This week, what's happening in the security world
Every week, thousands of new vulnerabilities are discovered and recorded in global catalogs like CISA KEV, Wordfence, or EPSS. This week, 78 new vulnerabilities have been added to the records. Although not all are immediately dangerous, some allow an attacker to take control of your website, steal data, or even bring down your online store. The number of vulnerabilities used in ransomware campaigns remains zero, which is a relief, but we shouldn't let our guard down.
What's happening in the world
New vulnerabilities
- 78 new vulnerabilities have been registered this week. This is 25.8% more than the average of the last five weeks (62 per week).
- None of them are currently being used in ransomware campaigns, which is good news.
Likelihood of use
- EPSS (Exploit Prediction Scoring System) is a tool that predicts how likely it is that a vulnerability will be exploited. This week, several vulnerabilities have a very high likelihood of being used, such as CVE-2026-109618 and CVE-2026-109619, with a 99.999% chance of exploitation.
What does this mean for you?
This means that although there are no active attacks on your servers, there are flaws in software that could be exploited if not updated. It's like having a broken lock on your house: it doesn't mean it's already broken, but someone could take advantage of it if they get in.
The cards
CVE-2026-109618
- Affected product: PHP
- What the flaw is: Allows remote code execution if exploited. An attacker could take control of your website.
- Attack type: Remote, no authentication required.
- Severity (CVSS): High
- Likelihood of use (EPSS): 99.999%
- Is it already exploited?: No
- Consequences: If your website uses a vulnerable version of PHP, an attacker could execute commands on your server, steal data, or even bring down your site.
CVE-2026-109619
- Affected product: PHP
- What the flaw is: Similar to the previous one, allows remote code execution.
- Attack type: Remote, no authentication required.
- Severity (CVSS): High
- Likelihood of use (EPSS): 99.999%
- Is it already exploited?: No
- Consequences: Same risk as the previous one.
CVE-2022-1471
- Affected product: SnakeYAML
- What the flaw is: Allows malicious code execution if a malicious YAML file is loaded.
- Attack type: Remote, with authentication.
- Severity (CVSS): High
- Likelihood of use (EPSS): 99.501%
- Is it already exploited?: No
- Consequences: If your website allows YAML file uploads (e.g., in a configuration plugin), an attacker could execute malicious code.
CVE-2020-10220
- Affected product: rConfig
- What the flaw is: Allows command execution on the system if exploited.
- Attack type: Remote, with authentication.
- Severity (CVSS): High
- Likelihood of use (EPSS): 99.697%
- Is it already exploited?: No
- Consequences: If you use rConfig to manage devices, an attacker could take control of the system.
CVE-2026-111497
- Affected product: Brotli
- What the flaw is: Allows malicious code execution if exploited.
- Attack type: Remote, no authentication required.
- Severity (CVSS): High
- Likelihood of use (EPSS): 82.641%
- Is it already exploited?: No
- Consequences: If your website uses Brotli to compress content, an attacker could execute malicious code.
And in SWPanel, what?
SWPanel actively monitors these vulnerability catalogs to detect which ones affect our customers' websites. If a vulnerability already has a security alert in SWPanel, like CVE-2026-109618 and CVE-2026-109619, you can review the alert in the Security 360 section. If your website uses an affected version, we recommend reviewing it and updating it if possible.
How we got here
KEV vulnerability evolution
- 21/09 to 27/09: 40 vulnerabilities
- 28/09 to 04/10: 32 vulnerabilities (-20%)
- 05/10 to 09/10: 22 vulnerabilities (-31.2%)
- 12/10 to 18/10: 136 vulnerabilities (+518.2%)
- 19/10 to 25/10: 80 vulnerabilities (-41.2%)
- 26/10 to 01/11 (this week): 78 vulnerabilities (-2.5%)
General trend
- Average of the last 5 weeks: 62 vulnerabilities per week
- This week: 78 vulnerabilities (+25.8% above average)
- Maximum in 6 weeks: 136 vulnerabilities
- Minimum: 22 vulnerabilities
- Streak: 2 weeks in a row decreasing
- Overall trend: upward
Projection
If the trend continues, it is expected that next week there will be around 109 new vulnerabilities, which would represent an increase of 40.3% compared to this week.
What's happening behind the numbers
Why do vulnerabilities go up or down?
The increase this week could be due to the publication of several critical vulnerabilities in widely used software, such as PHP or Brotli. Attack groups often take advantage of these publications to launch automated attacks. Although there is no evidence that they are already being used in active attacks, the high likelihood of exploitation (EPSS) suggests it could happen soon.
What to expect in the coming weeks?
- Optimistic scenario: If the vulnerabilities are not exploited and are quickly updated, the number of attacks could remain low.
- Pessimistic scenario: If the vulnerabilities are exploited and not updated, we could see an increase in attacks targeting websites with outdated versions.
Warning signs
- An increase in the number of security alerts in SWPanel.
- An increase in the number of attacks blocked by the Firewall or BotLock.
How it can affect your website or business
Scenario 1: Unupdated plugin
Imagine you're using a WordPress plugin that hasn't been updated in months. An attacker discovers a vulnerability in that plugin and exploits it. Your website could be hacked, showing pharmacy ads or even stealing your customers' data.
Scenario 2: Reused password
If you use the same password for your website and other accounts, and one of them is compromised, an attacker could try using that password to access your website. If you don't have 2FA enabled, they could succeed.
Scenario 3: Downed store
If your online store goes down due to an attack, you not only lose sales but also lose your customers' trust. In addition, if customer data is stolen, you could face fines for GDPR non-compliance.
How to protect yourself and prevent attacks
- Update CMS and plugins: If you use WordPress, Drupal, or Joomla, make sure they're updated. If you installed your website from SWPanel, you can enable automatic updates.
- Use strong and unique passwords: Don't reuse passwords between accounts. Use a password manager.
- Enable 2FA: Add an extra layer of security to your website. If an attacker steals your password, they won't be able to access without the second factor.
- Use SWPanel's security analysis: Regularly check the Security 360 section to see if your website has CMS or plugins with known vulnerabilities.
- Enable BotLock: Blocks malicious bots and crawlers trying to attack your website.
- Use the SWPanel Firewall: Filters web attacks before they reach your application.
- Make backups: In case of an attack, you can restore your website to a previous state.
- Switch to supported versions: If you're using an unsupported version of PHP or WordPress, switch to a supported version from the hosting panel.
What SWPanel tools help you
- Security analysis in Security 360: Detects CMS, plugins, and versions with known flaws and marks your website on the dashboard.
- Security bulletin and alerts: Warn you when a flaw affecting you is released.
- BotLock: Controls and blocks malicious bots and crawlers from your website.
- Firewall: Filters web attacks before they reach your application.
- CMS auto-update: If you installed your website from SWPanel, you can enable automatic updates.
- Backups: In case of an attack, you can restore your website to a previous state.
- PHP version switch: If you're using an unsupported version, switch to a supported version from the hosting panel.
- Ticket support: If you have questions, you can contact SWPanel support.
Quick summary
- This week, 78 new vulnerabilities were reported.
- Some have a very high likelihood of being exploited.
- Update CMS and plugins, use strong passwords, and enable 2FA.
- SWPanel helps with tools like the Firewall, BotLock, and security analysis.
Sources
The data for this week comes from public catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.
