This week, what you need to know
Every week, in the world of security, new vulnerabilities are discovered in software, plugins, and servers. This week, 55 new vulnerabilities have been reported that could affect websites, servers, or even printers. Although none of them are currently being used in ransomware attacks, several have a high probability of being exploited. It's like leaving the door to your house unlocked: even if there's no thief right now, it's only a matter of time before someone tries.
SWPanel monitors these threats so you don't have to. If any of these vulnerabilities affect your website, we'll let you know before it's too late.
What's happening in the world
This week, 55 new vulnerabilities have been identified in software and systems. Of these, none are being used in ransomware campaigns, which is a relief. However, several have a very high probability of being exploited by attackers. For example, Joomla!, Apache Struts, mantisbt, and other popular systems have flaws that could allow an attacker to execute commands or access sensitive data.
These vulnerabilities are not just numbers on a list: they represent open doors that attackers can use to enter systems. Even if there's no active attack right now, bots and automated scripts are already scanning for websites with these vulnerabilities.
The cards, CVE by CVE
CVE-2015-7857
- Affected product: Joomla!
- What the flaw is: Allows malicious code execution if an attacker sends a special request to the website.
- How it's attacked: Through a malformed URL.
- What could happen: The attacker could take control of the website or steal data.
- Severity: High
- Exploit probability (EPSS): 94.47%
- Already exploited (KEV): No
CVE-2013-1965
- Affected product: Apache Struts
- What the flaw is: Allows command execution on the server if a malformed request is sent.
- How it's attacked: Through a malicious web form.
- What could happen: The attacker could take control of the server.
- Severity: High
- Exploit probability (EPSS): 93.53%
- Already exploited (KEV): No
CVE-2017-7615
- Affected product: mantisbt
- What the flaw is: Allows reading server files if a special request is sent.
- How it's attacked: Through a malformed URL.
- What could happen: The attacker could read sensitive files such as passwords or customer data.
- Severity: High
- Exploit probability (EPSS): 91.20%
- Already exploited (KEV): No
CVE-2025-62168
- Affected product: squid
- What the flaw is: Allows command execution on the server if a malformed request is sent.
- How it's attacked: Through an automated script.
- What could happen: The attacker could take control of the server.
- Severity: Medium
- Exploit probability (EPSS): 64.82%
- Already exploited (KEV): No
CVE-2021-24472
- Affected product: kentharadio
- What the flaw is: Allows malicious code execution if a special request is sent.
- How it's attacked: Through a malicious web form.
- What could happen: The attacker could take control of the website.
- Severity: Medium
- Exploit probability (EPSS): 56.61%
- Already exploited (KEV): No
And in SWPanel, what?
SWPanel monitors these vulnerabilities so you don't have to. If any of them affect your website, we'll let you know before it's too late. In addition, if there's already a security alert published by SWPanel, you'll see it in the Security 360 section of your panel.
For example, we already have alerts for vulnerabilities such as CVE-2026-109618 and CVE-2026-109619, related to critical flaws in PHP. If any of these affect your website, we'll let you know.
How we got here
In the last few weeks, the number of reported vulnerabilities has fluctuated quite a bit. The week of October 12 to 18 was the highest with 136 new vulnerabilities, but it has decreased since then. This week, with 55 new vulnerabilities, is the third consecutive week of decline. The average of the last five weeks is 70, so this week is below the usual average.
Although there's an upward trend in the previous six weeks, the number of vulnerabilities seems to have stabilized. If this trend continues, it's likely that in the coming weeks we'll continue to see between 50 and 70 new vulnerabilities per week.
What's happening behind the numbers
Attackers are using bots and automated scripts to look for websites with known vulnerabilities. Although there's no active ransomware attack right now, attackers are preparing the ground for future attacks. This is like someone making copies of house keys: they don't enter now, but they wait for the right moment.
It's also possible that some of these flaws are related to automated campaigns looking for websites with outdated software versions. This explains why there are so many vulnerabilities with a high probability of exploitation, but without an active attack yet.
What we can expect
If the trend continues, it's likely that in the coming weeks we'll continue to see between 50 and 70 new vulnerabilities per week. An optimistic scenario would be that the number keeps decreasing, which would mean fewer risks for websites. A pessimistic scenario would be that the number rises again, which would mean more risks.
The warning signs to watch for would be:
- A sudden increase in the number of vulnerabilities with a high probability of exploitation.
- An increase in the number of vulnerabilities that are already being exploited.
- An increase in the number of vulnerabilities related to WordPress or popular plugins.
How it can affect your website or business
Imagine you have an online store with an outdated plugin. An attacker could exploit a vulnerability like CVE-2015-7857 to take control of your website. Once inside, they could:
- Steal your customers' data (names, addresses, emails, even credit card numbers).
- Add unwanted advertising or even malware to your website.
- Make your website stop working (denial-of-service attack).
This would not only affect your business (loss of sales), but also your reputation. If customers don't trust your website, they won't come back. In addition, if customer data is stolen, you could face fines for violating the GDPR.
How to protect yourself and prevent attacks
- Update your CMS and plugins regularly. If you use WordPress, Joomla!, Drupal, or any other system, make sure they're up to date. If you installed your website from SWPanel, you can enable automatic updates.
- Use strong and unique passwords. Don't use the same password on multiple sites. If you use a weak password, an attacker could guess it or steal it from another site.
- Enable two-factor authentication (2FA). This adds an extra layer of security. If someone steals your password, they won't be able to access without the second factor.
- Use a web firewall. A firewall filters attacks before they reach your website. If you use SWPanel, you can enable the firewall from the panel.
- Enable BotLock. BotLock blocks malicious bots and crawlers that try to attack your website.
- Review SWPanel security alerts. If there's an alert about a vulnerability that affects your website, act quickly. You can view the alerts in Security 360.
- Make regular backups. If your website is attacked, you can recover it quickly from a backup.
- Use a supported version of PHP or Node.js. If you use an unsupported version, you won't receive security patches. You can change the version from the hosting panel.
What SWPanel tools can help you
- Security analysis in Security 360: Detects CMS, plugins, and versions with known flaws. If your website has a flaw, it will be marked in the panel.
- Newsletter and security alerts: Warn you when a flaw affecting you is released. If there's an alert, you can see it in the panel.
- BotLock: Blocks malicious bots and crawlers that try to attack your website.
- Web firewall: Filters web attacks before they reach your application.
- Automatic CMS update: If you installed your website from SWPanel, you can enable automatic updates to keep it secure.
- Backups: If your website is attacked, you can recover it quickly from a backup.
- PHP version change: If you use an unsupported version, you won't receive security patches. You can change the version from the hosting panel.
Quick summary
- This week, 55 new vulnerabilities were reported, but none are being used in ransomware.
- Some have a high probability of being exploited, such as Joomla!, Apache Struts, or mantisbt.
- SWPanel monitors these vulnerabilities and alerts you if they affect your website.
- To protect yourself, update your CMS, use strong passwords, and use SWPanel's security tools.
Sources
The data for this week comes from public catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.
