale request-memory state lets a later request run code

php >= 5.4.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPL+1

2026-10-20 18:35 UTC

by InfraStack analyst

52 talkingAffects you?

critical9.8ExploitedPHP2Shellphp2shellPHP: out-of-memory handling flaw lets a web request run code

php >= 7.3.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPL+1

2026-10-20 18:35 UTC

by InfraStack analyst

51 talkingAffects you?

high7.7ZDI-26-703Airbyte SharePoint connector: authenticated SSRF leaks data via shared drive lookup

airbyte unknown

PackageIEN

2026-10-21 18:17 UTC

by InfraStack analyst

–Affects you?

Thursday, Oct 22

critical9.2Broccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPL+1

2026-10-21 23:58 UTC

by InfraStack analyst

8 talkingAffects you?

critical9.9ExploitedArista VeloCloud Orchestrator: SQL injection lets remote attacker reach internal functions

arista velocloud orchestrator >= 5.2.0, < 5.2.3.18 · fix 5.2.3.18, 6.1.3.10 · vendor

VendorKN

2026-10-22 21:17 UTC

by CISA KEV

–Affects you?

high8.7ExploitedYouDataSum CPAS audit system lets anyone read server files

CPAS Audit Management System V4 (no finer range published) · vendor

OtherIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

high8.8Exploitedi-Netsolution Unilevel MLM ecommerce: SQL injection lets anonymous visitors read the database

Readymade Unilevel Ecommerce MLM 2024-03-15 build (latest tested; earlier builds unknown) · vendor

OtherIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

critical9.1ExploitedYiShaAdmin: unauthenticated path traversal reads and deletes server files

YiShaAdmin >= 2.2, <= 3.1 · fix commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef · github

PackageIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

high8.7ExploitedOrbiTeam BSCW Server: unauthenticated path traversal reads local files

BSCW Server >= 5.0.0, < 5.2.5; >= 7.0.0, < 7.4.4 · fix 5.2.5, 7.4.4 · vendor

PackageIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

critical9.8ExploitedDedeCMS: crafted Referer header lets unauthenticated visitors run PHP code

DedeCMS 5.8.1-beta (pre-release), per CVE through 5.8.1-beta · vendor

OtherIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

critical9.8ExploitedFineReport: unauthenticated path traversal lets attackers write webshells

FineReport 9.0 · vendor

VendorIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

high8.7ExploitedWeaver E-cology 8.0: unauthenticated path traversal reads arbitrary server files

E-cology 8.0 · vendor

OtherIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

high8.8ExploitedSeaCMS: unauthenticated SQL injection leaks database contents via error messages

SeaCMS <= 8.7 · php

PackageIEN

2026-10-22 11:17 UTC

by InfraStack analyst

–Affects you?

Friday, Oct 23

unknownrefluxfsLinux kernel XFS: exchange-range TO_EOF corrupts file sizes, letting shared blocks be rewritten

CVE-2026-98974

RuntimeN

2026-10-23 13:17 UTC

by NVD

–Affects you?

← Saturday, Oct 24On fire · last 7 daysnow