Tuesday, October 27, 2026 · 3 of 5

1. CISA put PHP2Shell on its exploited list and gave federal agencies until Thursday

   32.5 million PHP services still ran an affected version.

   Oct 26Security