CISA added the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, after honeypots caught attackers running code on an unpatched PHP server. The flaws are in the PHP runtime itself, so updating WordPress or Joomla does not close them.
Attackers are using an on-prem VeloCloud exploit, CVE-2026-114625 (CVSS 9.9), to turn the lowest-privilege Enterprise Read Only portal account into local superuser on the Arista VeloCloud Orchestrator host. That host runs the SD-WAN management plane for every branch and site it controls. A forgotten login is now the shortest path to the management plane.