Critical severityAdvisories
PHP2Shell: the critical PHP vulnerability and how to patch it
Two critical PHP flaws allow code execution with no login. Update PHP itself and restart every worker.
Advisories
Patch and mitigation notices, each with a severity, its identifiers and one action.
Critical
CVSS 9.0 or more, or confirmed mass exploitation of internet-facing software.
- Critical severity
Critical severityAdvisories
CISA lists exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS
Four exploited perimeter and backup flaws. Patch PAN-OS, Cisco email gateways and AhsayCBS, and lock down management.
High
CVSS 7.0 to 8.9, or exploited with prerequisites.
High severityAdvisories
Microsoft October 2026 Patch Tuesday: exploited Windows Shell flaw and two public zero-days
An exploited Windows Shell bypass leads the October 2026 updates. Deploy it first, then the .NET fix.
High severityAdvisories
Ivanti Connect Secure zero-day CVE-2026-104935 exploited in a three-flaw chain
Exploited Ivanti Connect Secure authentication bypass. Upgrade to a fixed build, then hunt for compromise.
Informational
Guidance with no CVE.
Informational severityAdvisories
ASD and partners update their Active Directory compromise guidance to 18 techniques
More categories
Found one of these on your systems?
Tell us what you run. We patch, contain and check for signs of compromise.