TL;DR Rapid7 has published a full technical analysis and a working Metasploit module for CVE-2026-102764. This BeyondTrust Remote Support vulnerability is already exploited in the wild. The flaw scores 9.3 on CVSS v4. According to Rapid7, it lets "an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user." Attackers abused this zero-day from August 2026, well before BeyondTrust disclosed it on October 15.

TL;DR Drupal's security team has rated an access bypass in Commerce Core "Highly critical" and confirmed active attacks. The Drupal Commerce vulnerability, tracked as CVE-2026-118539, scores 21 out of 25 on Drupal's risk scale. According to advisory SA-CONTRIB-2026-254, "This vulnerability is being actively exploited in the wild." Commerce Core fails to protect certain routes and entity fields, which can cause financial losses for store owners.

TL;DR Drupal's security team has rated an access bypass in Commerce Core "Highly critical" and confirmed active attacks. The Drupal Commerce vulnerability, tracked as CVE-2026-118539, scores 21 out of 25 on Drupal's risk scale. According to advisory SA-CONTRIB-2026-254, "This vulnerability is being actively exploited in the wild." Commerce Core fails to protect certain routes and entity fields, which can cause financial losses for store owners.

TL;DR Attackers have exploited CVE-2026-112353, a stored XSS flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. According to the CVE record published by VulnCheck, "Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer." This Kerio Connect vulnerability scores 8.2 on CVSS v3.1 and 6.2 on CVSS v4. A crafted SVG email attachment can run JavaScript in a victim's Webmail session.

TL;DR On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux's own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack "came close to working," so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA's KEV catalog.

TL;DR Attackers have exploited CVE-2026-112353, a stored XSS flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. According to the CVE record published by VulnCheck, "Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer." This Kerio Connect vulnerability scores 8.2 on CVSS v3.1 and 6.2 on CVSS v4. A crafted SVG email attachment can run JavaScript in a victim's Webmail session.

TL;DR On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux's own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack "came close to working," so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA's KEV catalog.

TL;DR On October 28, CISA added a Linux kernel vulnerability and a VMware ESX flaw to its Known Exploited Vulnerabilities catalog. The kernel bug, CVE-2026-46300, is being chained with the PHP2Shell flaws. According to CISA, the chain lets attackers "implant PHP webshells and run commands as root." CISA confirms active exploitation of both flaws. Federal agencies must fix the Linux kernel vulnerability by October 31, and the ESX bug by November 11.

TL;DR On October 28, CISA added a Linux kernel vulnerability and a VMware ESX flaw to its Known Exploited Vulnerabilities catalog. The kernel bug, CVE-2026-46300, is being chained with the PHP2Shell flaws. According to CISA, the chain lets attackers "implant PHP webshells and run commands as root." CISA confirms active exploitation of both flaws. Federal agencies must fix the Linux kernel vulnerability by October 31, and the ESX bug by November 11.

TL;DR Previdian's honeypot network has caught attackers targeting CVE-2026-116690, an MLflow vulnerability that lets unauthenticated users read files from the server. The attempts surfaced within a day of the CVE's publication on October 27. MLflow's GitHub advisories now publish full details and proof-of-concept code for this flaw. The same is true for a related critical RCE bug. Attackers are already probing MLflow servers for CVE-2026-116690 (CVSS 7.5), an arbitrary file read flaw.

TL;DR Previdian's honeypot network has caught attackers targeting CVE-2026-116690, an MLflow vulnerability that lets unauthenticated users read files from the server. The attempts surfaced within a day of the CVE's publication on October 27. MLflow's GitHub advisories now publish full details and proof-of-concept code for this flaw. The same is true for a related critical RCE bug. Attackers are already probing MLflow servers for CVE-2026-116690 (CVSS 7.5), an arbitrary file read flaw.

TL;DR On October 27, CISA added two actively exploited flaws to its Known Exploited Vulnerabilities list, better known as the CISA KEV catalog. The first, CVE-2026-48356, hits Adobe Commerce and Magento. The second, CVE-2026-111497, is a Brotli vulnerability in Google's widely used compression library. CISA says it has evidence of active exploitation for both flaws. Federal agencies must patch by November 10, 2026.

TL;DR Attackers are exploiting CVE-2026-102785, a YOOtheme Pro vulnerability that scores the maximum 10.0 on CVSS 4.0. Palo Alto Networks Unit 42 confirmed in-the-wild attacks on October 26. The flaw gives unauthenticated attackers remote code execution on the web server. A flaw in YOOtheme Pro's image handler lets anyone write a PHP webshell to a public folder. Automated scanners began dropping webshells two days after the patch shipped.

 Hackers are still aggressively exploiting a critical bug in cPanel and WHM, the widely used web hosting control software that powers countless websites across the internet. The flaw, tracked as CVE-2026-41940, lets attackers bypass the login screen and seize administrative access to affected servers without a password. Because cPanel is deeply embedded in shared hosting environments, a single compromised server can expose many unrelated websites at once.  The scale of the problem is large. Security researchers say more than 550,000 cPanel servers may be vulnerable, while roughly 2,000 instances were believed to be compromised at the time of reporting, down from about 44,000 last week. That drop suggests some hosting providers and administrators have already begun cleaning up or blocking attacks, but the threat remains active and widespread.  What makes the issue especially dangerous is how much control the bug gives to attackers. Once inside, criminals can manage website files, databases, SSL certificates, and other critical settings tied to every site hosted on the server. In practice, that means they can deface websites, install backdoors, steal data, or redirect visitors to malicious pages, all from the control panel intended for legitimate administrators. The vulnerability has also shown signs of being abused before the public disclosure. One hosting provider reported seeing exploitation attempts as early as late February, well before the issue was officially disclosed and patched. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, confirming that it is being used in real-world attacks and should be treated as an urgent patching priority.  For site owners, the response needs to be immediate and practical. Systems should be patched to the latest cPanel and WHM releases, exposed login panels should be restricted where possible, and administrators should check for unauthorized users, modified files, suspicious SSH keys, and unexpected database changes. Hosting providers such as Namecheap, HostGator, and KnownHost have already taken emergency steps, including temporarily blocking access while they applied fixes. The wider lesson is that a single authentication-bypass flaw in a core admin tool can become a large-scale internet incident almost overnight.