Is It? The Wirehttps://isitexploited.org/wire/What attackers are using right now.php2shell: Hackers can take over websites running PHP without a loginhttps://isitexploited.org/cve/CVE-2026-109618/https://isitexploited.org/cve/CVE-2026-109618/Anyone running a website on PHP, including most WordPress hosting. Update PHP to the latest version, or ask your web host to do it.node2shell: A booby-trapped file can take over apps that use Google Brotlihttps://isitexploited.org/cve/CVE-2026-111497/https://isitexploited.org/cve/CVE-2026-111497/Any app or website that unpacks Brotli compressed data, which is common in web software. Update software and containers that include Brotli. Apply each vendor's security update.A booby-trapped setup file can take over a GitLab serverhttps://isitexploited.org/cve/CVE-2026-97229/https://isitexploited.org/cve/CVE-2026-97229/Anyone who runs their own GitLab server, Community or Enterprise Edition. Apply GitLab's latest security update to your self-run GitLab server.A Linux flaw can let attackers run commands as roothttps://isitexploited.org/cve/CVE-2026-46300/https://isitexploited.org/cve/CVE-2026-46300/Anyone running Linux servers. Reported as chained with the PHP flaws to plant web shells. Install your Linux distribution's kernel update and reboot. Also patch PHP.Ivanti Connect Secure flaw lets a logged-in user plant fileshttps://isitexploited.org/cve/CVE-2026-118527/https://isitexploited.org/cve/CVE-2026-118527/Companies that use Ivanti Connect Secure for remote access. Used together with two other flaws. Apply the vendor's mitigations and updates for Ivanti Connect Secure, covering all three linked flaws.Ivanti Connect Secure flaw lets a local user gain more powerhttps://isitexploited.org/cve/CVE-2026-111357/https://isitexploited.org/cve/CVE-2026-111357/Companies that use Ivanti Connect Secure for remote access. Used together with two other flaws. Apply the vendor's mitigations and updates for Ivanti Connect Secure, covering all three linked flaws.A crafted request can make Cisco firewalls restarthttps://isitexploited.org/cve/CVE-2026-76418/https://isitexploited.org/cve/CVE-2026-76418/Organizations using Cisco Secure Firewall ASA or FTD devices. Apply Cisco's security update for your firewall and confirm the fix with Cisco's advisory.A Linux network flaw can crash servers or let attackers inhttps://isitexploited.org/cve/CVE-2026-98432/https://isitexploited.org/cve/CVE-2026-98432/Anyone running Linux servers, including container hosts and Kubernetes nodes. Install your Linux distribution's kernel update and reboot.Attackers can run commands on Citrix NetScaler before loginhttps://isitexploited.org/cve/CVE-2026-88771/https://isitexploited.org/cve/CVE-2026-88771/Companies using Citrix NetScaler ADC or Gateway, including default setups. Update NetScaler using Citrix's bulletin. If you may be hit, investigate as well.Attackers can upload a malicious file to Adobe Commerce storeshttps://isitexploited.org/cve/CVE-2026-48356/https://isitexploited.org/cve/CVE-2026-48356/Online stores built on Adobe Commerce or Magento. Apply Adobe's latest security update for Commerce or Magento.A VMware ESX admin can act without leaving a log entryhttps://isitexploited.org/cve/CVE-2026-41709/https://isitexploited.org/cve/CVE-2026-41709/Teams that run VMware ESX servers. An attacker would already need admin access. Apply Broadcom's update for VMware ESX and review who holds admin access.Nextcloud's built in Collabora editor can be taken overhttps://isitexploited.org/cve/CVE-2026-110447/https://isitexploited.org/cve/CVE-2026-110447/People who self host Nextcloud with the built in Collabora Online CODE server. Update Collabora Online and Nextcloud to the latest versions.A flaw lets attackers break into Arista VeloCloud Orchestratorhttps://isitexploited.org/cve/CVE-2026-114625/https://isitexploited.org/cve/CVE-2026-114625/Companies that run Arista VeloCloud Orchestrator on their own servers. Apply Arista's security update for VeloCloud Orchestrator.Attackers can read private files on Atlassian servershttps://isitexploited.org/cve/CVE-2026-21589/https://isitexploited.org/cve/CVE-2026-21589/Companies that run Jira, Confluence, Bitbucket or other Atlassian Data Center products. Apply Atlassian's security update for your Data Center products.Plex Media Server can be forced to send data to attackershttps://isitexploited.org/cve/CVE-2026-96652/https://isitexploited.org/cve/CVE-2026-96652/People who run Plex Media Server. Used together with other Plex flaws. Update Plex Media Server to the latest version.A planted file can make Siemens Software Center run attacker codehttps://isitexploited.org/cve/CVE-2026-110936/https://isitexploited.org/cve/CVE-2026-110936/Windows users and companies who use Siemens Software Center. Apply Siemens' update for Software Center.A flaw in SiteGuard Server Edition lets attackers run commandshttps://isitexploited.org/cve/CVE-2026-106931/https://isitexploited.org/cve/CVE-2026-106931/Organizations using SiteGuard Server Edition to protect their websites. Apply the vendor's update for SiteGuard Server Edition.Plex Media Server flaw lets an admin write files that runhttps://isitexploited.org/cve/CVE-2026-96656/https://isitexploited.org/cve/CVE-2026-96656/People who run Plex Media Server. Used together with three other Plex flaws. Update Plex Media Server to the latest version.Plex Media Server can be tricked into making outside requestshttps://isitexploited.org/cve/CVE-2026-96655/https://isitexploited.org/cve/CVE-2026-96655/People who run Plex Media Server. Used together with other Plex flaws. Update Plex Media Server to the latest version.Plex Media Server flaw lets attackers call other pluginshttps://isitexploited.org/cve/CVE-2026-96654/https://isitexploited.org/cve/CVE-2026-96654/People who run Plex Media Server. Used together with other Plex flaws. Update Plex Media Server to the latest version.Attackers can skip the login on BeyondTrust Remote Supporthttps://isitexploited.org/cve/CVE-2026-102764/https://isitexploited.org/cve/CVE-2026-102764/Companies using BeyondTrust Remote Support for IT help desks. Apply BeyondTrust's update for Remote Support.Hackers can take over WordPress sites through a web requesthttps://isitexploited.org/cve/CVE-2026-63030/https://isitexploited.org/cve/CVE-2026-63030/Anyone with a WordPress website, including small business sites. Update WordPress to the latest version. Check: Dashboard > Updates.Attackers can run commands on Ivanti Connect Secure before loginhttps://isitexploited.org/cve/CVE-2026-104935/https://isitexploited.org/cve/CVE-2026-104935/Companies that use Ivanti Connect Secure for remote access. Apply the vendor's mitigations and updates for Ivanti Connect Secure.Fortinet admin accounts can write or delete any filehttps://isitexploited.org/cve/CVE-2025-61624/https://isitexploited.org/cve/CVE-2025-61624/Companies using FortiOS, FortiPAM, FortiProxy or FortiSwitchManager. Apply Fortinet's update for your products.A flaw lets attackers run commands on AhsayCBS backup servershttps://isitexploited.org/cve/CVE-2026-105134/https://isitexploited.org/cve/CVE-2026-105134/Organizations running AhsayCBS backup servers. Used together with another Ahsay flaw. Apply Ahsay's update for AhsayCBS.Cisco email security gateways let attackers write fileshttps://isitexploited.org/cve/CVE-2026-76519/https://isitexploited.org/cve/CVE-2026-76519/Organizations that filter email with a Cisco Secure Email Gateway. Apply Cisco's security update for Secure Email Gateway.Old ProFTPD file servers let attackers read and write fileshttps://isitexploited.org/cve/CVE-2015-3306/https://isitexploited.org/cve/CVE-2015-3306/Anyone running an older ProFTPD file transfer server. Update ProFTPD to the latest version.Hackers can inject database commands into WordPress siteshttps://isitexploited.org/cve/CVE-2026-60137/https://isitexploited.org/cve/CVE-2026-60137/Anyone with a WordPress website, including small business sites. Update WordPress to the latest version. Check: Dashboard > Updates.Attackers can skip the login on AhsayCBS backup servershttps://isitexploited.org/cve/CVE-2026-105133/https://isitexploited.org/cve/CVE-2026-105133/Organizations running AhsayCBS backup servers. Used together with another Ahsay flaw. Apply Ahsay's update for AhsayCBS.Palo Alto firewalls can be taken over by a logged-in userhttps://isitexploited.org/cve/CVE-2026-0322/https://isitexploited.org/cve/CVE-2026-0322/Organizations using Palo Alto Networks firewalls running PAN-OS. Apply Palo Alto Networks' update for PAN-OS.Old BIND DNS servers can be knocked offlinehttps://isitexploited.org/cve/CVE-2015-5477/https://isitexploited.org/cve/CVE-2015-5477/Teams running older versions of the BIND DNS server. Update BIND to a supported version.A Windows flaw lets attackers get around a safety checkhttps://isitexploited.org/cve/CVE-2026-96951/https://isitexploited.org/cve/CVE-2026-96951/Anyone using Windows, at home or at work. Run Windows Update, then restart your PC. Check: Settings > Windows Update.Strapi admins can see private user details they should nothttps://isitexploited.org/cve/CVE-2023-22894/https://isitexploited.org/cve/CVE-2023-22894/Teams that run websites on the Strapi content system. Old versions may be unsupported. Update Strapi, or move off any version the vendor no longer supports.Old Apache Struts websites can be taken over remotelyhttps://isitexploited.org/cve/CVE-2016-3081/https://isitexploited.org/cve/CVE-2016-3081/Companies running websites built on Apache Struts, especially older ones. Update Apache Struts to a supported version and turn off Dynamic Method Invocation.A flaw in ONLYOFFICE Docs can let attackers take over the serverhttps://isitexploited.org/cve/CVE-2021-3199/https://isitexploited.org/cve/CVE-2021-3199/Organizations that host ONLYOFFICE Docs for shared editing. Update ONLYOFFICE Docs to the latest version.Attackers can plant files on Fortinet FortiMail servershttps://isitexploited.org/cve/CVE-2026-104286/https://isitexploited.org/cve/CVE-2026-104286/Organizations using Fortinet FortiMail for email security. Apply Fortinet's update for FortiMail.Zammad flaw lets attackers hijack a login session and run codehttps://isitexploited.org/cve/CVE-2026-102489/https://isitexploited.org/cve/CVE-2026-102489/Teams that run their own Zammad help desk. Used together with another Zammad flaw. Update Zammad to the latest version.A bad image file can take over an iPhone, iPad or Machttps://isitexploited.org/cve/CVE-2026-86950/https://isitexploited.org/cve/CVE-2026-86950/Anyone with an iPhone, iPad or Mac. Update to the latest iOS, iPadOS or macOS. Check: Settings > General > Software Update.Hackers can take over WordPress sites through a theme flawhttps://isitexploited.org/cve/CVE-2026-87902/https://isitexploited.org/cve/CVE-2026-87902/Anyone with a WordPress website, including small business sites. Update WordPress to the latest version. Check: Dashboard > Updates.A crafted request can knock Citrix NetScaler offlinehttps://isitexploited.org/cve/CVE-2026-88779/https://isitexploited.org/cve/CVE-2026-88779/Companies using Citrix NetScaler ADC or Gateway. Apply Citrix's update for NetScaler.