This week, what you shouldn't ignore
In the world of cybersecurity, every week brings new alerts. This week, 83 new vulnerabilities have been identified that could be exploited by attackers. One of them is already being used in ransomware campaigns, a type of attack that can paralyze your website or online store. Why should you care? Because if your website uses an outdated plugin or CMS, it could be an easy target. This isn't alarmism—it's about being prepared before something happens.
What's happening in the world
This week, public vulnerability catalogs (like CISA KEV, Wordfence, EPSS, etc.) have added 83 new vulnerabilities. Of these, 1 is already being used in real ransomware attacks, making it an urgent priority.
Also, the number of known and exploited vulnerabilities (KEV catalog) has dropped by 39.3% compared to last week, but it's still a high number (82). This means there are many open doors attackers can exploit.
The cards
CVE-2026-110447
- Affected product: Collabora Online – Built-in CODE Server
- What the flaw is: Allows command execution on the server if accessed from a malicious website.
- How it's exploited: An attacker could exploit this vulnerability to run commands on the server as if they were a user with permissions.
- What could happen: If your website uses this software, it could be compromised and used to attack others.
- Severity: High
- Likelihood of use (EPSS): 2.28% (0.02285)
- Already exploited: Yes, being used in ransomware campaigns.
CVE-2024-8517
- Affected product: SPIP
- What the flaw is: Allows malicious code execution if a special request is sent.
- How it's exploited: An attacker could exploit this vulnerability to run code on the server as if they were a user with permissions.
- What could happen: If your website uses SPIP and is not updated, it could be compromised.
- Severity: High
- Likelihood of use (EPSS): 94.6% (0.94614)
- Already exploited: No
CVE-2025-49002
- Affected product: dataease
- What the flaw is: Allows command execution on the server if accessed from a malicious website.
- How it's exploited: An attacker could exploit this vulnerability to run commands on the server as if they were a user with permissions.
- What could happen: If your website uses this software, it could be compromised and used to attack others.
- Severity: High
- Likelihood of use (EPSS): 49.9% (0.49985)
- Already exploited: No
CVE-2026-109618
- Affected product: PHP
- What the flaw is: Allows malicious code execution if a special request is sent.
- How it's exploited: An attacker could exploit this vulnerability to run code on the server as if they were a user with permissions.
- What could happen: If your website uses an unpatched version of PHP, it could be compromised.
- Severity: High
- Likelihood of use (EPSS): 11.8% (0.11841)
- Already exploited: Yes
CVE-2026-109619
- Affected product: PHP
- What the flaw is: Allows malicious code execution if a special request is sent.
- How it's exploited: An attacker could exploit this vulnerability to run code on the server as if they were a user with permissions.
- What could happen: If your website uses an unpatched version of PHP, it could be compromised.
- Severity: High
- Likelihood of use (EPSS): 6.2% (0.06217)
- Already exploited: Yes
And in SWPanel, what?
SWPanel constantly monitors these public catalogs to detect which of these vulnerabilities could affect your websites. If you already have a security alert in your panel, such as the alert INC-2026-0001 about critical vulnerabilities in PHP, it means your website could be exposed. We recommend you check your security panel and update the affected versions.
How we got here
The evolution of the last 6 months shows a clear trend: upward. The average of the previous 5 weeks was 54 vulnerabilities per week, but this week 82 were identified, a 50.7% increase. The highest peak was 135 vulnerabilities in the week of October 12–17, and the lowest was 24 in the week of October 4–9.
This week, although the number has dropped by 39.3% compared to the previous one, it's still high. If the trend continues, it's likely that next week will see around 107 vulnerabilities.
What's happening behind the numbers
These figures reflect a reality: attackers are very active and are testing new ways to exploit vulnerabilities. Automated tools (bots) are scanning thousands of websites per second to find open doors. If your website is not updated, it's like leaving your house door unlocked.
The increase in vulnerabilities in October could be due to the publication of several critical flaws in popular software, such as PHP or CMS like SPIP. Additionally, the rise in ransomware campaigns indicates that attackers are looking for ways to make quick money.
What we can expect
If the trend continues, it's likely that the coming weeks will also see a high number of vulnerabilities. An optimistic scenario would be that software manufacturers respond quickly with patches and users apply them. A pessimistic scenario would be that attackers exploit these vulnerabilities to launch more ransomware campaigns and automated attacks.
Warning signs to watch: if you notice your website behaving strangely, if you receive security notifications in your panel, or if you detect unusual traffic in your logs, it's time to act.
How it can affect your website or business
Imagine your online store uses an outdated plugin. An attacker could exploit a vulnerability to:
- Steal your customers' data (names, addresses, credit card numbers).
- Paralyze your website and demand a ransom to recover it.
- Use your website to attack others, which could lead to legal issues.
This not only affects your business but also your reputation. If your customers don't trust you, you'll lose sales. Additionally, if your website gets infected, Google could mark it as unsafe, affecting your SEO.
How to protect yourself and prevent attacks
- Update CMS, plugins, and themes: If you use WordPress, SPIP, or other CMS, keep them updated. If you don't know how, consult a technician or use automatic updates if available.
- Use supported versions: If your website uses an unsupported version of PHP, switch to a supported version from your hosting panel.
- Enable 2FA: Add an extra layer of security to your admin account. If an attacker guesses your password, they won't be able to access without the second factor.
- Enable the firewall: The firewall filters attacks before they reach your website. If your hosting allows it, enable it.
- Use BotLock: If your website receives suspicious traffic, BotLock can block malicious bots and crawlers.
- Make backups: If your website gets infected, a recent backup will allow you to recover it quickly.
- Monitor security alerts: If you have an alert in your security panel, act before it's too late.
- Use strong and unique passwords: Don't use the same password on multiple sites. If an attacker steals a password elsewhere, they won't be able to use it to attack you.
- Review user permissions: If you have multiple users on your website, make sure only those who need it have admin permissions.
- Check the SWPanel security bulletin: It will keep you informed of the most relevant vulnerabilities and how they affect your website.
What SWPanel tools help you
- Security 360 analysis: Detects CMS, plugins, and versions with known flaws and marks your website in the panel.
- Security 360 alerts: Warn you when a flaw affects you.
- BotLock: Controls and blocks malicious bots and crawlers from your website.
- Firewall: Filters web attacks before they reach your application.
- CMS auto-update: If you installed your website from SWPanel, you can enable auto-updates.
- Backups: If your website gets infected, a recent backup will allow you to recover it quickly.
- PHP version switch: If your website uses an unsupported PHP version, switch to a supported version from your hosting panel.
- Ticket support: If you have questions or need help, you can contact us.
Quick summary
- This week, 83 new vulnerabilities were identified, one of which is already being used in ransomware.
- PHP, SPIP, and other CMS are frequent targets for attackers.
- Updating your website and using security tools is the best way to protect yourself.
- SWPanel alerts you when a vulnerability affects you.
Sources
This week's data comes from international public catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.
