The last 30 days of cyber threats for education and government (357 items).
AI-assisted summaries and fixes, sources cited.
High · The Register — Security ·
ShinyHunters is testing an Oracle E-Business Suite weakness and actively exploiting a PeopleSoft zero-day, with a trio of linked flaws tied to four issues as Cybersecurity Awareness Month ends.
High · BleepingComputer ·
InfraTrust says attackers are actively exploiting flaws tied to web management exposure on PHP, firewalls, VPNs, application delivery controllers and other network gear.
High · SecurityWeek ·
Actors tied to China used PHP2Shell and Fragnesia in an exploit chain that compromised two servers and gained root-level control of a firewall.
High · The Hacker News ·
Threat actors made close to 63,000 attempts in one day to exploit a remote code execution flaw in WordPress Core, and the vendor has released a patch.
High · The Record ·
A security firm says a small cluster of intrusions into public-sector servers traces back to PHP bugs it calls "PHP2Shell," in a campaign it suspects has Chinese origins.
High · The Register — Security ·
Suspected China-linked actors used PHP2Shell and a bespoke exploit to compromise twenty-five servers in a government-affiliated network and keep a foothold.
High · The Hacker News ·
Threat actors are actively leveraging PHP2Shell vulnerabilities against Palo Alto Networks management interfaces that are reachable from the public internet, prompting a vendor warning.
High · Wordfence ·
Guidance tied to Wordfence and WordPress calls for PHP upkeep on October 28, 2026, with no verified WordPress site breaches reported.
High · The Hacker News ·
A China-nexus group chained a PHP flaw with a kernel exploit to seize root on 25 internet-facing servers inside a U.S. government-affiliated network.
High · SecurityWeek ·
Attackers are attempting to use a race condition in WordPress to run code without logging in, a high-severity scenario with no CVE listed in the provided facts.
High · Wordfence ·
WordPress released 7.1.4 on October 28, 2026, fixing 22 vulnerabilities—among them an unauthenticated core-updater race condition that can lead to remote code execution—as exploitation attempts begin.
High · Patchstack ·
WordPress released 7.1.4 on 28 October 2026 to address 22 vulnerabilities across 17 advisories, including remote code execution and a race condition, with seven flaws tied to 7.1.3.
High · WordPress News ·
The WordPress project has published version 7.1.4 containing repairs for several security flaws, and administrators should deploy it without delay.
High · Hackread ·
OffSec will release a no-cost PHP2Shell training environment on 28 October 2026, giving security practitioners hands-on practice with no associated CVE.
High · BleepingComputer ·
Token Security reporting surfaced by BleepingComputer says attackers are exploiting critical PHP2Shell vulnerabilities, with service accounts, API keys and AI agent access at risk.
Medium · The Hacker News ·
A kernel TCP vulnerability tracked as CVE-2026-98432 enables unauthenticated remote root execution across several Linux distributions, with an Anthropic model producing exploit code.
Critical · Help Net Security ·
CISA has placed two Ivanti Connect Secure vulnerabilities in its KEV catalog, citing active exploitation and requiring federal agencies to remediate.
Critical · The Hacker News ·
Unidentified attackers are exploiting a three-flaw chain in Ivanti Connect Secure, including CVE-2026-111357, to obtain root-level access without authentication, prompting CISA catalog updates.
Critical · CISA Advisories ·
Two Ivanti Connect Secure vulnerabilities are under active attack and now listed in CISA's KEV catalog, putting federal and K-12 assets at risk of takeover.
Critical · CISA Known Exploited Vulnerabilities ·
Ivanti Connect Secure has three 2026 vulnerabilities that a logged-in remote user could chain—guessable identifiers and unrestricted file upload—prompting urgent mitigation and exposure review.
Critical · CISA Known Exploited Vulnerabilities ·
Three critical vulnerabilities in Ivanti Connect Secure let authenticated local users bypass authentication and escalate privileges, requiring urgent mitigation.
Critical · CISA Advisories ·
On October 29, 2026, CISA flagged two actively exploited vulnerabilities in Ivanti Connect Secure and GitLab CE/EE, requiring federal civilian agencies to remediate quickly.
High · The Record ·
A group called BYOD gang is tied to an October ransomware claim and reported attacks on a hospital and two universities, triggering campus-wide incident response.
Medium · The Hacker News ·
A state-linked cluster used a Linux RAT called SysGoRAT against public-sector systems, with activity seen in October 2025 and April 2026.