Live· 8 threats on fire this week· last check 2026-10-27 08:31 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Wednesday, Oct 21

critical9.8ExploitedPHP2Shellphp2shellPHP: out-of-memory handling flaw lets a web request run code

php >= 7.3.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

62 talkingAffects you?

critical9.2ExploitedPHP2Shellphp2shellPHP: stale request-memory state lets a later request run code

php >= 5.4.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

61 talkingAffects you?

Thursday, Oct 22

critical9.2Broccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPL+1

2026-10-21 23:58 UTC

by InfraStack analyst

17 talkingAffects you?

critical9.9ExploitedArista VeloCloud Orchestrator: SQL injection lets remote attacker reach internal functions

arista velocloud orchestrator >= 5.2.0, < 5.2.3.18 · fix 5.2.3.18, 6.1.3.10 · vendor

VendorKN

2026-10-22 21:17 UTC

by CISA KEV

–Affects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25 00:00 UTC

by InfraStack analyst

3 talkingAffects you?

Tuesday, Oct 27

high⚡ Early warningExploitedCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Dahua IP cameras devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

InfrastructureI

2026-10-27 06:34 UTC

by InfraStack analyst

–Affects you?

Saturday, Oct 24

high⚡ Early warningExploiteddeepveindrillingMagento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Magento Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored

VendorI

2026-10-24 00:00 UTC

by InfraStack analyst

–Affects you?

Friday, Oct 23

unknownrefluxfsLinux kernel XFS: exchange-range TO_EOF corrupts file sizes, letting shared blocks be rewritten

CVE-2026-98974

RuntimeEN

2026-10-23 13:17 UTC

by EPSS

–Affects you?

← Saturday, Sep 12On fire · last 7 daysMonday, Sep 14 →

Live· 8 threats on fire this week· last check 2026-10-27 08:31 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Wednesday, Oct 21

critical9.8ExploitedPHP2Shellphp2shellPHP: out-of-memory handling flaw lets a web request run code

php >= 7.3.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

62 talkingAffects you?

critical9.2ExploitedPHP2Shellphp2shellPHP: stale request-memory state lets a later request run code

php >= 5.4.0, < 8.2.35 · fix 8.2.35, 8.3.36 · vendor

RuntimeIEPK+2

2026-10-20 18:35 UTC

by InfraStack analyst

61 talkingAffects you?

Thursday, Oct 22

critical9.2Broccoli2ShellHTTP2ShellNode2ShellBrotli: crafted compressed stream overflows buffer, enables remote code execution

brotli >= 1.0.3, < 1.0.10; >= 1.1.0, < 1.1.1; >= 1.2.0, < 1.2.1 · fix 1.0.10, 1.1.1, 1.2.1 · npm, pypi

PackageIEPL+1

2026-10-21 23:58 UTC

by InfraStack analyst

17 talkingAffects you?

critical9.9ExploitedArista VeloCloud Orchestrator: SQL injection lets remote attacker reach internal functions

arista velocloud orchestrator >= 5.2.0, < 5.2.3.18 · fix 5.2.3.18, 6.1.3.10 · vendor

VendorKN

2026-10-22 21:17 UTC

by CISA KEV

–Affects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25 00:00 UTC

by InfraStack analyst

3 talkingAffects you?

Tuesday, Oct 27

high⚡ Early warningExploitedCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypasses

Dahua IP cameras devices with Easy4IP P2P enabled and weak passwords or firmware vulnerable to CVE-2021-33044/33045

InfrastructureI

2026-10-27 06:34 UTC

by InfraStack analyst

–Affects you?

Saturday, Oct 24

high⚡ Early warningExploiteddeepveindrillingMagento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Magento Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored

VendorI

2026-10-24 00:00 UTC

by InfraStack analyst

–Affects you?

Friday, Oct 23

unknownrefluxfsLinux kernel XFS: exchange-range TO_EOF corrupts file sizes, letting shared blocks be rewritten

CVE-2026-98974

RuntimeEN

2026-10-23 13:17 UTC

by EPSS

–Affects you?

← Saturday, Sep 12On fire · last 7 daysMonday, Sep 14 →