Blog | Holm Security | Cyberattacks & exploits

October 27, 2026 — Cyberattacks & exploits PHP2Shell is not a patching problem. It's an inventory problem. When the critical PHP vulnerabilities broke on October 21, how long would it have taken you to answer one question: where do we run PHP? PHP2Shell (CVE-2026-109618, CVE-2026-109619) sent organizations around the world scrambling. In the Netherlands, cyber...

September 9, 2026 — Cyberattacks & exploits Cybercriminals are backdooring online stores running Magento and Adobe Commerce

Adobe released an emergency fix on 7 September for a vulnerability in Adobe Commerce and...

September 4, 2026 — Cyberattacks & exploits Cybercriminals chain two SonicWall vulnerabilities to break into remote-access appliances

SonicWall disclosed two vulnerabilities in its SMA1000 remote-access appliances on 1...

September 2, 2026 — Cyberattacks & exploits Cybercriminals are hijacking Langflow servers for cloud keys

A critical vulnerability in Langflow - a widely used open-source tool for building AI...

Filter posts

April 7, 2026 — Cyberattacks & exploits Active attacks target critical Fortinet vulnerability – act now

Fortinet has disclosed critical vulnerability CVE-2026-35616 (CVSS score 9.8) in FortiClient EMS, which is confirmed exploited in the wild since March 31,...

August 12, 2025 — Cyberattacks & exploits Newly-discovered critical CodeIgniter4 flaw requires immediate action

A critical CodeIgniter4 vulnerability requires immediate action A newly-disclosed critical vulnerability in CodeIgniter4 (versions before 4.6.2) puts many...

May 10, 2024 — Cyberattacks & exploits Google Chrome zero-day vulnerability exploited in the wild

Understanding the vulnerability: A memory issue in Chrome The identified vulnerability (CVE-2024-4671) is classified as high-severity and has a CVSS v3.1 score...

April 12, 2024 — Cyberattacks & exploits Zero-day vulnerability in Palo Alto Networks PAN-OS exploited in the wild

Understanding the vulnerability CVE-2024-3400 Tracked as CVE-2024-3400 and rated with the maximum CVSS score of 10.0, this is a command injection vulnerability...

February 27, 2024 — Cyberattacks & exploits Critical vulnerabilities discovered in ConnectWise ScreenConnect

Understanding the vulnerabilities CVE-2024-1708 This is a path-traversal vulnerability with a CVSS score of 8.4 affecting ScreenConnect 23.9.7 and earlier,...

January 24, 2024 — Cyberattacks & exploits Critical security flaw in GoAnywhere MFT: Users exposed to unauthorized admin access

Understanding CVE-2024-0204 This vulnerability, with a high CVSS score of 9.8, arises from a path traversal weakness in the "/InitialAccountSetup.xhtml"...