Vulnerability notices · 01/11/2026 04:17 Amsterdam time
ReconX Watchtower
ReconX Watchtower follows official advisories, CERTs, reputable researchers and the security community around the clock. When a vulnerability needs attention we publish what is known, what is not known yet and what to do - early, and updated as the evidence grows.
Current notices · 30 · page 1 of 2
- 4 · Exploitedsince 26/10/2026PHP remote code execution (PHP2Shell)9.2CriticalPHP · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 · updated 28/10/2026≈2.96Minternet-facing systems run PHP≈1.32M still vulnerableShodan estimate · 01/11/2026
- 4 · Exploitedsince 27/10/2026Node2Shell: Brotli decoder flaw (CVE-2026-111497) exploited in the wild, fixed in Node.js 22.23.4, 24.22.1, 26.12.19.2CriticalNode.js · CVE-2026-111497 · updated 28/10/2026≈1.42Minternet-facing systems run Node.jsShodan estimate · 01/11/2026
- 4 · Exploitedsince 28/10/2026Drupal core: critical RCE in Field UI (CVE-2026-108097) fixed; Commerce Core flaw (CVE-2026-118539) exploitedDrupal · Critical · updated 29/10/2026≈32,100internet-facing systems run DrupalShodan estimate · 01/11/2026
- 4 · Exploitedsince 28/10/2026Cisco Secure Firewall ASA and FTD: remote access VPN denial of service (CVE-2026-76418) exploited, fixes released9.9CriticalCisco ASA / Secure Firewall · CVE-2026-20329, CVE-2026-20330, CVE-2026-20331 … · updated 30/10/2026≈25,300internet-facing systems run Cisco ASA / Secure FirewallShodan estimate · 01/11/2026
- 4 · Exploitedsince 30/10/2026Ivanti Connect Secure: chained zero-days (CVE-2026-104935, CVE-2026-111357) exploited in the wild, fixes released7.0HighIvanti Connect Secure (Pulse Secure) · CVE-2026-111357 · updated 30/10/2026≈6,432internet-facing systems run Ivanti Connect Secure (Pulse Secure)Shodan estimate · 01/11/2026
- 4 · Exploitedsince 13/10/2026Ivanti Connect Secure: zero-day authentication bypass (CVE-2026-104935) exploited in the wild8.6HighIvanti Connect Secure (Pulse Secure) · CVE-2026-104935 · published 26/10/2026≈6,432internet-facing systems run Ivanti Connect Secure (Pulse Secure)Shodan estimate · 01/11/2026
- 4 · Exploitedsince 14/10/2026Cisco Secure Email Gateway (AsyncOS): root code execution via a crafted email attachment (CVE-2026-76519), actively exploited9.8CriticalCisco Secure Email Gateway (AsyncOS) · CVE-2026-76519 · updated 26/10/2026≥2,357internet-facing systems run Cisco Secure Email Gateway (AsyncOS)Shodan · at least · 01/11/2026
- 4 · Exploitedsince 28/10/2026 13:19Oracle PeopleSoft PeopleTools: missing-authentication flaw (CVE-2026-35273) exploited in the wild9.8CriticalOracle E-Business Suite · CVE-2025-61882, CVE-2026-35273 · published 30/10/2026
- 4 · Exploitedsince 29/10/2026GitLab CE/EE: critical code execution flaw (CVE-2026-97229) exploited in the wild, fixed in 19.4.2, 19.3.5, 19.2.810.0CriticalGitLab Community Edition and Enterprise Edition · CVE-2026-10518, CVE-2026-4523, CVE-2026-84739 … · published 30/10/2026
- 4 · Exploitedsince 27/10/2026Magento / Adobe Commerce PolyShell: unauthenticated file upload (CVE-2026-48356) exploited in the wild9.3CriticalMagento · CVE-2026-48356 · published 29/10/2026
- 4 · Exploitedsince 13/10/2026Microsoft Windows Shell: command injection (CVE-2026-96951) exploited in the wild (October 2026 Patch Tuesday)8.8HighMicrosoft Windows Shell · CVE-2026-96951 · published 27/10/2026
- 4 · Exploitedsince 16/10/2026BeyondTrust Remote Support: actively exploited zero-day (CVE-2026-102764), patch BT26-05-RS9.3CriticalBeyondTrust Remote Support / PRA · CVE-2026-102764 · published 26/10/2026
- 4 · Exploitedsince 28/10/2026Read More & Accordion (WordPress plugin): privilege escalation (CVE-2026-7467), no fixed version confirmed8.8HighWordPress · CVE-2026-7467 · updated 28/10/2026≈827,000internet-facing systems run WordPressShodan estimate · 01/11/2026
- 4 · Exploitedsince 16/10/2026Fortinet: CLI path traversal (CVE-2025-61624), actively exploited (FG-IR-26-122)6.5MediumFortinet FortiGate (FortiOS) · CVE-2025-61624 · published 26/10/2026≈394,000internet-facing systems run Fortinet FortiGate (FortiOS)Shodan estimate · 01/11/2026
- 4 · Exploitedsince 27/10/2026Laravel: TokenGuard authentication bypass (CVE-2026-114509) fixed in 12.68.0 and 13.29.0, exploited in the wild9.2CriticalLaravel · CVE-2026-114509 · updated 28/10/2026≥82,400internet-facing systems run LaravelShodan · at least · 01/11/2026
- 4 · Exploitedsince 14/10/2026Palo Alto Networks PAN-OS: code injection flaw (CVE-2026-0322) exploited in the wild8.6HighPalo Alto PAN-OS (GlobalProtect) · CVE-2026-0322 · published 26/10/2026≈38,800internet-facing systems run Palo Alto PAN-OS (GlobalProtect)≈983 still vulnerableShodan estimate · 01/11/2026
- 4 · Exploitedsince 28/10/2026VMware ESX: insufficient logging flaw (CVE-2026-41709) exploited in the wild, fixed builds available2.7LowBroadcom VMWare ESX · CVE-2026-41709 · published 29/10/2026≥3,932internet-facing systems run Broadcom VMWare ESXShodan · at least · 01/11/2026
- 4 · Exploitedsince 15/10/2026Atlassian Data Center and Server: critical pre-auth arbitrary file read (CVE-2026-21589), exploited in the wild9.3CriticalAtlassian Confluence / Jira / Bitbucket · CVE-2026-21589 · published 26/10/2026≈141internet-facing systems still vulnerableShodan estimate · 01/11/2026
- 3 · Confirmedsince 13/10/2026 23:00nginx: heap buffer overflows (CVE-2026-15176, CVE-2026-93479) fixed in 1.30.6 and 1.31.79.2Criticalnginx · CVE-2026-15176, CVE-2026-93479 · updated 26/10/2026≈57.39Minternet-facing systems run nginxShodan estimate · 01/11/2026
- 3 · Confirmedsince 13/10/2026 16:00Microsoft IIS: critical remote code execution flaw (CVE-2026-70024) fixed in Microsoft's October 2026 updates9.8CriticalMicrosoft IIS · CVE-2026-70024, CVE-2026-78459, CVE-2026-97830 · published 27/10/2026≈3.74Minternet-facing systems run Microsoft IISShodan estimate · 01/11/2026
- 3 · Confirmedsince 13/10/2026 16:00ASP.NET Core: multiple vulnerabilities fixed in Microsoft's .NET security release of 13/10/20269.4CriticalASP.NET · CVE-2026-102870, CVE-2026-109468, CVE-2026-114148 … · published 27/10/2026≈3.38Minternet-facing systems run ASP.NETShodan estimate · 01/11/2026
- 3 · Confirmedsince 21/10/2026Apache Tomcat: critical authentication bypass (CVE-2026-101296) and other flaws fixed in 11.0.27, 10.1.61 and 9.0.123Apache Tomcat · Critical · published 25/10/2026≈399,000internet-facing systems run Apache TomcatShodan estimate · 01/11/2026
- 3 · Confirmedsince 14/10/2026 16:31Fortinet FortiSandbox and FortiSIEM: authentication bypass (CVE-2026-107656) and path traversal (CVE-2026-106173), FortiSIEM flaw reported exploited9.8CriticalFortinet FortiSandbox · CVE-2026-106170, CVE-2026-106172, CVE-2026-106173 … · published 29/10/2026≥60internet-facing systems run Fortinet FortiSandboxShodan · at least · 01/11/2026
- 3 · Confirmedsince 23/10/2026 12:20Grafana: four authenticated flaws (CVE-2026-103506, CVE-2026-100105) fixed in 12.4.14, 13.0.12, 13.1.9, 13.2.58.9HighGrafana · CVE-2026-100105, CVE-2026-103506, CVE-2026-88858 … · published 01/11/2026
- 3 · Confirmedsince 29/10/2026 10:05Dell PowerProtect Data Domain: seven critical flaws (CVE-2026-103780, CVE-2026-90717) fixed by Dell9.8CriticalDell PowerProtect Data Domain OS · CVE-2026-103780, CVE-2026-103792, CVE-2026-103799 … · published 01/11/2026
Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.
ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.