Mitigation: PHP patches released on October 21: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 → PHP patched the vulnerabilities on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Cve: Not previously recorded → CVE-2026-109618 and CVE-2026-109619
Product: Not previously recorded → PHP engine
Mitigation: Not previously recorded → PHP patches released on October 21: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Exploitation: Not previously recorded → Confirmed in-the-wild exploitation with remote code execution against an Apache mod_php installation running PHP 8.4.26
Status: Not previously recorded → Added by CISA to its Known Exploited Vulnerabilities Catalog
Exploitation: Attackers used a genuine signed Software Center copy with attacker-supplied DLL files that the vulnerable version loaded at startup. → Attackers used a genuine signed Siemens Software Center copy with attacker-supplied DLL files that the vulnerable version loaded at startup.
Mitigation: Update Siemens Software Center to version 4.0.9.8 or later. → Update Siemens Software Center to version 4.0.9.8 or later; starting the application installs the update automatically.
Product: Not previously recorded → Siemens Software Center
Exploitation: Not previously recorded → Attackers used a genuine signed Software Center copy with attacker-supplied DLL files that the vulnerable version loaded at startup.
Mitigation: Not previously recorded → Update Siemens Software Center to version 4.0.9.8 or later.
Status: Not previously recorded → Actively exploited
Exploitation: Not previously recorded → In-the-wild exploitation attempts observed
Mitigation: Not previously recorded → Remove the plugin, rotate wallet keys, and audit for suspicious changes
Product: Not previously recorded → CryptoPayment Gateway WordPress plugin
Status: Not previously recorded → Versions 1.2.1 through 1.2.2 affected; 1.2.2 is latest; no known fixes; plugin closed on the WordPress Plugin Directory
UAT-11473 exploited the vulnerability to install the KeyDrift malware framework, which collected sensitive keying information and provided backdoor and command-and-control capabilities.
[1]
Mitigation
Apply Cisco's fixed releases; there is no workaround. Until upgrades are possible, on-premises customers can limit access to ports 22 and 830 to known systems, but this does not remove malware already on a device.
[2]
Product
Cisco Catalyst SD-WAN Controller, Manager and Validator, including on-premises systems and Cisco-hosted cloud deployments
[2]
Status
Historical exploitation identified; Cisco says it is aware of limited exploitation.
[2]
Exploitation: Not previously recorded → UAT-11473 exploited the vulnerability to install the KeyDrift malware framework, which collected sensitive keying information and provided backdoor and command-and-control capabilities.
Mitigation: Not previously recorded → Apply Cisco's fixed releases; there is no workaround. Until upgrades are possible, on-premises customers can limit access to ports 22 and 830 to known systems, but this does not remove malware already on a device.
Product: Not previously recorded → Cisco Catalyst SD-WAN Controller, Manager and Validator, including on-premises systems and Cisco-hosted cloud deployments
Status: Not previously recorded → Historical exploitation identified; Cisco says it is aware of limited exploitation.
Mitigation: Upgrade to a fixed AsyncOS release; Content Scanner Tools 25.3.0.5525 and later contain the fix → Upgrade to fixed AsyncOS releases 15.5.5-014 or 16.5.0-780; Content Scanner Tools versions 25.3.0.5525 and later contain the fix
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
[1]
Exploitation
Exploited by UNC6240, also known as ShinyHunters, from May 27 through June 9, with renewed mass exploitation reported in September.
[1][2]
Mitigation
Oracle released its fix on June 10; Mandiant's guidance is to rotate credentials and hunt for web shells.
[1]
Status
Oracle released an out-of-band fix on June 10; the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and continued mass exploitation was reported in September.
[1][2]
Mitigation: Apply Oracle's June 10 fix; rotate credentials and hunt for web shells because patching does not by itself evict an attacker already inside. → Oracle released its fix on June 10; Mandiant's guidance is to rotate credentials and hunt for web shells.
Mitigation: Apply Oracle's fix; rotate credentials and hunt for web shells because patching alone does not evict an attacker already inside. → Apply Oracle's June 10 fix; rotate credentials and hunt for web shells because patching does not by itself evict an attacker already inside.
Status: Oracle issued an out-of-band fix on June 10; the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. → Oracle released an out-of-band fix on June 10; the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and continued mass exploitation was reported in September.
Product: Not previously recorded → Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Exploitation: Not previously recorded → Exploited by UNC6240, also known as ShinyHunters, from May 27 through June 9, with renewed mass exploitation reported in September.
Mitigation: Not previously recorded → Apply Oracle's fix; rotate credentials and hunt for web shells because patching alone does not evict an attacker already inside.
Status: Not previously recorded → Oracle issued an out-of-band fix on June 10; the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
