Vulnerability notices · 01/11/2026 05:17 Amsterdam time
ReconX Watchtower
ReconX Watchtower follows official advisories, CERTs, reputable researchers and the security community around the clock. When a vulnerability needs attention we publish what is known, what is not known yet and what to do - early, and updated as the evidence grows.
Exploited · 18 Show all notices
- 4 · Exploitedsince 26/10/2026PHP remote code execution (PHP2Shell)9.2CriticalPHP · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 · updated 28/10/2026≈2.96Minternet-facing systems run PHP≈1.32M still vulnerableShodan estimate · 01/11/2026
- 4 · Exploitedsince 27/10/2026Node2Shell: Brotli decoder flaw (CVE-2026-111497) exploited in the wild, fixed in Node.js 22.23.4, 24.22.1, 26.12.19.2CriticalNode.js · CVE-2026-111497 · updated 28/10/2026≈1.42Minternet-facing systems run Node.jsShodan estimate · 01/11/2026
- 4 · Exploitedsince 28/10/2026Drupal core: critical RCE in Field UI (CVE-2026-108097) fixed; Commerce Core flaw (CVE-2026-118539) exploitedDrupal · Critical · updated 29/10/2026≈32,100internet-facing systems run DrupalShodan estimate · 01/11/2026
- 4 · Exploitedsince 28/10/2026Cisco Secure Firewall ASA and FTD: remote access VPN denial of service (CVE-2026-76418) exploited, fixes released9.9CriticalCisco ASA / Secure Firewall · CVE-2026-20329, CVE-2026-20330, CVE-2026-20331 … · updated 30/10/2026≈25,300internet-facing systems run Cisco ASA / Secure FirewallShodan estimate · 01/11/2026
- 4 · Exploitedsince 30/10/2026Ivanti Connect Secure: chained zero-days (CVE-2026-104935, CVE-2026-111357) exploited in the wild, fixes released7.0HighIvanti Connect Secure (Pulse Secure) · CVE-2026-111357 · updated 30/10/2026≈6,432internet-facing systems run Ivanti Connect Secure (Pulse Secure)Shodan estimate · 01/11/2026
- 4 · Exploitedsince 13/10/2026Ivanti Connect Secure: zero-day authentication bypass (CVE-2026-104935) exploited in the wild8.6HighIvanti Connect Secure (Pulse Secure) · CVE-2026-104935 · published 26/10/2026≈6,432internet-facing systems run Ivanti Connect Secure (Pulse Secure)Shodan estimate · 01/11/2026
- 4 · Exploitedsince 14/10/2026Cisco Secure Email Gateway (AsyncOS): root code execution via a crafted email attachment (CVE-2026-76519), actively exploited9.8CriticalCisco Secure Email Gateway (AsyncOS) · CVE-2026-76519 · updated 26/10/2026≥2,357internet-facing systems run Cisco Secure Email Gateway (AsyncOS)Shodan · at least · 01/11/2026
- 4 · Exploitedsince 28/10/2026 13:19Oracle PeopleSoft PeopleTools: missing-authentication flaw (CVE-2026-35273) exploited in the wild9.8CriticalOracle E-Business Suite · CVE-2025-61882, CVE-2026-35273 · published 30/10/2026
- 4 · Exploitedsince 29/10/2026GitLab CE/EE: critical code execution flaw (CVE-2026-97229) exploited in the wild, fixed in 19.4.2, 19.3.5, 19.2.810.0CriticalGitLab Community Edition and Enterprise Edition · CVE-2026-10518, CVE-2026-4523, CVE-2026-84739 … · published 30/10/2026
- 4 · Exploitedsince 27/10/2026Magento / Adobe Commerce PolyShell: unauthenticated file upload (CVE-2026-48356) exploited in the wild9.3CriticalMagento · CVE-2026-48356 · published 29/10/2026
- 4 · Exploitedsince 13/10/2026Microsoft Windows Shell: command injection (CVE-2026-96951) exploited in the wild (October 2026 Patch Tuesday)8.8HighMicrosoft Windows Shell · CVE-2026-96951 · published 27/10/2026
- 4 · Exploitedsince 16/10/2026BeyondTrust Remote Support: actively exploited zero-day (CVE-2026-102764), patch BT26-05-RS9.3CriticalBeyondTrust Remote Support / PRA · CVE-2026-102764 · published 26/10/2026
- 4 · Exploitedsince 28/10/2026Read More & Accordion (WordPress plugin): privilege escalation (CVE-2026-7467), no fixed version confirmed8.8HighWordPress · CVE-2026-7467 · updated 28/10/2026≈827,000internet-facing systems run WordPressShodan estimate · 01/11/2026
- 4 · Exploitedsince 16/10/2026Fortinet: CLI path traversal (CVE-2025-61624), actively exploited (FG-IR-26-122)6.5MediumFortinet FortiGate (FortiOS) · CVE-2025-61624 · published 26/10/2026≈394,000internet-facing systems run Fortinet FortiGate (FortiOS)Shodan estimate · 01/11/2026
- 4 · Exploitedsince 27/10/2026Laravel: TokenGuard authentication bypass (CVE-2026-114509) fixed in 12.68.0 and 13.29.0, exploited in the wild9.2CriticalLaravel · CVE-2026-114509 · updated 28/10/2026≥82,400internet-facing systems run LaravelShodan · at least · 01/11/2026
- 4 · Exploitedsince 14/10/2026Palo Alto Networks PAN-OS: code injection flaw (CVE-2026-0322) exploited in the wild8.6HighPalo Alto PAN-OS (GlobalProtect) · CVE-2026-0322 · published 26/10/2026≈38,800internet-facing systems run Palo Alto PAN-OS (GlobalProtect)≈983 still vulnerableShodan estimate · 01/11/2026
- 4 · Exploitedsince 28/10/2026VMware ESX: insufficient logging flaw (CVE-2026-41709) exploited in the wild, fixed builds available2.7LowBroadcom VMWare ESX · CVE-2026-41709 · published 29/10/2026≥3,932internet-facing systems run Broadcom VMWare ESXShodan · at least · 01/11/2026
- 4 · Exploitedsince 15/10/2026Atlassian Data Center and Server: critical pre-auth arbitrary file read (CVE-2026-21589), exploited in the wild9.3CriticalAtlassian Confluence / Jira / Bitbucket · CVE-2026-21589 · published 26/10/2026≈141internet-facing systems still vulnerableShodan estimate · 01/11/2026
Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.
ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.