Pierluigi Paganini answers questions about the PHP2Shell flaws
2026-10-24T20:51:37Z•2bdf277b70a3ab67ddae1aa7c68129bc186a50fe34f6917ad6931dae5476cb44
CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-114625CVE-2026-115560AI-assisted-attacksCISA-KEVCapcomChina-linked-threat-actorCollabora-OnlinePHPPHP2ShellVeloCloud-Orchestratoractive-exploitationcredential-theftcybercrimedata-breachlaw-enforcementremote-code-executionsupply-chain-compromisevulnerability
What happened
Security news feed highlights active exploitation and critical vulnerabilities, including PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), a newly reported PHP code-execution issue (CVE-2026-115560), and CISA KEV additions affecting Collabora Online (CVE-2026-110447) and Arista VeloCloud Orchestrator (CVE-2026-114625). It also reports a major Capcom data breach exposing 11.7 million email addresses, a China-linked ConnectWise compromise using stolen credentials and AI-assisted tooling, and a large multinational cybercrime enforcement operation.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 2bdf277b70a3ab67ddae1aa7c68129bc186a50fe34f6917ad6931dae5476cb44
- Enrichment time
- 2026-10-24T20:51:37Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.