ctrlINT What the industry said about every indicator, with the quote

CVE-2026-64638Vulnerability

Reported by 1 independent source · first reported by Datadog Security Labs · last reported

Last reported 1 month ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “…targets under five named exploitation chains: react2shell (CVE-2025-55182), wp2shell (CVE-2026-63030 and CVE-2026-60137), xss2shell (CVE-2026-64638), joomla2shell (CVE-2026-48907), and deep.”

    Datadog Security LabsVendor
    Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

Indicators reported together

named in the same reports

Also named with it: CVE-2025-55182, CVE-2026-48907, CVE-2026-60137, CVE-2026-63030

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-64638 here?
No account needed. We do not store your IP address.