This week, what you need to know
In the digital world, just like in real life, there are doors left open due to carelessness. This week, experts have detected 81 new vulnerabilities in software and platforms used by millions of websites. One of them, specifically, is already being used in ransomware attacks, meaning attacks that lock your website or your data until you pay a ransom. It's not a joke: this is what's happening in the real world, and it's what SWPanel monitors for you.
Why should you care? Because if you have a website with outdated plugins or CMS, or with weak passwords, those open doors can be exploited. You don't need to be an expert: bots (automated programs) do it for you. And if you don't act in time, the damage can be real: from your website stopping to work to your customer data being stolen.
What's happening in the world
This week, 81 new vulnerabilities have been added to global security catalogs. That's a high number, but it's not the only thing that matters. Of those 81, one is already being used in ransomware attacks, meaning that groups are already exploiting it to attack websites and demand money.
In addition, 10 high-risk vulnerabilities (EPSS greater than 0.05) have been identified, indicating that they are likely already being used by attackers. One of them, CVE-2024-8517, affects SPIP, a French CMS used in institutional and educational websites, and has an exploitation probability of 94.6%. That means if your website uses SPIP and is not updated, it's very likely already being attacked.
The cards, CVE by CVE
CVE-2026-110447
- Affected product: Collabora Online – Built-in CODE Server
- What it is: a cloud collaboration tool for office documents.
- How it's attacked: unauthorized access to code functionalities.
- What can happen: execution of malicious commands on the server.
- Severity: High
- Exploitation probability (EPSS): 2.285% (high)
- Already exploited: Yes
CVE-2024-8517
- Affected product: SPIP
- What it is: a French CMS used in institutional and educational websites.
- How it's attacked: injection of malicious code.
- What can happen: remote command execution.
- Severity: High
- Exploitation probability (EPSS): 94.614% (very high)
- Already exploited: No
CVE-2025-49002
- Affected product: dataease
- What it is: a data visualization platform.
- How it's attacked: unauthorized access to administrative functionalities.
- What can happen: execution of commands on the server.
- Severity: Medium
- Exploitation probability (EPSS): 49.985% (high)
- Already exploited: No
CVE-2026-109618
- Affected product: PHP
- What it is: the most used programming language in the world.
- How it's attacked: injection of malicious code.
- What can happen: remote command execution.
- Severity: High
- Exploitation probability (EPSS): 11.841% (high)
- Already exploited: Yes
CVE-2026-109619
- Affected product: PHP
- What it is: the most used programming language in the world.
- How it's attacked: injection of malicious code.
- What can happen: remote command execution.
- Severity: High
- Exploitation probability (EPSS): 6.217% (medium)
- Already exploited: Yes
And in SWPanel, what?
SWPanel actively monitors these vulnerabilities and cross-references them with the analysis of our customers' websites. If one of these vulnerabilities affects your website, we notify you in Security 360. For example, we already have alerts published for the vulnerabilities CVE-2026-109618 and CVE-2026-109619, which affect PHP. If you use PHP and are not up to date, it's important that you check it.
How we got here
In the last few weeks, the data has fluctuated quite a bit. Last week, 81 vulnerabilities were recorded, which is 40.9% less than the previous week, but it's still a high number. The week of October 12 to 18 was the highest with 137 vulnerabilities, while the week of October 5 to 9 was the lowest with only 22. The average of the previous 5 weeks is 55, so this week is above average.
The general trend is upward, indicating that attackers remain active and that we are likely to continue seeing more vulnerabilities in the coming weeks.
What's happening behind the numbers
Attackers don't stop. This week, the increase in vulnerabilities may be due to the publication of several important flaws, such as the one in PHP, which affects millions of websites. In addition, the fact that one vulnerability is already being used in ransomware attacks indicates that organized groups are exploiting these flaws to attack websites and demand money.
This is not a coincidence. Attackers follow patterns: they look for websites with outdated plugins or CMS, weak passwords, or unsupported software versions. Once they find an open door, they enter and cause damage.
What we can expect
If the trend continues, it's likely that in the coming weeks we will continue to see a high number of vulnerabilities. A linear projection suggests that next week we could see between 100 and 110 new vulnerabilities. That doesn't mean they are all serious, but it does mean we need to stay alert.
Optimistic scenario: software manufacturers respond quickly and customers update their websites in time.
Pessimistic scenario: more vulnerabilities are already being exploited and ransomware attacks continue to increase.
Signs to watch for: if your website becomes slower, if you receive security alerts, or if your website displays strange content (like pharmacy ads), it's a sign that something is wrong.
How it can affect your website or business
Imagine you have an online store with an outdated plugin. An attacker enters through that door and:
- Steals your customers' data: names, addresses, credit card numbers. That could cost you a GDPR fine.
- Blocks your website: demands a ransom to get it working again. While that happens, you lose sales and customers.
- Redirects your visitors to malicious pages: your reputation is ruined and Google lowers your ranking.
And all this can happen within hours. It's not an exaggeration: it's what's happening in the real world.
How to protect yourself and prevent attacks
- Update CMS, plugins, and themes: if you use WordPress, SPIP, or any CMS, make sure they are updated. If you don't know how, ask your hosting support.
- Use strong and unique passwords: don't use the same password on multiple websites. Use a password manager.
- Enable two-factor authentication (2FA): it's like having a doorman who asks for a second key before letting you in.
- Review user permissions: not everyone needs full access. Limit privileges.
- Use a web firewall: filters attacks before they reach your website.
- Enable bot blocking: if a bot tries to attack your website, block it before it causes damage.
- Make frequent backups: if something goes wrong, you can recover your website in minutes.
- Monitor security alerts: if SWPanel or your CMS warns you of a flaw, act quickly.
- Use supported versions: if you're using PHP 7.2, for example, and it's no longer supported, switch to a newer version.
- Scan your website with security tools: SWPanel has a security analysis that detects CMS, plugins, and versions with known flaws.
What SWPanel tools can help you
- Security analysis in Security 360: tells you if your website has CMS, plugins, or versions with known flaws.
- Security alerts in Security 360: notifies you when a flaw that affects you is released.
- BotLock: blocks malicious bots and crawlers trying to attack your website.
- FireWall: filters web attacks before they reach your application.
- Automatic CMS updates: if you installed your website from SWPanel, you can enable automatic updates.
- Backups: if something goes wrong, you can recover your website in minutes.
- PHP version switch: if you're using an unsupported version, switch to a supported one from the panel.
- Ticket support: if you don't know how to do something, ask and we'll help you.
Quick summary
- This week, 81 new vulnerabilities were identified.
- One of them is already being used in ransomware attacks.
- Update CMS, plugins, and themes. Use strong and unique passwords.
- SWPanel alerts you if a vulnerability affects your website.
Sources
This week's data comes from global public catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.
