This week, the digital security world didn't sleep
Imagine your website is a building with doors, windows, and locks. This week, attackers have published 26 new ways to force those locks, and some are already being used by real criminals. It's no joke: if your website has an unpatched door, someone could get in, steal data, or even bring down your business.
Although the number of attacks has decreased compared to last week, it's still high. And the worst part: 8 of those 26 exploits are already being used by real attackers, according to the KEV catalog. That means there are people out there already trying to exploit them.
What's happening in the world
This week, 26 new or updated exploits have been published. That's like 26 new fake keys that can open doors that should be locked. Of them, 8 are already being used by real attackers. That's a serious problem, because it means there are people out there already trying to exploit them.
Also, 54 new vulnerabilities have been added to the real attacks catalog (KEV). That's like adding 54 new doors that have already been forced in other buildings. And of those 54, 8 already have public exploits, which means anyone can use them to attack.
Also, 2 attack detection signatures have been updated, which helps better identify intrusion attempts. It's like your building's doorman learning to recognize thieves better.
The cards, CVE by CVE
CVE-2026-109619
- Affected product: PHP Group PHP
- What it is: A flaw in PHP implementation that allows attackers to execute malicious code.
- How it's attacked: Through a public exploit that allows remote code execution.
- What can happen: If your website uses a vulnerable version of PHP, an attacker could take control of your site, steal data, or even bring down your website.
- Severity: High (CVSS not available, but already exploited).
- Probability: Very high (EPSS 0.99999).
- Already exploited: Yes, according to the KEV catalog.
CVE-2026-102764
- Affected product: BeyondTrust Remote Support
- What it is: An authentication flaw that allows attackers to access remote sessions without permission.
- How it's attacked: Through an exploit that allows unauthorized access to remote sessions.
- What can happen: If you use this software for remote support, an attacker could access your system without your knowledge.
- Severity: High (CVSS not available, but already exploited).
- Probability: High (EPSS 0.77994).
- Already exploited: Yes, according to the KEV catalog.
CVE-2026-97229
- Affected product: GitLab Community Edition and Enterprise Edition
- What it is: A security flaw that allows attackers to read sensitive information.
- How it's attacked: Through an exploit that allows unauthorized access to sensitive information.
- What can happen: If you use GitLab, an attacker could access your repositories or sensitive company information.
- Severity: High (CVSS not available, but already exploited).
- Probability: Medium (EPSS 0.65220).
- Already exploited: Yes, according to the KEV catalog.
CVE-2026-96652
- Affected product: Plex Media Server
- What it is: A security flaw that allows attackers to execute malicious code.
- How it's attacked: Through an exploit that allows remote code execution.
- What can happen: If you use Plex to share multimedia content, an attacker could take control of your server and steal data.
- Severity: High (CVSS not available, but already exploited).
- Probability: Low (EPSS 0.11886).
- Already exploited: Yes, according to the KEV catalog.
CVE-2026-7873
- Affected product: Langflow Langflow
- What it is: A security flaw that allows attackers to execute malicious code.
- How it's attacked: Through an exploit that allows remote code execution.
- What can happen: If you use Langflow to automate tasks, an attacker could take control of your system and steal data.
- Severity: High (CVSS not available, but already exploited).
- Probability: Low (EPSS 0.06211).
- Already exploited: Yes, according to the KEV catalog.
And in SWPanel, what?
SWPanel actively monitors this data and cross-references it with the analysis of our clients' websites. If we detect that one of your websites is using a vulnerable version of PHP or a CMS, we notify you through Seguridad 360. Also, if you installed your website from SWPanel, you can activate the CMS automatic update to keep it secure without having to do anything.
We also recommend checking PHP updates from the hosting panel, as some versions no longer receive patches. If you use a CMS like WordPress, Drupal, or Joomla, and you're not sure if it's up to date, you can use the Seguridad 360 security analysis to check it.
How we got here
In the last 6 weeks, the number of public exploits has fluctuated quite a bit:
- 25/09 to 01/10: 9 exploits
- 02/10 to 08/10: 13 exploits (+44.4%)
- 11/10 to 15/10: 22 exploits (+69.2%)
- 21/10 to 22/10: 17 exploits (-22.7%)
- 23/10 to 29/10: 49 exploits (+188.2%) → Peak
- 30/10 to 05/11 (this week): 26 exploits (-46.9%)
The average of the previous 5 weeks was 22 exploits per week. This week, with 26, is a bit above that average. The general trend is upward, although it has decreased a bit this week.
As for the vulnerabilities added to the KEV catalog:
- 25/09 to 01/10: 33 vulnerabilities
- 02/10 to 08/10: 30 vulnerabilities (-9.1%)
- 09/10 to 15/10: 130 vulnerabilities (+333.3%) → Peak
- 16/10 to 22/10: 82 vulnerabilities (-36.9%)
- 23/10 to 29/10: 68 vulnerabilities (-17.1%)
- 30/10 to 04/11 (this week): 54 vulnerabilities (-20.6%)
The average of the previous 5 weeks was 69 vulnerabilities per week. This week, with 54, is below that average. The trend is downward, but it's still concerning.
What's happening behind the numbers
The increase in exploits and vulnerabilities reflects a growing trend in the world of cybersecurity. Attackers are more organized and use automated tools to test thousands of websites per second. Also, when a flaw is published, attackers use it quickly to attack vulnerable websites.
The drop this week could be because the most important exploits have already been published, or because attackers are waiting for them to spread more. But don't let your guard down: if the trend continues, it's likely that in the coming weeks we'll continue to see a high number of exploits and vulnerabilities.
What we can expect
If the trend continues, it's likely that in the coming weeks we'll continue to see a high number of exploits and vulnerabilities. A linear projection suggests that next week we could see between 41 and 45 new or updated exploits.
Optimistic scenario: Attackers focus on other sectors and the number of exploits decreases.
Pessimistic scenario: We continue to see an increase in exploits and more websites are attacked.
Warning signs to watch: A sudden increase in exploits related to popular CMSs like WordPress, Drupal, or Joomla, or an increase in the number of real attacks detected.
How it can affect your website or business
Scenario 1: Website down
Imagine you have an online store and you're using a WordPress plugin that isn't updated. An attacker finds a public exploit and uses it to inject malicious code into your website. Your website goes down, customers can't buy, and you lose sales.
Scenario 2: Data theft
Imagine you're using a CMS like Drupal and you don't update a known vulnerability. An attacker exploits the flaw to steal your customers' data, including emails and passwords. You face fines for GDPR violations and a loss of trust.
Scenario 3: Spam and reputation
Imagine you're using an email server and you don't update a vulnerability. An attacker exploits the flaw to send spam emails from your server. Your email reputation deteriorates, and your legitimate emails are marked as spam.
How to protect yourself and prevent attacks
- Update your CMS and plugins regularly. If you installed your website from SWPanel, you can activate automatic updates.
- Use strong and unique passwords. If you use the same password on multiple websites, an attack on one can affect all.
- Enable two-factor authentication (2FA). Adds an extra layer of security to your account.
- Check PHP updates. If you're using an unsupported version, switch to a supported one from the hosting panel.
- Use the Seguridad 360 security analysis. Helps detect CMS, plugins, and versions with known flaws.
- Activate the SWPanel Firewall. Filters web attacks before they reach your application.
- Use BotLock to block malicious bots. Controls and blocks bots and crawlers trying to attack your website.
- Make regular backups. In case of an attack, you can quickly recover your website.
- Subscribe to the SWPanel Security Newsletter. We notify you when new flaws that could affect you are released.
- Monitor security updates. If you're using a CMS like WordPress, Drupal, or Joomla, regularly check for updates.
What SWPanel tools can help you
- Seguridad 360 security analysis: Detects CMS, plugins, and versions with known flaws. If your website is at risk, it will mark it in the panel.
- Seguridad 360 security newsletter and alerts: Warns you when a flaw that affects you is released. Ideal for staying up to date without wasting time.
- BotLock: Controls and blocks malicious bots and crawlers from your website. Useful if your website receives many attack attempts.
- FireWall: Filters web attacks before they reach your application. Ideal for protecting your website from common attacks.
- CMS automatic update: If you installed your website from SWPanel, you can activate automatic updates to keep it secure without doing anything.
- Backups: In case of an attack, you can quickly recover your website. Ideal for minimizing the impact.
- PHP version change: If you're using an unsupported version, switch to a supported one from the hosting panel.
- Ticket support: If you have questions or need help, you can contact us anytime.
Quick summary
- The number of public exploits remains high, and 8 of them are already being used in real attacks.
- Vulnerable websites can be attacked quickly if they're not updated.
- Updating your CMS, plugins, and PHP is key to keeping your website secure.
- SWPanel helps you detect and prevent these attacks with tools like Seguridad 360, BotLock, and the FireWall.
Sources
This week's data comes from the exploited vulnerabilities catalog (KEV), attack detection rules (nuclei), and detection signatures from Emerging Threats.
