Proactive Threat Intelligence from the team that finds the vulnerabilities. We publish what is being exploited right now, who is doing it, and whether it reaches you. No vendor summaries written a week late.

Intelligence

Emerging threats, analyzed the day they matter.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP. PHP released fixes on October 21, 2026, and
The Arbitrary File Upload in BeyondTrust Remote Support let an attacker upload files to the appliance before BeyondTrust's October 15, 2026 fix.
CVE-2026-102764 is an Arbitrary File Upload vulnerability in BeyondTrust Remote Support that allows an external, unauthenticated attacker to perform arbitrary file operations

Threat analysis

Browse everything →

Ivanti patched the Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure across several version branches, with fixed releases now available. This
CVE-2026-104935 is an Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure that lets a remote attacker run commands without logging in.
CVE-2026-21589 is an Arbitrary File Read vulnerability in Atlassian Jira and Confluence (and other Data Center and Server Products) that lets an
CVE-2026-21589 is an Arbitrary File Access vulnerability affecting eight Atlassian Data Center and Server products, letting unauthenticated attackers read specific files without
CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can cause a denial of service when SAML authentication
CVE-2026-88779 is a Denial Of Service (Memory Overflow) in Citrix NetScaler that can make appliances configured for SAML authentication stop responding. Apply
Fortinet disclosed a Path Traversal in FortiMail that lets an unauthenticated attacker write files onto the underlying system through crafted web requests.
Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

PHP2Shell Remote Code Execution FAQ

Frequently asked questions about PHP2Shell CVE-2026-109618 and CVE-2026-109619

Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.