Threat intelligence
Advisories from Panop Research on critical vulnerabilities and active threats: what is affected, who is exposed, and what to do first.
- Published by
- Panop Research
- Latest
- Questions
- contact@panop.io
- Vulnerability advisory
Linux Kernel TCP/IP RCE: Internet-Wide Scanning for CVE-2026-98432
CVE-2026-98432
CVE-2026-98432 is a critical use-after-free in the Linux kernel's IPv4 TCP path. Threat actors are already scanning for exposed MPTCP listeners.
Severity: Critical - Updated Vulnerability advisory
PHP2Shell: Unauthenticated RCE in PHP (CVE-2026-109618, CVE-2026-109619)
CVE-2026-109618 · CVE-2026-109619
Two critical PHP engine flaws allow unauthenticated RCE, and exploitation attempts began before disclosure. What is affected and what to do today.
Severity: Critical - Vulnerability advisory
HTTP2Shell: Out-of-Bounds Write in the Brotli Decoder (CVE-2026-111497)
CVE-2026-111497
A Brotli decoder flaw first called Node2Shell reaches Node.js, Bun, Python, Envoy and .NET. Who is exposed, how to patch, what to do until you can.
Severity: Critical
About Panop Research
Panop Research is the security research function of Panop SA, a Swiss exposure management company founded in July 2024 by three practitioners with nearly twenty years each inside large international organisations. It publishes analysis built on primary public datasets, with every figure attributed and linked to the publisher that produced it.
Need to know where an advisory lands in your estate? Request a scan