Citrix has patched two vulnerabilities (CVE-2026-88771, CVE-2026-88772) that been exploited in zero-day attacks to plant webshells.

Citrix has patched two vulnerabilities (CVE-2026-88771, CVE-2026-88772) that been exploited in zero-day attacks to plant webshells.

ShinyHunters-linked attackers exploit CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules to deploy web shells on dozens of systems.

Attackers are exploiting a critical flaw in a third-party WooCommerce plugin to upload PHP webshells

Attackers are exploiting a critical flaw in a third-party WooCommerce plugin to upload PHP webshells

Attackers are exploiting a critical flaw in a third-party WooCommerce plugin to upload PHP webshells

Attackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP webshells and execute remote code on WordPress sites.

A critical flaw in the WooCommerce Wholesale Lead Capture plugin (CVE-2026-27540) is being used to plant PHP webshells. Over 100,000 attacks blocked, but many sites remain vulnerable. Update to v2.0.3

Cómo bloquear la ejecución de PHP en wp-content/uploads con .htaccess en Apache o un bloque location en Nginx, para frenar webshells.

 A critical vulnerability in the Elementor Pro WordPress plugin is being actively exploited to upload malicious PHP files and execute commands remotely on the affected websites.  The vulnerability, tracked as CVE-2026-32475, affects the Elementor Pro versions 4.2.1 and lower. This issue was patched on August 19. Elementor Pro has more than 6 million active installations and is widely used to design WordPress websites with drag-and-drop tools.  The vulnerability is related to the insufficient validation of file-upload arrays in Elementor Pro forms. Attackers can exploit this issue by uploading an empty file as the first element of the upload array and a malicious PHP file as the second. Then the plugin will not validate the following files in the array, thus allowing the attacker-controlled PHP payload to be successfully uploaded on the server without any additional checks.  Once the malicious file is uploaded, it will be stored on the /wp-content/uploads/elementor/forms/ directory with a randomly generated name but preserving the attacker’s .php extension. Then the attacker will be able to directly access this file on the server to execute arbitrary commands and potentially deploy a webshell for further attacks. To successfully exploit the vulnerability, an attacker needs to have access to a WordPress website with a published Elementor Pro Form widget that contains at least one File Upload field.  This is a relatively common case for WordPress websites that utilize Elementor Pro forms. WordPress security company Defiant, which operates the Wordfence firewall, noted that exploitation began on August 19, the same day Elementor released the 4.2.2 version to address the vulnerability. Wordfence observed that the traffic was especially heavy between August 19 and 23, having blocked more than 190,000 attempts to target its customers.  Wordfence has identified IP addresses that were responsible for thousands of exploitation attempts. Website administrators can add these addresses to their blocklists to protect their WordPress sites. Administrators that utilize Elementor Pro need to make sure to update their software to the latest versions, preferably 4.2.2 or newer. Moreover, they should check their /wp-content/uploads/elementor/forms/ directories for any unexpected .php files.  As the name suggests, the directory is supposed to contain the files that users upload with Elementor forms, meaning that the discovery of any .php files should be investigated and potentially result in an intrusion assessment.

Bug no plugin WordPress com mais de 6 milhões de instalações permite upload de webshells e execução remota de comandos. Há patch desde 19 de agosto, mas os ataques já rolam.

A critical vulnerability in Elementor Pro, tracked as CVE-2026-32475, is being actively exploited to upload webshells and run arbitrary commands on WordPress servers. Defiant’s Wordfence has blocked nearly 200,000 attempts since the patch on August 19, and administrators should upgrade to Elementor Pro 4.2.2 or later and inspect the uploads directory for rogue PHP files. #CVE-2026-32475 #ElementorPro #Wordfence

Unauthenticated file upload in Elementor Pro 4.2.1 and earlier, patched in 4.2.2.