The Wire
What attackers are using right now
Every bug the US government has confirmed is being used in real attacks in the last 45 days, plus Cloudflare's watch list, ranked by how much the internet is talking about it.
php2shell Hackers can take over websites running PHP without a login
Anyone running a website on PHP, including most WordPress hosting.
744K interactions todaynode2shell A booby-trapped file can take over apps that use Google Brotli
Any app or website that unpacks Brotli compressed data, which is common in web software.
7.1K interactions todayA booby-trapped setup file can take over a GitLab server
Anyone who runs their own GitLab server, Community or Enterprise Edition.
24K social interactionsA Linux flaw can let attackers run commands as root
Anyone running Linux servers. Reported as chained with the PHP flaws to plant web shells.
7.6K social interactionsIvanti Connect Secure flaw lets a logged-in user plant files
Companies that use Ivanti Connect Secure for remote access. Used together with two other flaws.
11K social interactionsIvanti Connect Secure flaw lets a local user gain more power
Companies that use Ivanti Connect Secure for remote access. Used together with two other flaws.
11K social interactionsA crafted request can make Cisco firewalls restart
Organizations using Cisco Secure Firewall ASA or FTD devices.
12K social interactionsA Linux network flaw can crash servers or let attackers in
Anyone running Linux servers, including container hosts and Kubernetes nodes.
7.9M social interactionsAttackers can run commands on Citrix NetScaler before login
Companies using Citrix NetScaler ADC or Gateway, including default setups.
Attackers can upload a malicious file to Adobe Commerce stores
Online stores built on Adobe Commerce or Magento.
A VMware ESX admin can act without leaving a log entry
Teams that run VMware ESX servers. An attacker would already need admin access.
Nextcloud's built in Collabora editor can be taken over
People who self host Nextcloud with the built in Collabora Online CODE server.
A flaw lets attackers break into Arista VeloCloud Orchestrator
Companies that run Arista VeloCloud Orchestrator on their own servers.
Attackers can read private files on Atlassian servers
Companies that run Jira, Confluence, Bitbucket or other Atlassian Data Center products.
Plex Media Server can be forced to send data to attackers
People who run Plex Media Server. Used together with other Plex flaws.
A planted file can make Siemens Software Center run attacker code
Windows users and companies who use Siemens Software Center.
A flaw in SiteGuard Server Edition lets attackers run commands
Organizations using SiteGuard Server Edition to protect their websites.
Plex Media Server flaw lets an admin write files that run
People who run Plex Media Server. Used together with three other Plex flaws.
Plex Media Server can be tricked into making outside requests
People who run Plex Media Server. Used together with other Plex flaws.
Plex Media Server flaw lets attackers call other plugins
People who run Plex Media Server. Used together with other Plex flaws.
Attackers can skip the login on BeyondTrust Remote Support
Companies using BeyondTrust Remote Support for IT help desks.
Hackers can take over WordPress sites through a web request
Anyone with a WordPress website, including small business sites.
Attackers can run commands on Ivanti Connect Secure before login
Companies that use Ivanti Connect Secure for remote access.
Fortinet admin accounts can write or delete any file
Companies using FortiOS, FortiPAM, FortiProxy or FortiSwitchManager.
A flaw lets attackers run commands on AhsayCBS backup servers
Organizations running AhsayCBS backup servers. Used together with another Ahsay flaw.
Cisco email security gateways let attackers write files
Organizations that filter email with a Cisco Secure Email Gateway.
Old ProFTPD file servers let attackers read and write files
Anyone running an older ProFTPD file transfer server.
Hackers can inject database commands into WordPress sites
Anyone with a WordPress website, including small business sites.
Attackers can skip the login on AhsayCBS backup servers
Organizations running AhsayCBS backup servers. Used together with another Ahsay flaw.
Palo Alto firewalls can be taken over by a logged-in user
Organizations using Palo Alto Networks firewalls running PAN-OS.
Old BIND DNS servers can be knocked offline
Teams running older versions of the BIND DNS server.
A Windows flaw lets attackers get around a safety check
Anyone using Windows, at home or at work.
Strapi admins can see private user details they should not
Teams that run websites on the Strapi content system. Old versions may be unsupported.
Old Apache Struts websites can be taken over remotely
Companies running websites built on Apache Struts, especially older ones.
A flaw in ONLYOFFICE Docs can let attackers take over the server
Organizations that host ONLYOFFICE Docs for shared editing.
Attackers can plant files on Fortinet FortiMail servers
Organizations using Fortinet FortiMail for email security.
Zammad flaw lets attackers hijack a login session and run code
Teams that run their own Zammad help desk. Used together with another Zammad flaw.
A bad image file can take over an iPhone, iPad or Mac
Anyone with an iPhone, iPad or Mac.
Hackers can take over WordPress sites through a theme flaw
Anyone with a WordPress website, including small business sites.
A crafted request can knock Citrix NetScaler offline
Companies using Citrix NetScaler ADC or Gateway.
Attackers can get admin access to Cisco SD-WAN Manager
Companies managing their networks with Cisco Catalyst SD-WAN Manager.
A Zammad server user can become the all powerful root user
Teams that run their own Zammad help desk. Used together with another Zammad flaw.
Citrix NetScaler flaw can crash or let attackers take over
Companies using Citrix NetScaler ADC or Gateway.
MikroTik routers can be tricked into running commands
Businesses and home users with a MikroTik router. Linked to another RouterOS flaw.
WSO2 flaw lets attackers upload files and take over servers
Companies using WSO2 API Manager and related products.
A flaw in Microsoft SharePoint lets attackers run code
Organizations that run their own SharePoint servers.
Attackers can reach private data in Adobe Commerce stores
Online stores built on Adobe Commerce or Magento.
F5 BIG-IP login systems can be taken over before login
Companies using F5 BIG-IP APM with an OAuth profile set up.
Check Point management servers let attackers run scripts
Organizations running Check Point management or log servers.
Check Point VPN gateways can be taken over remotely
Organizations using Check Point Security Gateway or Spark Firewall VPNs.
A flaw lets attackers break into Arista VeloCloud Orchestrator
Companies that run Arista VeloCloud Orchestrator on their own servers.
Zyxel GS1900 switches can be taken over from the local network
Offices and homes with a Zyxel GS1900 series network switch.
Updated 2026-11-03 18:08 UTC. KEV catalog 2026.10.30. Zero Wire checked 2026-11-03 08:44. Social interactions are a sign of attention, not of victims.