Summary
Attackers are racing ahead of defenders by exploiting PHP2Shell vulnerabilities in PHP-based web applications, launching over 122,000 attack sessions and 482,000 requests in just 24 hours. Cyware.com highlights how this wave has already impacted nearly 22,000 sites across 103 countries, with the United States facing the brunt of the automated break-ins.
A single malicious PDF can now compromise Apple devices due to a CoreGraphics flaw tracked as CVE-2026-86950. This bug, rooted in a unit conversion error, lets attackers trigger out-of-bounds writes and potentially execute code on iOS and macOS, with a fix available in iOS 26.7.1.
A flaw in Bun’s HTTP/3 implementation lets remote attackers knock servers offline with as little as 6 MB of traffic or a 530 KB request. The vulnerability, affecting Bun versions between 1.3.14 and 1.4.4, allows memory exhaustion and CPU pinning, but is now addressed in Bun 1.4.4.
Top Vulnerabilities Reported in Last 24 hours
PHP2Shell attacks surge across PHP sites
Attackers are using the PHP2Shell vulnerabilities in PHP-based web applications (CVE-2026-109618 and CVE-2026-109619) to run commands remotely on exposed servers, opening the door to data theft, malware installation, and service disruption. The rush started before most defenders even knew the name: attackers began exploiting PHP2Shell four days before public disclosure, and Imperva observed a wave of automated probing and break-in attempts. Attackers are already exploiting this in the wild. Imperva said it recorded 482,342 requests and 122,311 attack sessions, impacting 21,998 sites across 103 countries in the first 24 hours, with heavy targeting in the United States; the disclosure effort involved Imperva coordinating with Wiz, OpenAI, and Calif. The same AI-assisted tooling that lowers the barrier for attackers is also being used to speed up detection and mitigation, with defenders urged to pair AI tools with skilled security teams; recommended actions highlighted in reporting include applying security updates, reviewing logs dating back to October 17, and restricting access to vulnerable services.
Malicious PDFs can compromise Apple devices
A CoreGraphics bug in Apple’s iOS and macOS (CVE-2026-86950) can let a malicious PDF trigger an out-of-bounds write and potentially lead to arbitrary code execution on targeted devices. The issue stems from a unit conversion error in aa_double_to_fixed that feeds into glyph rendering paths, with CGGlyphBitmapCreateWithPathAndDilation implicated in the flow that reaches the vulnerable rendering logic. Attackers can drive memory corruption through an integer overflow during bounding box calculation in aa_cache_render, creating a controlled offset that results in an out-of-bounds 16-bit increment. No active exploitation was explicitly confirmed in the provided reporting, but the write-up discusses how crafted PDFs and app-level PDF processing changes (including in WhatsApp’s Kaleidoscope framework) may have facilitated exploitation scenarios. A fix is available in iOS 26.7.1.
Bun HTTP/3 bug enables cheap DoS
A flaw in Bun’s HTTP/3 implementation allows a remote, unauthenticated peer to exhaust memory or pin CPU, effectively knocking a Bun service offline through low-volume traffic (affected: Bun >= 1.3.14 and < 1.4.4). In testing described by the project, as little as 6 MB of traffic could push a server with a 2 GB memory limit into an out-of-memory kill, and a 530 KB request could hold a server at 100% CPU, preventing it from answering other requests. The weakness comes from missing limits on decoded header size, enabling HTTP/3 QPACK amplification where a small request expands into an oversized header set inside the server process. No active exploitation was reported in the advisory text provided, but the conditions are straightforward for any untrusted client that can reach an HTTP/3-enabled endpoint. The issue is fixed in Bun 1.4.4, which adds enforced limits and changes behavior by returning a 431 response when requests exceed limits and closing the connection for much larger requests.
Frequently Asked Questions
What is CVE-2026-109618? Attackers are using the PHP2Shell vulnerabilities in PHP-based web applications (CVE-2026-109618 and CVE-2026-109619) to run commands remotely on exposed servers, opening the door to data theft, malware installation, and service disruption. The rush started before most defenders even knew the name: attackers began exploiting PHP2Shell four days before public disclosure, and Imperva observed a wave of automated probing and break-in attempts.
What is CVE-2026-86950? A CoreGraphics bug in Apple’s iOS and macOS (CVE-2026-86950) can let a malicious PDF trigger an out-of-bounds write and potentially lead to arbitrary code execution on targeted devices. The issue stems from a unit conversion error in aa_double_to_fixed that feeds into glyph rendering paths, with CGGlyphBitmapCreateWithPathAndDilation implicated in the flow that reaches the vulnerable rendering logic.
What is Bun? A flaw in Bun’s HTTP/3 implementation allows a remote, unauthenticated peer to exhaust memory or pin CPU, effectively knocking a Bun service offline through low-volume traffic (affected: Bun >= 1.3.14 and < 1.4.4). In testing described by the project, as little as 6 MB of traffic could push a server with a 2 GB memory limit into an out-of-memory kill, and a 530 KB request could hold a server at 100% CPU, preventing it from answering other requests.