Patchstack disclosed the flaw today with exploitation reported and public exploit code already indexed, so unpatched Elementor Pro sites can be found and taken over by commodity scanners within days.
Elementor Pro through 4.2.1 allows an unauthenticated attacker to upload files of dangerous types, which Patchstack demonstrates can be chained to full remote code execution on the WordPress host. A compromised site gives the attacker the web user's privileges, database credentials, and a foothold for malware distribution.
Affected: Elementor Pro <= 4.2.1 (fixed in 4.2.2)
How to Test
Check the plugin version under Plugins in wp-admin — anything at or below 4.2.1 is vulnerable. Scan wp-content/uploads and Elementor's upload directories for unexpected .php/.phtml files, and review access logs for unauthenticated POSTs to Elementor Pro AJAX/upload endpoints followed by direct GET requests to files in the uploads tree.
How to Patch
Update Elementor Pro to 4.2.2 immediately (Patchstack also offers a vPatch rule for managed mitigation). As a hardening step, block PHP execution in wp-content/uploads via your web server configuration (e.g., an nginx location rule or Apache .htaccess denying .php handlers) and remove any unauthorized files found.
VulnCheck added this flaw to its known-exploited catalog today with five public exploits already circulating, and self-managed GitLab instances left unpatched this week risk unauthenticated attackers tampering with or destroying their projects and user data.
A flaw in GitLab CE/EE GraphQL directive handling allows a completely unauthenticated remote attacker to modify or delete public projects and user data. Because tampered public repositories can poison everything downstream that pulls from them, the integrity impact extends well beyond the GitLab instance itself.
Affected: GitLab CE/EE >= 18.2 < 18.11.11; GitLab CE/EE >= 19.0 < 19.0.8; GitLab CE/EE >= 19.1 < 19.1.6; GitLab CE/EE >= 19.2 < 19.2.4
How to Test
Check your version via /help or `gitlab-rake gitlab:env:info` — anything from 18.2 up to but not including 18.11.11/19.0.8/19.1.6/19.2.4 is vulnerable. Review production_json.log and workhorse logs for unauthenticated POSTs to /api/graphql containing unusual or malformed directives, and audit recent project deletion/modification events (audit_events, project destroy jobs) that lack a corresponding authenticated actor.
How to Patch
Upgrade immediately to GitLab 18.11.11, 19.0.8, 19.1.6, or 19.2.4 per the GitLab 19.2.4 patch release notes. If you cannot upgrade today, restrict unauthenticated network access to /api/graphql at your reverse proxy or firewall until you can, and take fresh backups of repositories and the database first.
Cl0p today publicly named more than 40 victims of its Windchill/FlexPLM exploitation campaign — including Shell, Philips, and Fiserv — and any team still running an unpatched, reachable instance this week risks data theft and appearance on the leak site.
An improper input validation flaw in PTC Windchill PDMLink and FlexPLM lets an unauthenticated remote attacker execute arbitrary code with a single crafted network request. The Cl0p ransomware group has used it in a mass data-theft and extortion campaign against dozens of major organizations.
Affected: PTC Windchill PDMLink <= 11.0 M030; PTC Windchill PDMLink 11.1 M020; PTC Windchill PDMLink 11.2.1.0; PTC Windchill PDMLink 12.0.2.0; PTC Windchill PDMLink 12.1.2.0; PTC Windchill PDMLink 13.0.2.0; PTC Windchill PDMLink 13.1.0.0; PTC Windchill PDMLink 13.1.1.0; PTC Windchill PDMLink 13.1.2.0; PTC Windchill PDMLink 13.1.3.0; PTC FlexPLM (same code base and fix line)
How to Test
Confirm your Windchill/FlexPLM build against the affected list above (any 11.x–13.1.3.0 build is vulnerable). Treat any internet-reachable instance as potentially compromised: review web-tier access logs for anomalous unauthenticated POST requests to Windchill servlet endpoints since late June 2026, hunt for newly written JSP/webshell files under the Windchill web application directories, and check for large outbound data transfers consistent with Cl0p exfiltration.
How to Patch
Apply the fixes and mitigations in PTC article CS473270 (https://www.ptc.com/en/support/article/CS473270), upgrading to the patched CPS builds for your release line. If you cannot patch immediately, remove the appliance from direct internet exposure (VPN-gate it) and perform forensic triage before restoring access — this CVE's KEV remediation deadline passed on 2026-06-28.
Patchstack reported in-the-wild exploitation and VulnCheck added the flaw to its known-exploited catalog on 2026-08-18, so any site still on a pre-7.20.01 build this week is an easy full-takeover target.
WP Compress versions before 7.20.01 contain an unauthenticated remote code execution flaw (CVSS 10.0) that lets any remote attacker run arbitrary code on the WordPress host with no credentials or user interaction. Successful exploitation yields full site compromise, including database access and the ability to plant persistent webshells.
Affected: AresIT WP Compress < 7.20.01 (fixed in 7.20.01)
How to Test
Check the WP Compress version in the wp-admin Plugins page — anything below 7.20.01 is vulnerable. Hunt for compromise: search wp-content (especially uploads and the plugin directory) for recently created PHP files, review web server logs for unauthenticated requests to wp-compress-image-optimizer endpoints, and audit wp_users for newly added administrator accounts.
How to Patch
Update WP Compress to 7.20.01 or later immediately, or deactivate/remove the plugin until you can. Patchstack subscribers can enable the vPatch mitigation; regardless, rotate WordPress salts and admin credentials if you find any indicator of prior exploitation.
CISA's SSVC decision is 'active' for both flaws and Kaspersky confirmed Head Mare is chaining them in live attacks, so unpatched TrueConf hosts exposed on port 4307 face full system compromise this week.
TrueConf Server exposes a critical function over 4307/TCP without authentication, letting a remote attacker execute an arbitrary script (CVE-2026-72529, CVSS 9.3); a code injection flaw then lets that script break out of the isolated scripting environment and run arbitrary code on the underlying host (CVE-2026-72530, CVSS 9.5). Kaspersky ICS-CERT observed the Head Mare group chaining both to deploy PhantomCore malware.
Affected: TrueConf Server < 5.3.9.10013 / < 5.3.9.10015; TrueConf Server 5.4.0.12689–5.4.9.10072 / 5.4.0.12700–5.4.9.10019; TrueConf Server 5.5.0.13826–5.5.5.10010 / 5.5.0.13828–5.5.5.10009
How to Test
Check your TrueConf Server build number in the admin panel against the fixed builds (5.3.9.10013/10015, 5.4.9.10072/10019, 5.5.5.10010/10009); scan your perimeter for exposed 4307/TCP and review connection logs on that port for unauthenticated script-execution requests; hunt for unexpected child processes spawned by the TrueConf service outside its scripting sandbox and for PhantomCore indicators from the Kaspersky ICS-CERT report.
How to Patch
Upgrade immediately to TrueConf Server 5.3.9.10013/10015, 5.4.9.10072/10019, or 5.5.5.10010/10009 (or later) for your branch — one upgrade fixes both flaws; until patched, block 4307/TCP from the internet and restrict it to trusted management networks.