Watch FloorOct 26, 8:00 PM to Oct 27, 8:00 PM ET
Daily brief, Tuesday, October 27, 2026
2 breaking, 2 newly exploited, 6 with new public exploit code, 47 new critical CVEs, 43 ransomware posts, 1 new breaches.
Breaking
PHP2Shell / Node2Shell · PHP
- 173 posts from 75 independent sources in 48 h
- PHP: very widely used in large enterprises
- remote code execution / auth bypass
- exploited in the wild (CISA KEV)
- public exploit code
- named threat actor activity
Arista Networks VeloCloud Orchestrator: SQL injection (2 CVEs)
- 8 posts from 6 independent sources in 48 h
- rising: 6 posts in the last 24 h
- Arista / VeloCloud SD-WAN: widely used in large enterprises
- sql injection
- exploited in the wild (CISA KEV)
CVEs: CVE-2026-114625, CVE-2026-110447
Newly exploited in the wild
- 9.2CVE-2026-111497 Google BrotliCISA KEVA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a
- 9.3CVE-2026-48356 Adobe Adobe CommerceCISA KEVCVE published Jul 14, 2026Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session
New public exploit code
- 8.2CVE-2026-116067 Ananthakumaran paisaNuclei templateDetectionPaisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafte
- 7.3CVE-2026-116006 YunaiV ruoyi-vue-proNuclei templateDetectionA vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improp
- 10.0CVE-2026-97359 Rejetto hfs2Nuclei templateDetectionCVE published Sep 24, 2026An attacker can execute code without authentication on HFS2.
- 10.0CVE-2024-56829 Nuclei templateDetectionCVE published Jan 2, 2025Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx.
- 7.1CVE-2026-93485 Automattic WordPressNuclei templateDetectionCVE published Sep 18, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
- 3.4CVE-2026-9062 Unknown Store Locator WordPressNuclei templateDetectionCVE published Jun 13, 2026The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain datab
5 older CVEs (published more than 7 days earlier) with new exploit code, below the bar (CVSS under 9, not widely used enterprise tech): CVE-2026-17540 (8.8), CVE-2026-11565 (8.5), CVE-2026-9848 (7.5), CVE-2026-16959 (6.8), CVE-2026-10525 (6.1).
New critical CVEs
- 9.1CVE-2026-114607 npm better-authAn attacker can sign in as another user in better-auth.
- 9.1CVE-2026-108142 Veeam Backup & ReplicationAn unauthenticated attacker can bypass authorization on the Veeam Backup & Replication CDP Coordinator Service.
- 9.0CVE-2026-106076 Microsoft Backup for Microsoft 365An attacker with organization-transfer peer access can inject SQL into the Veeam Backup for Microsoft 365 server, leading to cross-tenant data access and remote code execution.
- 9.6CVE-2026-118355 Google chromeImproper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CVE-2026-118305 Google ChromeAn attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118306 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118308 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118309 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome on Android.
- 9.6CVE-2026-118310 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome on Windows.
- 9.6CVE-2026-118312 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118321 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome on Android.
- 9.6CVE-2026-118340 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118316 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118332 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.6CVE-2026-118342 Google ChromeA remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page in Google Chrome.
- 9.1CVE-2026-112352 Sunhillo SureLineAn unauthenticated remote attacker can impersonate any user with an active web session on Sunhillo SureLine.
- 9.9CVE-2026-104353 Adobe Adobe Campaign ClassicA low-privileged attacker can execute arbitrary code in the context of the current user on Adobe Campaign Classic by injecting malicious OS commands without authentication.
- 9.8CVE-2026-35002 pip agnoAn attacker can execute arbitrary code on agno via the `field_type` parameter in a `FunctionCall` input field.
- 9.8CVE-2026-116692 pip mlflowAn attacker can gain remote code execution on an unauthenticated mlflow server.
- 9.8CVE-2026-117532 Redaxo coreAn attacker can forge temporary login tokens on REDAXO core, allowing unauthenticated access.
27 more critical CVEs in this window: see them on the dashboard.
Ransomware
43 victims posted to leak sites. Most active: Booba Project (10), everest (8), play (7), Whitearmor (4), qilin (2).
Financial services hit: Money Concepts Capital (play), NuVista Federal Credit Union (qilin), Hawaii Law Enforcement Fedral Credit Union (qilin).
New data breaches
- AfD afd.de345,439 accounts
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Breaking stories as RSS or JSON. watchfloor.fyi
Powered by MikeGPT