TL;DR WPScan reports that attackers are exploiting CVE-2026-123751, an unpatched WP Duplicate vulnerability that leads to remote code execution. The flaw affects WP Duplicate, formerly LocalSync, up to version 1.1.11. According to WPScan, "This vulnerability is being actively exploited in the wild." An authentication bypass lets unauthenticated attackers upload any file to a WordPress site running WP Duplicate. No fix exists yet.

TL;DR Barracuda confirmed on November 9, 2026, that attackers are exploiting a Barracuda ESG vulnerability chain against "a small number of organizations." The chain joins CVE-2026-116606, an authorization bypass, with CVE-2026-111560, a command injection bug. Together, they give an attacker root access to the Email Security Gateway. Notably, watchTowr Labs published full technical details and proof-of-concept exploit code six days earlier.

TL;DR Microsoft fixed an actively exploited Outlook zero-day, CVE-2026-124194, in its November 2026 Patch Tuesday release on November 10. The spoofing flaw carries a CVSS score of 6.5. On the same day, CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until November 24 to patch. Attackers exploited a flaw in Microsoft Outlook that fails to warn users before unsafe actions.

TL;DR JPCERT/CC has warned that attackers are exploiting CVE-2026-111793, an Openwave Webtop vulnerability in the Webtop Media Transcoder. According to the advisory, "The developer states that attacks exploiting the vulnerability have been observed." The flaw affects all versions before 1.1.22.0. Webtop Media Transcoder ignores the file type limits that administrators set. As a result, a logged-in user can convert document types the admin meant to block.

TL;DR The UnrealIRCd team says attackers are now exploiting CVE-2026-114713, a critical flaw in the open-source IRC server. "We are seeing bad guys exploiting this issue on the internet right now," the project warned. This UnrealIRCd vulnerability lets any ordinary user run commands with server or IRC operator authority. CVE-2026-114713 lets normal users inject server-to-server commands through the labeled-response module.

TL;DR On November 4, 2026, Japan's JPCERT/CC warned about an Airbyte vulnerability that allows arbitrary code execution. The flaw "has been confirmed to be exploited in the wild." The flaw affects all Airbyte versions before 2.2.0. Airbyte itself rates the bug critical, with a CVSS 3.1 score of 9.9. Airbyte's Connector Builder let users load unintended Python classes, which can lead to command execution in the container.

TL;DR Attackers used a Zyxel GS1900 zero-day, now tracked as CVE-2026-107441, to break into network switches that admins believed were patched. Binarly researchers Fernando Mercês and Yegor Vasilenko found the flaw while studying an exploit left on an attacker's server. Zyxel's June fix for a related bug, CVE-2026-7273, did not stop it. CVE-2026-107441 is an out-of-bounds write in the GS1900 web interface.

TL;DR On October 26, 2026, CISA added the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (CISA KEV) catalog. Federal agencies must patch by October 29. Meanwhile, a researcher confirmed full remote code execution in the wild, and CYFIRMA tied low-volume scanning to a suspected North Korea-linked operator. Why It Matters PHP runs a large share of the web.

TL;DR On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 to fix CVE-2026-86950, an exploited CoreGraphics zero-day. Apple says the flaw "may have been exploited" against "specific targeted individuals." The update brings the fix to older iPhones and iPads that cannot run newer iOS versions. Why It Matters This CoreGraphics zero-day is already confirmed as exploited. CISA added it to its Known Exploited Vulnerabilities catalog on September 29, 2026.

TL;DR Canada's Cyber Centre updated its Fortinet advisory on October 23, 2026, to warn that CVE-2026-106173 "is being exploited in the wild." This FortiSIEM vulnerability, rated CVSS 9.4, lets unauthenticated attackers write files and run code. Horizon3 has already published full technical details and a public proof-of-concept exploit. Why It Matters FortiSIEM collects security data across entire networks. Taking it over gives attackers a view of everything defenders see.

TL;DR Arista says attackers are actively exploiting CVE-2026-114625, a critical VeloCloud Orchestrator vulnerability rated CVSS 9.9. The SQL injection flaw lets any logged-in user gain "superuser operator" privileges on on-prem VCO. Fixes are available in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. Why It Matters VeloCloud Orchestrator manages SD-WAN networks, so it controls traffic across many branch sites. A takeover can therefore reach far beyond one server.

TL;DR Attackers are now exploiting PHP2Shell, a pair of critical PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Amazon saw the first attempt on October 17, four days before disclosure, and multiple public proof-of-concept exploits appeared on October 21. Admins should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Why It Matters PHP powers an estimated 75% to 80% of websites, including WordPress, Joomla and Drupal sites.

TL;DR On October 16-17, 2026, Defused's honeypots caught attackers exploiting CVE-2026-25243, a Redis RESTORE vulnerability rated CVSS 7.7. The memory bug can lead to remote code execution for users who can run RESTORE. Redis 8.6.3 fixes it. Why It Matters Redis sits behind many web apps as a cache and data store. Many instances also run with weak or shared credentials.

TL;DR On October 19, 2026, Siemens confirmed that attackers are exploiting CVE-2026-110936 in the wild. The Siemens Software Center vulnerability is a DLL sideloading flaw that a ClickFix campaign uses to run malware under a trusted, signed program. Version 4.0.9.8 fixes it. Why It Matters Siemens Software Center downloads, installs and updates Siemens software. Its files carry a valid Siemens signature, which makes them a useful disguise.

TL;DR Attackers began exploiting Plex Media Server vulnerabilities on October 17, 2026, one day after researcher Zach Main published full details and PoC code for his "Plex2Shell" chain. The chain links four CVEs into unauthenticated remote code execution. A honeypot caught attackers dropping a cryptominer and a proxy tool. Why It Matters Many people run Plex at home, often on residential IP addresses.

TL;DR JPCERT/CC warned on October 14, 2026, that attackers are exploiting CVE-2026-106931 in SiteGuard Server Edition. The SiteGuard Server Edition vulnerability is an OS command injection flaw that can grant root or SYSTEM access. Fixes and patches are available now. Why It Matters SiteGuard Server Edition is a host-based web application firewall from EG Secure Solutions. It sits directly on web servers, so a breach puts the server itself at risk.

TL;DR Ivanti disclosed CVE-2026-104935 on October 13, 2026, and confirmed the flaw is already exploited in the wild. The Ivanti Connect Secure vulnerability lets a remote, unauthenticated attacker run arbitrary commands. Fixed versions are available now. Why It Matters Connect Secure is a VPN gateway that sits at the network edge. A breach can therefore give attackers a foothold inside corporate networks.

TL;DR Attackers are exploiting two unauthenticated stored XSS flaws in Ninja Forms and WPC Product Bundles for WooCommerce, according to Patchstack. The WordPress XSS campaign plants a script that hijacks an administrator's session and installs four separate backdoors, including an admin account hidden from the dashboard. Site owners should update both plugins and check for signs of compromise. Why It Matters…

TL;DR Attackers have begun CVE-2026-21589 exploitation against self-managed Atlassian servers. Researchers at watchTowr published a full technical breakdown and working proof-of-concept for the arbitrary file read flaw. Days later, threat intelligence firm Previdian Cyber reported honeypot traffic matching the bug. Admins who have not patched Jira, Confluence, Bitbucket or related products should do so now. Why It Matters This flaw needs no login and no user interaction.

TL;DR A Sharp printer vulnerability, now tracked as CVE-2024-58388, lets unauthenticated attackers read any file on the device. Exploit details and a working proof-of-concept have been public since June 2024. Attackers began exploiting the flaw in the wild by July 2024. Why It Matters VulnCheck assigned the CVE on October 1, 2026, more than two years after the bug went public.

TL;DR Attackers chained two Zammad zero-day flaws to break into the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21. The pair, CVE-2026-102489 and CVE-2026-102490, took the intruders from a hijacked session to root in seconds. DIVD says the attack looked like the work of an agentic AI, and it urges every Zammad user to upgrade to version 7 or take the system…

TL;DR Attackers are exploiting a MediaWiki RCE flaw tracked as CVE-2026-100382. This CVSS 10 unauthenticated RCE sits in the popular External Data extension. Details and a proof-of-concept are public, and hijacked wikis are already hosting web shells. Admins should upgrade to External Data 3.7 or disable it now. Why It Matters The External Data RCE went public on September 25. Within a day, bots began hitting wikis that run the extension.

TL;DR watchTowr has published a technical analysis and a public proof-of-concept for CVE-2026-88771, a Citrix NetScaler flaw already exploited in the wild as a zero-day. The pre-authentication command injection can run attacker commands as root on default configurations. CISA added the flaw to its KEV catalog on September 27, 2026. Why the CVE-2026-88771 Flaw Matters NetScaler ADC and NetScaler Gateway sit at the edge of thousands of enterprise networks.

TL;DR A KGUARD DVR vulnerability now tracked as CVE-2026-87827 carries a maximum CVSS score of 10.0. It lets an unauthenticated attacker run commands and fully take over the device. Mirai botnets have already exploited it in the wild. Why this KGUARD DVR vulnerability matters Digital video recorders sit on many home and business networks. A full takeover turns them into attack tools.

TL;DR Cisco confirmed active attacks on a critical Cisco Secure Email Gateway vulnerability. Tracked as CVE-2026-76461, it scores a CVSS 9.8. An unauthenticated attacker can send a crafted email and run commands as root. Why this Cisco Secure Email Gateway vulnerability matters Email gateways sit at the edge of corporate networks. They inspect every inbound message. A root-level flaw there hands attackers deep control.