ZealLabs.aiFlipping the Script by leveraging AI
Threat Watch LiveChecking services…Members
Now watching
  • Checking services…
Watch level: ElevatedOpen Threat Watch →
Live · Watch level: Elevated

Threat Watch · from ezNet Solutions

What we're watching right now.

Live data from official sources, refreshed every 10 to 30 minutes.

Watch level

Elevated

Set by Bill Brazeal, CISSP · October 27, 2026

This week in one paragraph

The big story is PHP2Shell: two critical PHP flaws that let attackers take over unpatched websites without logging in. If your business has a WordPress, Joomla or other PHP website, ask your web host to confirm it's patched. Firewalls and remote-access tools remain a favorite target, with new flaws in Fortinet, Citrix and BeyondTrust this month. Microsoft's next security updates arrive November 10.

Why Elevated: Attackers are actively exploiting critical PHP flaws that let them take over websites. If you own an older WordPress, Joomla or custom PHP site, have it checked or taken offline this week.

This week, do three things

  1. Update firewalls and remote accessFortinet, Citrix, Cisco and BeyondTrust all had actively exploited flaws this month.
  2. Ask your web host about PHPConfirm your website runs a patched PHP version.
  3. Let computers restart for updatesMicrosoft's next fixes arrive November 10. Restart within a few days of that.

Threat Watch comes from ezNet Solutions, ZealLabs' parent company, which handles these for its managed IT clients. Questions about any of them? Ask us.

Spotlight · Bill's pick this week

PHP2Shell: older websites can be taken over

Why it matters
Two critical PHP flaws let attackers take over a website without logging in, and they're being used right now.
What ezNet is doing
We're tracking this for every client and will contact you directly if a website you own is affected.
What you should do
If you have a WordPress, Joomla or custom PHP website, ask your web host to confirm it runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.

Read our full notice

Flaws attackers are using

Every flaw added to the government's exploited list in the last 30 days. Products common in small offices come first. Open any card for details.

  • Act now: ransomware, common firewalls and VPNs, or a deadline this week
  • Common in small offices
  • Enterprise and other
  • Loading the latest list…

Cloud service status

What each vendor reports on its own status page, checked every 10 minutes. Each strip shows the last 24 hours.

Loading…

  • Operational
  • Maintenance
  • Minor issue
  • Major issue

Loading…

Grok (xAI) doesn't allow automated status checks; see its status page.

Internet health

Alabama, last 7 days

How much of Alabama's internet answers when it's measured from outside, compared with a normal hour. A sharp dip means a real outage somewhere in the state.

Loading…

Major providers

The same measurement for each provider's whole network, nationwide.

Loading…

Down for you? Crowd reports on DownDetector:

Trends and charts

What's being attacked

Exploited flaws added in the last 30 days.

Loading…

12-week trend

New entries on the government's exploited-vulnerability list, per week.

Loading…

Last 5 weeks, day by day

Each square is a day; darker means more newly exploited flaws.

Loading…

By type of system

Loading…

Most-targeted vendors

Loading…

Microsoft Patch Tuesday

Loading…

CISA advisories

  • Loading…

About this data

Types of system and card colors come from simple rules. Fix-by dates are deadlines CISA sets for federal agencies, a useful yardstick for everyone else. Listings summarize public information; they aren't a complete security assessment, and a vendor's status page can lag behind a real outage. Internet measurements are by IODA (Internet Outage Detection and Analysis), Georgia Tech. For plain-English advisories, see ezNet's Security Notices.