Vulnerability notices · 11/11/2026 22:17 Amsterdam time
ReconX Watchtower
ReconX Watchtower follows official advisories, CERTs, reputable researchers and the security community around the clock. When a vulnerability needs attention we publish what is known, what is not known yet and what to do - early, and updated as the evidence grows.
Exploited · 34 · page 2 of 2 Show all notices
- 4 · Exploitedsince 26/10/2026PHP (PHP2Shell): remote code execution flaws (CVE-2026-109618, CVE-2026-109619) exploited in the wild, fixed in 8.5.129.2CriticalFix availablePHP · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 · updated 04/11/2026≈4.02Minternet-facing systems run PHP≈1.71M still vulnerableShodan estimate · 11/11/2026
- 4 · Exploitedsince 13/10/2026Ivanti Connect Secure: zero-day authentication bypass (CVE-2026-104935) exploited in the wild8.6HighFix availableIvanti Connect Secure (Pulse Secure) · CVE-2026-104935 · updated 04/11/2026≈6,903internet-facing systems run Ivanti Connect Secure (Pulse Secure)Shodan estimate · 11/11/2026
- 4 · Exploitedsince 16/10/2026BeyondTrust Remote Support: exploited zero-day file upload to RCE (CVE-2026-102764), patch BT26-05-RS9.3CriticalFix availableBeyondTrust Remote Support / PRA · CVE-2026-102764 · updated 04/11/2026
- 4 · Exploitedsince 30/10/2026Ivanti Connect Secure: chained zero-days (CVE-2026-104935, CVE-2026-111357) exploited in the wild, fixes released7.0HighFix availableIvanti Connect Secure (Pulse Secure) · CVE-2026-111357 · updated 04/11/2026≈6,903internet-facing systems run Ivanti Connect Secure (Pulse Secure)Shodan estimate · 11/11/2026
- 4 · Exploitedsince 27/10/2026Apple iOS and iPadOS: CoreGraphics out-of-bounds write (CVE-2026-86950) fixed in 18.7.11, reported exploited8.8HighFix availableiOS 18.7.11 and iPadOS 18.7.11 · CVE-2026-86950 · updated 03/11/2026
- 4 · Exploitedsince 28/10/2026Cisco Secure Firewall ASA and FTD: remote access VPN denial of service (CVE-2026-76418) exploited, fixes released9.9CriticalFix availableCisco ASA / Secure Firewall · CVE-2026-20329, CVE-2026-20330, CVE-2026-20331 … · updated 30/10/2026≈25,500internet-facing systems run Cisco ASA / Secure FirewallShodan estimate · 11/11/2026
- 4 · Exploitedsince 27/10/2026Magento / Adobe Commerce PolyShell: unauthenticated file upload (CVE-2026-48356) exploited in the wild9.3CriticalMagento · CVE-2026-48356 · published 29/10/2026
- 4 · Exploitedsince 28/10/2026Read More & Accordion (WordPress plugin): privilege escalation (CVE-2026-7467), no fixed version confirmed8.8HighWordPress · CVE-2026-7467 · updated 28/10/2026≈1.49Minternet-facing systems run WordPressShodan estimate · 11/11/2026
- 4 · Exploitedsince 14/10/2026Cisco Secure Email Gateway (AsyncOS): root code execution via a crafted email attachment (CVE-2026-76519), actively exploited9.8CriticalFix availableCisco Secure Email Gateway (AsyncOS) · CVE-2026-76519 · updated 26/10/2026≥2,313internet-facing systems run Cisco Secure Email Gateway (AsyncOS)Shodan · at least · 11/11/2026
Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.
ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.