Weekly report flags PHP and FortiSIEM flaws under attack

Between 19 and 25 October 2026, CVE Watchtower logged 4,222 new CVEs, with Daily Cybersecurity (DC) flagging six flaws as exploited during the period. Of these six, two had already reached CISA KEV, while four were exclusive to DC at the time of reporting. The report cautions that the DC vs KEV comparison is feed-to-feed and not a controlled benchmark, and notes that some “Not listed” flaws may still be added to KEV later.

DC identifies several notable weaknesses. PHP (PHP2Shell) flaws CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution on PHP servers; DC says these are being exploited at scale in the wild, with first attempts around 17 October and Cloudflare noting millions of probe attempts, but KEV had not listed them by 23 October.

Fortinet FortiSIEM cites CVE-2026-106173, with open-source reporting indicating active exploitation; Arista’s VeloCloud Orchestrator suffers SQL injection under CVE-2026-114625, with CISA adding it to KEV a day after DC flagged it. Additional DC-exclusive entries include Plex Media Server flaws CVE-2026-96656 (arbitrary file write), CVE-2026-96654 (Encoded URI scheme injection), CVE-2026-96652 (SSRF), and CVE-2026-96655 (SSRF).

Collabora Online’s CVE-2026-110447 is noted as being used to plant webshells on Nextcloud servers, while Plex and Collabora are also linked to related exploit activity. The piece also lists CVEs tied to Redis (CVE-2026-66373) and Siemens Software Center (CVE-2026-110936) among DC-exposed entries.

CVE-2026-109618 coverage
Published (UTC)	Outlet	Headline
Wed 21 Oct · 00:58 UTC	SecurityOnline	PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm
Wed 21 Oct · 02:31 UTC	Ars Technica	PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts
Wed 21 Oct · 06:00 UTC	The Hacker News	PHP Prepares Emergency Fixes for Two Critical RCE Flaws
Wed 21 Oct · 07:15 UTC	SecurityWeek	Critical PHP2Shell flaws could expose servers to remote code execution
Wed 21 Oct · 10:52 UTC	NCSC	NCSC urges PHP users to patch flaws that could enable server takeover
Wed 21 Oct · 11:00 UTC	Infosecurity	PHP2Shell flaws threaten remote code execution across PHP websites
Wed 21 Oct · 11:00 UTC	SOCRadar	PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution
Wed 21 Oct · 14:06 UTC	Unit 42	Critical PHP Flaws Enable Remote Code Execution Across Web Servers
Wed 21 Oct · 15:23 UTC	The Hacker News	PHP Patches Critical Unauthenticated Flaws That Expose Web Servers
Wed 21 Oct · 15:23 UTC	Securelist	Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8
Wed 21 Oct · 16:00 UTC	Krebs on Security	PHP Zero Days Put Millions of Websites at Risk of Remote Takeover
Wed 21 Oct · 17:08 UTC	SecurityWeek	PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers
Wed 21 Oct · 17:11 UTC	Malwarebytes	Critical PHP Flaws Trigger Emergency Patches as Attacks Begin
Wed 21 Oct · 17:54 UTC	SANS ISC	Critical PHP flaws enable remote code execution as exploit PoCs emerge
Wed 21 Oct · 18:01 UTC	SecurityOnline	PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs
Wed 21 Oct · 18:01 UTC	Rapid7	Critical PHP Flaws Enable Remote Code Execution Without Login
Wed 21 Oct · 19:59 UTC	Dark Reading	Critical PHP Flaws Enable Unauthenticated Code Execution on Servers
Thu 22 Oct · 09:24 UTC	The Hacker News	Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot
Thu 22 Oct · 10:14 UTC	SecurityWeek	Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public
Thu 22 Oct · 11:38 UTC	SecurityOnline	QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable
Thu 22 Oct · 12:52 UTC	SecurityWeek	Attackers Target Critical PHP Flaws Before Patches Were Released
Thu 22 Oct · 13:29 UTC	SecurityOnline	cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting
Thu 22 Oct · 15:23 UTC	SecurityOnline	Gcore Offers Free Web Protection to Governments After PHP Attacks
Thu 22 Oct · 16:01 UTC	Security Affairs	AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed
Thu 22 Oct · 16:01 UTC	SOCRadar	Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable
Fri 23 Oct · 00:23 UTC	Darktrace	PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches
Fri 23 Oct · 04:30 UTC	SecurityOnline	Okta fixes critical Access Gateway flaws enabling remote code execution
Fri 23 Oct · 08:36 UTC	The Hacker News	Attackers exploit PHP2Shell flaws to build a Mirai derived botnet
Fri 23 Oct · 12:00 UTC	The Hacker News	PHP Warns of Unpatched RCE Risk in Rare Session Configurations
Fri 23 Oct · 12:35 UTC	Security Affairs	Critical PHP Flaws Trigger Millions of Exploit Attempts in Days
Fri 23 Oct · 13:13 UTC	SecurityWeek	Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In
Fri 23 Oct · 20:59 UTC	Dark Reading	Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It
Sun 25 Oct · 19:00 UTC	The Hacker News	PHP2Shell attackers target a European government entity
Mon 26 Oct · 01:30 UTC	SecurityOnline	PHP2Shell flaws put products running PHP at risk of remote code execution
Mon 26 Oct · 03:20 UTC	SecurityOnline	Weekly report flags PHP and FortiSIEM flaws under attack (this article)

CVE-2026-109618 coverage

Published (UTC)

Outlet

Headline

Wed 21 Oct · 00:58 UTC

SecurityOnline

PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm

Wed 21 Oct · 02:31 UTC

Ars Technica

PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts

Wed 21 Oct · 06:00 UTC

The Hacker News