any major incident live · unconfirmed

days since someone got hacked

record
35 days · Oct 24, 2022 – Nov 28, 2022 · since 2022
now
PHP2Shell: leaked critical PHP RCE zero-days (CVE-2026-109618/109619) · ongoing, no confirmed victims yet
last
California student data stolen via ETS testing contractor (5.7M students) · Oct 16, 2026

days since

supply chain attack by ecosystem: npm 13dPyPI 28dActions 99dVS Code 156dcrates 62dgems 94d

Happening now

LIVE since Oct 20, 2026 no confirmed victims yet 14 updates updated Oct 21, 13:57 UTC

PHP2Shell: leaked critical PHP RCE zero-days (CVE-2026-109618/109619)

Details of two critical unauthenticated remote code execution flaws in the PHP interpreter (CVE-2026-109618, CVE-2026-109619; CVSS v4.0 9.2) leaked on 2026-10-20 before fixes existed, prompting early exploitation attempts and precautionary shutdowns of many PHP sites until PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 2026-10-21.

  1. Oct 21, 2026 · UTC

  2. Patchstack says its telemetry still shows only probing, with no hard evidence of breaches, and expects this to change once patch details are public. patchstack.com

  3. PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing both flaws, plus minimal source backports for 7.4, 8.0 and 8.1, ahead of the 14:00 UTC schedule. php.net

  4. Finland's state IT centre Valtori and several universities, including the University of Vienna, shut down public-facing services as a precaution. precursorsecurity.com

Latest events

  1. PHP2Shell: leaked critical PHP RCE zero-days (CVE-2026-109618/109619)

    Details of two critical unauthenticated remote code execution flaws in the PHP interpreter (CVE-2026-109618, CVE-2026-109619; CVSS v4.0 9.2) leaked on 2026-10-20 before fixes existed, prompting early exploitation attempts and precautionary shutdowns of many PHP sites until PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 2026-10-21.

    live unconfirmed in-the-wild 0-day phpcve-2026-109618cve-2026-109619php2shell php.net · github.com· cert.europa.eu· sansec.io · +11

  2. California student data stolen via ETS testing contractor (5.7M students)

    The California Department of Education disclosed that an attacker used a compromised credential on an ETS file-transfer site to copy records of about 5.7 million current students plus some former students, including disability and test data.

    major breach educationcredential-abusethird-party malwarebytes.com · laist.com

  3. Nikkei discloses breach of 1.83M personal records via dev cloud service

    Japanese publisher Nikkei said about 1.83 million sets of personal information were compromised after attackers used stolen credentials to access a cloud service used for system development.

    major breach japanmediacloud nippon.com

  4. BeyondTrust Remote Support zero-day exploited by China-nexus spies

    BeyondTrust disclosed CVE-2026-102764 (CVSS 9.3), an origin-validation flaw in Remote Support that Mandiant/GTIG say the China-nexus group ARMORY CASTLE (UNC5221) exploited as a zero-day since late August 2026.

    in-the-wild 0-dayexploited CVSS 9+ beyondtrustcve-2026-102764aptcvss-9.8 cybersecuritydive.com · darkreading.com· nvd.nist.gov· beyondtrust.com

  5. Burger King Japan app breach exposes 11.18M members

    Burger King Japan disclosed that attackers accessed its app membership system between Oct 2 and Oct 7, 2026, leaking names, emails, phone numbers and birth dates of about 11.18 million members.

    major breach japanretailapp securityaffairs.com

  6. CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability

    Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

    exploited CVSS 9+ cvss-10.0ahsay nvd.nist.gov · ahsay.com

  7. CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

    Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

    exploited CVSS 9+ cvss-9.8cisco nvd.nist.gov · sec.cloudapps.cisco.com

  8. Palo Alto PAN-OS management interface RCE exploited (CVE-2026-0322)

    Palo Alto Networks published CVE-2026-0322, an authenticated RCE as root in the PAN-OS management interface, marking it as attacked with 'very limited exploitation' observed.

    in-the-wild 0-day palo-altopan-oscve-2026-0322 security.paloaltonetworks.com

  9. Ivanti Connect Secure auth bypass exploited as zero-day (CVE-2026-104935)

    Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure exploited before disclosure against a limited number of customers and chained with an unpatched privilege escalation flaw; CISA added it to KEV the same day.

    in-the-wild 0-day ivantivpncve-2026-104935 rapid7.com

  10. Windows Shell Mark-of-the-Web bypass exploited zero-day (CVE-2026-96951)

    Microsoft's record-size October 2026 Patch Tuesday fixed CVE-2026-96951, a Windows Shell security feature bypass exploited in the wild that suppresses Mark of the Web warnings.

    in-the-wild 0-day windowsmicrosoftcve-2026-96951 rapid7.com · malwarebytes.com

  11. Ledger (Supply Chain) — $93.0M lost

    Frontend & Infrastructure: Supply Chain Attack · Wallet.

    supply chain attack cryptofrontend-infrastructuresupply-chain defillama.com

  12. Skyticket operator Adventure reports 14.64M records leaked

    Japanese travel site skyticket's operator Adventure Inc. said unauthorized access via three routes exposed about 14.64 million customer records, including ~4.13 million hashed passwords.

    major breach japantravelpasswords mlex.com · atmarkit.itmedia.co.jp

  13. CVE-2015-3306: ProFTPD Improper Access Control Vulnerability

    ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

    exploited CVSS 9+ cvss-10.0proftpd nvd.nist.gov · lists.debian.org

  14. CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability

    ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

    exploited CVSS 9+ cvss-9.8onlyoffice nvd.nist.gov · github.com

  15. Daiichi Kosho (Big Echo karaoke) contractor malware exposes 8.7M records

    Daiichi Kosho disclosed that a malware infection at contractor Nippon Columbia may have exposed about 8.72 million customer and employee records, including names, birth dates, emails and phone numbers.

    major breach japanmalwarethird-party bleepingcomputer.com · nippon.com

  16. tensorlake npm package compromised with Shai-Hulud-style worm

    Malicious commits pushed to the tensorlakeai/tensorlake main branch under a maintainer identity were released as tensorlake@0.5.144 on npm with provenance; the preinstall payload steals credentials, self-propagates, and wipes the home directory if the stolen GitHub token is revoked.

    supply chain attack npmwormshai-huludchaindrop stepsecurity.io · aikido.dev· thehackernews.com

  17. Ransomware hits SoftBank's IDCF Cloud: 495 clients incl. JR East disrupted

    A ransomware attack on IDC Frontier's IDCF Cloud (East Japan Region 1) disrupted 495 companies and local governments; JR East and JR Kyushu said ~6.09M and ~1.3M customer accounts may have been exposed, though IDCF found no evidence of exfiltration.

    major breach ransomwarecloudjapan idcf.jp · bleepingcomputer.com· nippon.com

  18. Denmark's national population register (CPR) breach exposes 8.8M people

    Attackers abused a private Danish company's legitimate CPR lookup access to enumerate and extract names, addresses and CPR numbers of about 8.8 million people, including deceased and emigrated persons.

    major breach governmentdenmarkpii therecord.media · irishtimes.com

  19. SubQuery @subql/common npm release backdoored

    StepSecurity found that @subql/common@5.8.3 on npm carried a hidden payload that steals credentials and opens a remote shell on install and on import, published via a manipulated release workflow with npm provenance.

    supply chain attack npmcredential-theftci-cd stepsecurity.io

  20. CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

    Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

    exploited CVSS 9+ cvss-9.8zammad-gmbh nvd.nist.gov · zammad.com

Sources: CISA KEV, NVD, DeFiLlama, vendor advisories, GitHub advisories and public security research. Events are selected by LLM triage and confirmed by a human.

Counters reset on the day an incident becomes public · days counted in UTC.