Live· 9 threats on fire this week· last check 2026-10-27 14:35 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Wednesday, Oct 21

critical9.8ExploitedPHP2Shellphp2shellPHP: out-of-memory handling flaw lets a web request run code

php >= 7.3.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

64 talkingAffects you?

critical9.2ExploitedPHP2Shellphp2shellPHP: stale request-memory state lets a later request run code

php >= 5.4.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

62 talkingAffects you?

critical⚡ Early warningExploitedlitellm 1.107.0 compromiselitellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

litellm = 1.107.0

PackageI

2026-10-21 00:00 UTC

by InfraStack analyst

1 talkingAffects you?

Thursday, Oct 22

critical9.2Broccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPL+1

2026-10-21 23:58 UTC

by InfraStack analyst

17 talkingAffects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25 00:00 UTC

by InfraStack analyst

4 talkingAffects you?

Tuesday, Oct 27

critical⚡ Early warningExploitedGMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-

VendorI

2026-10-27 01:30 UTC

by InfraStack analyst

–Affects you?

high⚡ Early warningExploitedCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Dahua IP cameras devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

InfrastructureI

2026-10-27 06:34 UTC

by InfraStack analyst

–Affects you?

Saturday, Oct 24

high⚡ Early warningExploiteddeepveindrillingMagento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Magento Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored

VendorI

2026-10-24 00:00 UTC

by InfraStack analyst

–Affects you?

Friday, Oct 23

unknownrefluxfsLinux kernel XFS: exchange-range TO_EOF corrupts file sizes, letting shared blocks be rewritten

CVE-2026-98974

RuntimeEN

2026-10-23 13:17 UTC

by EPSS

–Affects you?

← Friday, Sep 4On fire · last 7 daysSunday, Sep 6 →

Live· 9 threats on fire this week· last check 2026-10-27 14:35 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Wednesday, Oct 21

critical9.8ExploitedPHP2Shellphp2shellPHP: out-of-memory handling flaw lets a web request run code

php >= 7.3.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

64 talkingAffects you?

critical9.2ExploitedPHP2Shellphp2shellPHP: stale request-memory state lets a later request run code

php >= 5.4.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

62 talkingAffects you?

critical⚡ Early warningExploitedlitellm 1.107.0 compromiselitellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

litellm = 1.107.0

PackageI

2026-10-21 00:00 UTC

by InfraStack analyst

1 talkingAffects you?

Thursday, Oct 22

critical9.2Broccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPL+1

2026-10-21 23:58 UTC

by InfraStack analyst

17 talkingAffects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25 00:00 UTC

by InfraStack analyst

4 talkingAffects you?

Tuesday, Oct 27

critical⚡ Early warningExploitedGMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-

VendorI

2026-10-27 01:30 UTC

by InfraStack analyst

–Affects you?

high⚡ Early warningExploitedCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Dahua IP cameras devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

InfrastructureI

2026-10-27 06:34 UTC

by InfraStack analyst

–Affects you?

Saturday, Oct 24

high⚡ Early warningExploiteddeepveindrillingMagento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Magento Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored

VendorI

2026-10-24 00:00 UTC

by InfraStack analyst

–Affects you?

Friday, Oct 23

unknownrefluxfsLinux kernel XFS: exchange-range TO_EOF corrupts file sizes, letting shared blocks be rewritten

CVE-2026-98974

RuntimeEN

2026-10-23 13:17 UTC

by EPSS

–Affects you?

← Friday, Sep 4On fire · last 7 daysSunday, Sep 6 →