Pierluigi Paganini answers questions about the PHP2Shell flaws
2026-10-25T08:51:38Z•ace9c540d734eb0c2aa4fd987a8efc61d67527650b18e342f4220a4928037b78
CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-114625CVE-2026-115560AI-assisted attacksCISA KEVChina-linked threat actorCollabora OnlinePHPPHP2ShellVeloCloud Orchestratoractive exploitationcredential theftcybercrimedata breachknown exploited vulnerabilitiesremote code executionsupply chain compromise
What happened
Security news roundup covering active exploitation and critical vulnerabilities in PHP, Collabora Online, and Arista VeloCloud Orchestrator; a major Capcom data breach; and a China-linked campaign abusing stolen ConnectWise credentials and AI-assisted tooling. The most urgent items are the PHP2Shell flaws reportedly targeted at scale and vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- ace9c540d734eb0c2aa4fd987a8efc61d67527650b18e342f4220a4928037b78
- Enrichment time
- 2026-10-25T08:51:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.