TL;DR Attackers are exploiting CVE-2026-102785, a YOOtheme Pro vulnerability that scores the maximum 10.0 on CVSS 4.0. Palo Alto Networks Unit 42 confirmed in-the-wild attacks on October 26. The flaw gives unauthenticated attackers remote code execution on the web server. A flaw in YOOtheme Pro's image handler lets anyone write a PHP webshell to a public folder. Automated scanners began dropping webshells two days after the patch shipped.