Every Monday

    Security news

    Every week we go through the actively exploited vulnerabilities, incidents and new critical flaws, and tell you what to patch first. Data from NVD, CISA KEV, FIRST EPSS, NÚKIB and CSIRT.CZ.

    Security news is generated by artificial intelligence (AI) from publicly available sources. Severity and exploitation data come straight from the databases; check the vendor's guidance before changing production systems.

    RSS feed
    flowpro.local/cve
    CVE Monitor in FlowPro NG

    Free newsletter

    Get Security news by e-mail

    Every Monday morning: actively exploited vulnerabilities, incidents of the week and what to do about them. Plus FlowPro NG news a few times a year.

    Archive

    1. 25/10 – 1/11/2026
      published 01/11/2026

      Security news 44/2026

      PHP2Shell, GitLab RCE and attacks on WordPress

      The week was dominated by actively exploited critical flaws in PHP (PHP2Shell), which attackers are using to gain root on servers, and in GitLab, where code can be executed without authentication. Attacks are also targeting a freshly patched WordPress core flaw and Drupal Commerce. Web hosting and Linux server admins should prioritize updating PHP, CMSs, GitLab and the kernel; VPN admins should patch Cisco ASA/FTD and Ivanti Connect Secure.

      KEV9exploitedCRIT248criticalRead issue