Critical RCE PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Critical heap use-after-free vulnerabilities in the PHP core allow unauthenticated remote code execution and memory disclosure targeting web servers globally.

Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.
A pre-authentication memory overread vulnerability (CVE-2026-8451) in Citrix NetScaler appliances configured as SAML IdPs allows for information leakage and denial of service.