PHP Zero-Days and 953 Compromised Shops: CISA Confirms Active Exploitation
PHP Zero-Days and 953 Compromised Shops: CISA Confirms Active Exploitation
On 26 October 2026, CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue, both allowing unauthenticated remote code execution. CVE-2026-1096018 and CVE-2026-1096019 are confirmed as actively exploited in the wild, affecting the scripting language that powers most small business websites and e-commerce platforms. Simultaneously, Sansec researchers documented a 15-month campaign compromising 953 online stores, primarily running Magento, using JavaScript card skimmers hidden in CMS content…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.