What you need to know today.
Critical PHP, Adobe, and WordPress vulnerabilities are under active exploitation or pose significant risks, with CISA confirming PHP flaws are being exploited in the wild.
PHP Vulnerabilities Under Active Exploitation: CISA has confirmed the active exploitation of two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, related to the handling of out-of-memory errors and global state management, allow for remote code execution. The exploitation of these vulnerabilities has been observed in the wild, with reports indicating successful compromises of servers, including those belonging to universities and businesses. Security researchers have developed proof-of-concept exploits, and some threat actors are actively using them to gain control of systems. The PHP development team has released security updates to address these issues, and users are strongly advised to update their PHP installations immediately. The widespread use of PHP in web applications makes these vulnerabilities a significant concern for a large number of internet-facing services.
Adobe Commerce and Campaign Classic Vulnerabilities: Adobe has released patches for several critical vulnerabilities affecting its Commerce and Campaign Classic (ACC) products. CVE-2026-48356, an unrestricted file upload vulnerability in Adobe Commerce, could lead to arbitrary code execution. This flaw has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Additionally, multiple critical vulnerabilities in Adobe Campaign Classic, including SQL injection (CVE-2026-105781, CVE-2026-105489), OS command injection (CVE-2026-104353), improper authorization, and code injection (CVE-2026-105780, CVE-2026-104351), could allow attackers to gain elevated access or execute arbitrary code. These vulnerabilities pose a significant risk to organizations using these Adobe products, and prompt patching is essential.
Multiple Critical Vulnerabilities in WordPress Plugins: Several critical vulnerabilities have been disclosed in popular WordPress plugins. The Ultimate Member plugin is affected by CVE-2026-115968, a deserialization of untrusted data vulnerability that allows for object injection. The Contact Manager plugin has a critical arbitrary file upload vulnerability (CVE-2026-109218) due to an incomplete extension blacklist. Furthermore, the Pie Register Premium plugin suffers from an unrestricted file type upload vulnerability (CVE-2026-84999). These vulnerabilities could allow attackers to upload malicious files, execute arbitrary code, or gain unauthorized access to WordPress sites. Users of these plugins should update to the latest versions to mitigate these risks.
Dell PowerProtect Data Domain Vulnerabilities: A series of critical vulnerabilities have been identified in Dell PowerProtect Data Domain. CVE-2026-103780, CVE-2026-86384, CVE-2026-86400, CVE-2026-86397, and CVE-2026-86397 all relate to vulnerabilities within the product that could lead to significant security compromises. While the specific impacts are not detailed in the provided text, the critical severity and CVSS scores suggest potential for remote code execution or other severe security breaches. Organizations utilizing Dell PowerProtect Data Domain should consult Dell