CVE-2026-116839: HIGH severity CSRF vuln in Ubiquiti airMAX M (<6.3.26). Exploitation allows unauthorized changes & DoS if an authenticated user visits a malicious page. Upgrade to 6.3.26+ ASAP. https://radar.offseq.com/threat/cve-2026-116839-cwe-352-cross-site-request-forgery-csrf-in-ubiquiti-inc-airmax-m-384ff83bdd5089b1 #OffSeq #CSRF #Ubiquiti

CVE-2026-116839: HIGH severity CSRF vuln in Ubiquiti airMAX M (<6.3.26). Exploitation allows unauthorized changes & DoS if an authenticated user visits a malicious page. Upgrade to 6.3.26+ ASAP. https://radar.offseq.com/threat/cve-2026-116839-cwe-352-cross-site-request-forgery-csrf-in-ubiquiti-inc-airmax-m-384ff83bdd5089b1 #OffSeq #CSRF #Ubiquiti

Update your #iPhone, #iPad, #Apple Safari, and everything else #Webkit *right now*

https://support.apple.com/en-us/149227
https://www.cve.org/CVERecord?id=CVE-2026-112623

OpenPanel <3.0.0 HIGH severity info disclosure (CVE-2026-116819): Read-level users can access integration secrets (Slack tokens, webhooks) due to missing redaction. Upgrade to 3.0.0+ and restrict access. https://radar.offseq.com/threat/openpanel-before-300-contains-an-information-disclosure-vulnerability-that-allows-read-level-project-1754d084c1108896 #OffSeq #vuln #OpenPanel #CVESecurity

OpenPanel <3.0.0 HIGH severity info disclosure (CVE-2026-116819): Read-level users can access integration secrets (Slack tokens, webhooks) due to missing redaction. Upgrade to 3.0.0+ and restrict access. https://radar.offseq.com/threat/openpanel-before-300-contains-an-information-disclosure-vulnerability-that-allows-read-level-project-1754d084c1108896 #OffSeq #vuln #OpenPanel #CVESecurity

Apple's iOS 18.7.11 fixes CVE-2026-86950, a CoreGraphics zero-day exploited in the wild, on older iPhones and iPads. Update now.

#Apple #iOS #ZeroDay #CVE202686950 #CoreGraphics #ExploitedInTheWild #iPhone #CyberSecurity

https://securityonline.info/coregraphics-zero-day-cve-2026-86950-ios-18/?utm_source=mastodon&utm_medium=jetpack_social

Apple's iOS 18.7.11 fixes CVE-2026-86950, a CoreGraphics zero-day exploited in the wild, on older iPhones and iPads. Update now.

#Apple #iOS #ZeroDay #CVE202686950 #CoreGraphics #ExploitedInTheWild #iPhone #CyberSecurity

https://securityonline.info/coregraphics-zero-day-cve-2026-86950-ios-18/?utm_source=mastodon&utm_medium=jetpack_social

📣 EMERGENCY UPDATE 📣

Apple pushed additional updates for a zero-day that may have been actively exploited.

🐛 CVE-2026-86950 (CoreGraphics) additional patches:
- iOS and iPadOS 18.7.11

#apple #cybersecurity #infosec #security #ios

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Patch CVE-2026-110720 now. This 9.9 CVSS consul-k8s vulnerability enables a cross-namespace authorization bypass in ACL binding rules.

#HashiCorp #Consul #Kubernetes #CVE2026110720 #CloudSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/hashicorp-consul-k8s-vulnerability-cve-2026-110720/?utm_source=mastodon&utm_medium=jetpack_social

Patch CVE-2026-110720 now. This 9.9 CVSS consul-k8s vulnerability enables a cross-namespace authorization bypass in ACL binding rules.

#HashiCorp #Consul #Kubernetes #CVE2026110720 #CloudSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/hashicorp-consul-k8s-vulnerability-cve-2026-110720/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Security update: Routinator 0.15.3 is now available.

This release fixes several security issues. These security fixes primarily fix some cases where someone could make Routinator exit or become unavailable. They have been assigned CVE-2026-72752 till -72758.

https://community.nlnetlabs.nl/t/routinator-0-15-3-until-it-ends-there-is-no-end-released/3496

JFC

https://nvd.nist.gov/vuln/detail/cve-2026-112346

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

🚨 Two critical Wasmtime flaws could allow malicious WebAssembly modules to escape the runtime sandbox

Both vulnerabilities affect Cranelift, Wasmtime’s default compiler, and carry CVSS scores of 9.9.
⠀
CVE-2026-115889 affects all processor architectures and can trigger silent compiler errors that generate incorrect machine code.

CVE-2026-115893 affects ARM64 systems and can cause large br_table instructions to jump to the wrong code location.
⠀
Exploitation requires a vulnerable Wasmtime instance to compile an attacker-controlled WebAssembly module. Services that accept and execute untrusted customer modules face the greatest risk.

Fixed versions:

• Wasmtime 36.0.19
• Wasmtime 48.0.7
• Wasmtime 49.0.4
• Wasmtime 50.0.0 or later

No exploitation in the wild has been reported.

Sources: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm

Brotli Defect Exposes Vast Internet Risk

A critical defect, CVE-2026-111497, has been uncovered in Google's Brotli decompression library, posing a significant risk of system crashes and remote code execution. This newly discovered buffer overflow vulnerability has sparked a flurry of activity, with major players like Node.js, Microsoft, and Python scrambling to issue patches and…

https://osintsights.com/brotli-defect-exposes-vast-internet-risk?utm_source=mastodon&utm_medium=social

#BrotliVulnerability #Cve2026111497 #Nodejs #RemoteCodeExecution #BufferOverflow

SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)
https://isc.sans.edu/podcastdetail/10152

Palo Alto confirms PAN-OS Brotli vulnerability CVE-2026-111497, a CVSS 9.2 buffer overflow in PAN-OS 12.2, 12.1 and 11.2. Install the hotfixes now.

#PaloAltoNetworks #PANOS #Brotli #CVE2026111497 #BufferOverflow #Firewall #PrismaCloud #CyberSecurity

https://securityonline.info/pan-os-brotli-vulnerability-cve-2026-111497/?utm_source=mastodon&utm_medium=jetpack_social

SANS Stormcast Tuesday, October 27th, 2026: Apple Patches 304 Vulnerabilities Incl. Exploited CoreGraphics Flaw; Threat Hunting in DShield SIEM with ELK; .NET and PHP Brotli Fixes (CVE-2026-111497)
https://isc.sans.edu/podcastdetail/10152

Palo Alto confirms PAN-OS Brotli vulnerability CVE-2026-111497, a CVSS 9.2 buffer overflow in PAN-OS 12.2, 12.1 and 11.2. Install the hotfixes now.

#PaloAltoNetworks #PANOS #Brotli #CVE2026111497 #BufferOverflow #Firewall #PrismaCloud #CyberSecurity

https://securityonline.info/pan-os-brotli-vulnerability-cve-2026-111497/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-111497 now haunts Google's Brotli decoder — embedded across Node.js, .NET, Visual Studio, PowerShell, and Python packages — enabling out-of-bounds writes that Imperva confirmed can achieve code execution on Node.js 24.22.0 for Linux arm64.

Microsoft, Node.js, and two Python package maintainers have since issued patches. PHP rebuilt its Windows packages too. Rapid7 sees no wild exploitation yet, but the proof-of-concept exists. (2/3)

🔥 Node2Shell vulnerability scanner 'NodeGuard' unveiled

We are releasing NodeGuard, a free inspection service for Node2Shell (CVE-2026-111497). By simply entering the service URL, you can quickly check the likelihood of exposure and immediately see the results and recommended actions.

👉 Go to NodeGuard: https://nodejsguard.io

📌 How to use NodeGuard

• After entering the service URL to be inspected, check the assessment results and recommended actions displayed on the screen

• Domains, subdomains: If there are multiple API endpoints, check each one

• After patching, check again using the same URL to see if the action addressed the vulnerability

*Please use only for services you own and manage directly.

If you need to inspect internal network services or deployment/worker environments that cannot be accessed from outside, please leave a message on the NodeGuard page.

#Nodejs #Node2Shell #CVE2026111497 #NodeGuard #Xint

CW: CVE-2026-111497 — Brotli sérülékenység

Kritikus (CVSS 9.2) memóriahiba a Google Brotli dekóderben (érint: Brotli 1.0.3–1.2.0). Távoli kódfuttatás, adatkiszivárgás és DoS lehetséges. Javítások: Brotli 1.2.1; Node.js 22.23.4/24.22.1/26.12.1; Bun 1.4.4; brotli/brotlicffi 1.2.1. Ha nem tudsz frissíteni: tiltsd a br dekódolást, újraindítás szükséges. #CVE #Brotli #Security #NodeJS #Python https://linuxmint.hu/hir/2026/10/http2shell-kritikus-serulekenyseg-fenyegeti-a-brotli-tomoritest-hasznalo-alkalmazasokat

Oh, interesting:

git https remote (git-remote-https) may be vulnerable to the #brotli RCE (CVE-2026-111497), if built with brotli-enabled libcurl. I'm guessing updating libbrotli would fix that, but that seems like a neat, little attack vector that flies under the radar.

Palo finally published an advisory outlining impact from CVE-2026-111497 in brotli.

https://security.paloaltonetworks.com/CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.

Most importantly:

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls that have inspection of Brotli compressed traffic and TLS/SSL decryption enabled on the dataplane. There is no impact on the Management interface (web or API) of the PAN-OS devices.

Too much coffee, too may CVEs, not enough sleep? Same, tbh. 👉 To bring you this free #Node2Shell scanner, our team worked through the weekend too.

While you scan your target for CVE-2026-111497 (also called #HTTP2Shell), you can also dig into:

☑️ how our active detection works
☑️ what each scan result tells you
☑️ why version-based detection is not enough
☑️ what attackers can do with this vulnerability
☑️ why we're offering this free scanner (and others).

And, before you can scroll twice, you'll have a report like this one ready to share.

Know a colleague, friend, or fellow #infosec or IT who could use this free scanner? Share the URL with them: https://pentest-tools.com/network-vulnerability-scanning/node2shell-scanner

#ethicalhacking #offensivesecurity #vulnerabilitymanagement

PHP has rebuilt official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a memory corruption vulnerability in the Brotli compression library.

The issue can be reached via the cURL extension when automatic HTTP response decompression is enabled.

Affected packages include versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, incorporating Brotli 1.2.1.

Windows users are advised to update from the official downloads page.

https://en.hacks.gr/nea-paketa-php-gia-ta-windows-diorthonoyn-sovaro-provlima-asfaleias/

#PHP #Brotli #Windows #cURL

🚨 PHP releases new Windows builds to fix critical HTTP2Shell vulnerability

The PHP team has rebuilt its supported Windows packages with Brotli 1.2.1, addressing CVE-2026-111497, an out-of-bounds write flaw that can potentially lead to remote code execution.
⠀
In PHP’s Windows builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled.

This cURL feature is disabled by default, but applications and HTTP client libraries can turn it on.
⠀
Updated builds:

• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1
⠀
The “-1” suffix indicates that the Windows packages were rebuilt with updated dependencies. The PHP source and runtime version numbers remain unchanged.

This is separate from the PHP2Shell flaws patched on October 21.

Source: https://www.php.net/archive/2026.php

New.

"As of October 26, 2026, Rapid7 is not aware of exploitation in the wild, and CVE-2026-111497 is not listed in CISA's Known Exploited Vulnerabilities catalog. However, given the vulnerability's potential to disclose memory or enable remote code execution (RCE), Rapid7 recommends that organizations prioritize remediation."

Rapid7: CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/ @Rapid7Official #infosec #vulnerability #JavaScript #threatresearch

🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability

Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint.
⠀
The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution.

It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases.
⠀
Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action.

Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement.
⠀
Node.js users should update to:

• 22.23.4
• 24.22.1
• 26.12.1

The WAF rules are an additional mitigation, not a replacement for patching.

Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release

🚨 Microsoft issues emergency .NET updates after earlier patches failed to fully fix two vulnerabilities

Microsoft says its October 13 updates did not completely address CVE-2026-102870 and CVE-2026-70197, prompting new out-of-band security releases for .NET 8, 9, 10 and 11.
⠀
CVE-2026-102870 is a high-severity remote code execution flaw in the Blazor WebAssembly debugger.

Attacker-controlled data from a debugged application could escape a generated C# string and execute code on a developer’s computer when they evaluate an expression. The vulnerability has a CVSS score of 8.8 and requires user interaction.
⠀
The emergency updates also address:

• CVE-2026-70197, a SocketAsyncEventArgs memory corruption flaw
• CVE-2026-111497, a Brotli decoder out-of-bounds write
• CVE-2026-114148, a Linux source-build tarball ownership issue
⠀
Microsoft warns that updating the shared .NET runtime alone is not enough to fix the Blazor vulnerability when affected NuGet packages are referenced directly.

Developers should update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including version 10.0.14 for .NET 10 projects.

Source: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates

📣 Updated PHP Windows builds are now available:

- PHP 8.2.35-1
- PHP 8.3.36-1
- PHP 8.4.27-1
- PHP 8.5.12-1

‼️ These builds include Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write in Brotli decompression. This vulnerability is in the bundled Brotli library, not PHP code.

📝 Read more: https://www.php.net/archive/2026.php#2026-10-26-1

#PHP #Windows #Release #Security #CVE

Node.js Brotli OOB Write RCE PoC https://github.com/syrex1013/CVE-2026-111497-node2shell

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)

#ZEN #SecDB #InfoSec

The Brotli CVE-2026-111497 vulnerability enables unauthenticated remote code execution across Node.js, Bun, Python, Envoy, and Istio cloud infrastructure.

#Brotli #CVE2026111497 #Node2Shell #Cybersecurity #AppSec

https://meterpreter.org/brotli-cve-2026-111497-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

#Nodejs released #fixes for ten #vulnerabilities, including CVE-2026-111497 in the Brotli decoder enabling remote code execution or disruption. Updates for versions 26.x, 24.x and 22.x are urged; end-of-life versions remain exposed. https://cybernews.com/security/php-node-js-vulnerabilities-patch-exploit/?eicker.news #tech #news #ainews

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws
https://isc.sans.edu/podcastdetail/10150

Oh man, light a candle for #infosec, #sysop, and #ops, cause if you thought the #php #cve was fun, wait till you hear about CVE-2026-111497, AKA as Node2Shell, HTTP2Shell, and Broccoli2Shell, a high-severity out-of-bounds write vulnerability in the Brotli decoder that can permit remote code execution (#RCE). The bug allows data to overwrite memory buffers when a process decompresses untrusted Brotli streams. It was surfaced by #OpenAI’s red team.

Fixed versions were released this weekend, but systems using system-linked Brotli libraries (e.g., Debian, Alpine) must verify their distribution-specific package updates, as the Node.js binary release does not patch those external dependencies.

While researchers from Imperva demonstrated successful code execution on a specific Node.js 24.22.0 Linux arm64 build, no widespread exploitation in the wild has been reported as of October 25, 2026..

https://nvd.nist.gov/vuln/detail/cve-2026-111497

Microsoft's out-of-band .NET security update fixes Brotli flaw CVE-2026-111497 and Linux tarball bug CVE-2026-114148. Update to 8.0.33 or 9.0.22.

#DotNET #Microsoft #Brotli #CVE2026111497 #CVE2026114148 #CVE202670197 #ASPNETCore #CyberSecurity

https://securityonline.info/dotnet-security-update-brotli-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

CW: CVE-2026-111497 — memóriahiba a Google Brotli dekóderében, távoli RCE lehetősége.

Érintett: Node.js (22/24/26 javítva), Bun, Python (brotli/brotlicffi), Envoy/Istio és mások. Frissíts a javított runtime-/library-verzióra, indítsd újra a szolgáltatásokat és építsd újra a konténer-image-eket; ha nem mehetsz frissítéssel, tiltsd a br dekódolást.

https://linuxmint.hu/hir/2026/10/a-nodejs-rce-mogott-allo-brotli-dekoder-hiba-a-bun-t-a-pythont-es-mas-szeles-korben

#security #CVE-2026-111497 #NodeJS #Python #OpenSource

CW: Biztonsági — Imperva bemutatta a "Node2Shell" PoC-t: manipulált Brotli-adat távoli kódfuttatást érhet el a Node.js beépített dekóderében (CVE-2026-111497). Javítások okt.21-én kiadva (pl. 24.22.1). Érintett ágak: 22.x, 24.x, 26.x. Részletek: https://linuxmint.hu/hir/2026/10/kutatok-node2shell-rce-tamadast-mutattak-be-nodejs-build-ellen-manipulalt-brotli-adattal
#NodeJS #Brotli #CVE-2026-111497 #infosec #OpenSource

CW: biztonsági

A Node.js okt.21-i kiadásban egy Brotli dekóderben talált határon túli írás (CVE-2026-111497) távoli kódfuttatást tehet lehetővé minden támogatott ágban (22.x, 24.x, 26.x). Javított verziók: 22.23.4, 24.22.1, 26.12.1. Nincsen átmeneti workaround — frissítés szükséges. #NodeJS #Security #CVE #Brotli #OpenSource

https://linuxmint.hu/hir/2026/10/nodejs-brotli-dekoder-hibaja-tavoli-kodfuttatast-tehet-lehetove-minden-tamogatott

👉 For everyone who started #Node2Shell triage over the weekend, we see you and your huge effort! If you need a hand, we just added detection for CVE-2026-111497 to our Network Scanner, in every paid plan. ( ⏭️ Free trial link below.)

The scan tests if your endpoint decodes Brotli with a vulnerable decoder, so you see reachability (not a version guess). Once it completes, you get a PDF report with: 👇

✅ the finding and the request and response behind it

✅ the fixed release for Node.js, Bun, or Envoy

✅ the CVSS score and severity rating

✅ remediation steps you can hand to whoever owns the fix

❗One thing to check before you call it patched: the runtime hides in more places than your package.json shows. Container base images, Envoy and Istio sidecars, and Python services that use the Brotli or brotlicffi packages all carry their own copy of the decoder.

Need to check every service, rescan after each patch, or document findings for compliance? Start Node2Shell detection with the Network Scanner with a free trial. ⬇️ ⬇️ ⬇️

#Node2Shell details: https://pentest-tools.com/vulnerabilities-exploits/node2shell-brotli-decoder-remote-code-execution_29896

Free Pentest-Tools.com trial: https://app.pentest-tools.com/trial/signup

#offensivesecurity #pentesting #vulnerabilitymanagement #ethicalhacking #cybersecurity

The shit just keeps on coming 😬

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

@offby1 this might be a duplicate, but maybe not?
https://strobes.co/blog/http2shell-brotli-rce-cve-2026-111497/

@jschauma For Debian sid/unstable, there is a patched package in the Bug Tracking System by Salvatore Bonaccorso who is part of the Debian security team; his changes are also in the salsa Git repo).

The bug log seems to indicate that the Debian maintainer doesn't consider there is any hurry for sid. So I downloaded the source package, visually inspected the patch, applied it, verified that the two modified source files were now identical to those from upstream commit b418fa81c48262a86a9 which is referenced at the bottom of the Debian security tracker page for CVE-2026-111497, built the source package and upgraded the relevant binary packages.

To be on the safe side, I also uninstalled libio-compress-brotli-perl which is built from a different source package, although that one is quite possibly not affected by the bug (the package was only recommended by other packages I have installed, not depended on).

"The public PoC's own author states it plainly: the highest verified result is bounded command execution, demonstrated only on a deliberately non-PIE, ASLR-off local harness — not a portable remote exploit."

#node2shell

https://medium.com/@guidancewhite/cve-2026-111497-node2shell-how-brotlis-counter-exhaustion-turned-an-error-into-an-arbitrary-47ded2c7617b

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion: https://news.ycombinator.com/item?id=50219177

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Link: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion: https://news.ycombinator.com/item?id=50219177

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

🚨 Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

#node2shell #brotli #vuln #cybersecurity

@hrbrmstr
Sure is, and thanks!

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929/1

@ntkramer @nikolaydudaev

Ubuntu still considers the #brotli RCE (CVE-2026-111497) as "medium" priority:

https://ubuntu.com/security/CVE-2026-111497

Some other Linuxes:

AlpineLinux: https://security.alpinelinux.org/vuln/CVE-2026-111497

Debian: https://security-tracker.debian.org/tracker/CVE-2026-111497

Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-111497

RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-111497
https://access.redhat.com/security/cve/cve-2026-111497

SuSE: https://www.suse.com/security/cve/CVE-2026-111497.html

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
Link: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Comments: https://news.ycombinator.com/item?id=50219177

🔴 CVE-2026-116207 - Critical (9.1)

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116191 - High (7.5)

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116171 - High (7.5)

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: GitroomHQ postiz-app (2.15.0 – 2.25.2) vulnerable to CVE-2026-115933. Shared secret flaw allows forging of session/invite/reset tokens — risking full account compromise. Restrict access, monitor usage. https://radar.offseq.com/threat/cve-2026-115933-cwe-290-in-gitroomhq-postiz-app-49e726f3e86131f8 #OffSeq #CVE2026115933 #AppSec #Security

🔴 CVE-2026-115933 - Critical (9.9)

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apache Camel fixes eight Apache Camel vulnerabilities, including XXE flaw CVE-2026-90885 and S3 injection CVE-2026-95664. Upgrade to 4.23.0.

#ApacheCamel #XXE #CVE202690885 #CVE202695664 #CVE202694386 #Java #OpenSource #CyberSecurity

https://securityonline.info/apache-camel-vulnerabilities-xxe-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

Go ../ more MCP bullshit.

https://nvd.nist.gov/vuln/detail/cve-2026-93328

sev:CRIT 9.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

New advisory from Fortinet for a critical vulnerability.

CRITICAL: CVE-2026-107656: an authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox https://app.opencve.io/cve/CVE-2026-107656

Yesterday:

CRITICAL: CVE-2026-21643: FortiClientEMS 7.4.4 SQL Injection Enabling Unauthenticated Remote Code Execution https://app.opencve.io/cve/CVE-2026-21643 #Fortinet
-----

Dell:

High-severity, affecting multiple CVEs: Security Update for Multiple Dell Client Platform BIOS Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000502180/dsa-2026-373

Security Update for Dell Client Platform BIOS for Multiple AMI BIOS Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000516289/dsa-2026-230-security-update-for-dell-client-platform-bios-for-multiple-ami-bios-vulnerabilities

Security Update for Dell PowerScale OneFS Multiple Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000505684/dsa-2026-360-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities #Dell #infosec #vulnerability

CVE-2026-107900: FUJI ELECTRIC/Hakko V-SFT (≤6.2.11.0) has a HIGH severity out-of-bounds read in VS6ComFile!CCheck::ItemCheck. Crafted V7 files may cause info disclosure or code execution. Avoid untrusted files. https://radar.offseq.com/threat/cve-2026-107900-out-of-bounds-read-in-fuji-electric-co-ltd-hakko-electronics-co-ltd-v-sft-fc586c6c5117dc99 #OffSeq #ICS #Vulnerability

🟠 CVE-2026-116177 - High (7.5)

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-110956 - Critical (9.8)

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110956/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-116234 in Oray Pugongying X5 Pro 7.6.1 allows remote CRLF injection via 'secproto' in IPsec Policy Handler. Public exploit exists, no patch from vendor. Restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-116234-crlf-injection-in-oray-pugongying-x5-pro-84e430f291e3bea4 #OffSeq #Cybersecurity #CVE #NetworkSecurity

CVE-2026-115995 (CRITICAL): Unitree Go2 <1.1.11.5 has remote OS command injection in chat_go/set_volume (gpt_thread.py). Remote attackers could fully compromise systems. Upgrade to 1.1.11.5 ASAP. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-unitree-robotics-unitree-go2-up-to-11114-cve-2026-115995-64c6c5b520bc3457 #OffSeq #CVE #Infosec #Robotics

CVE-2026-115995 (CRITICAL, CVSS 9.4): OS command injection in Unitree Go2 (1.1.11.0 – 1.1.11.4) enables remote code execution via set_volume in chat_go. Upgrade to 1.1.11.5 to remediate. https://radar.offseq.com/threat/cve-2026-115995-os-command-injection-in-unitree-robotics-unitree-go2-28735a7dafc55240 #OffSeq #CVE2026115995 #Robotics #Vuln

🔴 CVE-2026-115995 - Critical (9.6)

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os comm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-115251: Duplicator WordPress plugin (v1.5.17 – <5.0.0) HIGH severity. Multisite child admins can execute arbitrary PHP code in the shared plugin dir — network-wide risk. Restrict admin access & monitor usage. https://radar.offseq.com/threat/cve-2026-115251-cwe-269-improper-privilege-management-in-duplicator-a398971080f44e92 #OffSeq #WordPress #Infosec #Vuln

CVE-2026-116237: CRITICAL CRLF injection in Oray Pugongying X5 Pro 7.6.1 (Dnsmasq). Remote attackers can exploit public PoC; no vendor patch. Apply network filtering & monitor for updates. https://radar.offseq.com/threat/cve-2026-116237-crlf-injection-in-oray-pugongying-x5-pro-52f065cc5bfd9b94 #OffSeq #CVE2026116237 #Vuln #Infosec

CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.

#PHP2Shell #CISAKEV #PHP #CVE2026109618 #CVE2026109619 #Lazarus #ExploitedInTheWild #CyberSecurity

https://securityonline.info/php2shell-cisa-kev-confirmed-rce-dprk/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1026] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-109618 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- Name: PHP Memory Corruption Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618

⚠️ CVE-2026-109619 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- Name: PHP Stale Internal Request-State Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261026 #cisa20261026 #cve_2026_109618 #cve_2026_109619 #cve2026109618 #cve2026109619

🚨 NEW on CISA KEV — exploited in the wild

🛡 PHP Group PHP
PHP Memory Corruption Vulnerability
CVE: CVE-2026-109618 · patch by 2026-10-29
📈 EPSS 100.0% exploitation probability

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-109618
#cybersecurity #KEV #CVE #infosec

CISA found enough evidence to add both php2shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to the KEV Catalog.

https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

#php2shell #php #CISA #KEV

CVE ID: CVE-2026-109618
Vendor: PHP Group
Product: PHP
Date Added: 2026-10-26
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109618

🐧 SIGINT // Ubuntu Watch — 2026-10-27

Two PHP CVEs, and this is the one with actual commands. It covers Ubuntu, Debian, Docker and panels, plus the lagging-mirror trap: check apt-cache policy php8.3-fpm before assuming you're patched. Docker images need a rebuild, not just apt upgrade.

🔗 https://massivegrid.com/blog/how-to-patch-php-cve-2026-109618-109619-every-platform/

#Ubuntu #Linux #infosec

CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.

#PHP2Shell #CISAKEV #PHP #CVE2026109618 #CVE2026109619 #Lazarus #ExploitedInTheWild #CyberSecurity

https://securityonline.info/php2shell-cisa-kev-confirmed-rce-dprk/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1026] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-109618 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- Name: PHP Memory Corruption Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618

⚠️ CVE-2026-109619 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- Name: PHP Stale Internal Request-State Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261026 #cisa20261026 #cve_2026_109618 #cve_2026_109619 #cve2026109618 #cve2026109619

CISA found enough evidence to add both php2shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to the KEV Catalog.

https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

#php2shell #php #CISA #KEV

CVE ID: CVE-2026-109618
Vendor: PHP Group
Product: PHP
Date Added: 2026-10-26
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109618

"no public exploit works reliably on a default PHP setup yet"

#php #cybersecurity

PHP2Shell in the Wild: 1,187 IPs, No Mass Exploitation Yet

https://www.crowdsec.net/vulntracking-report/cve-2026-109618-php2shell-no-mass-exploitation-yet

⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR constate des tentatives d'exploitation des vulnérabilités CVE-2026-109618 et CVE-2026-109619 ciblant des déploiements spécifiques de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/

Confirmed exploitation of CVE-2026-109618? It might only be a honeypot but I would be cautious of 15.204.59[.]70 and 162.35.99[.]94

https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md

#IOC #php2shell #php #eitw #threatintel

Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches available now. https://security.paloaltonetworks.com/CVE-2026-109618

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the...

🔗️ [Bleepingcomputer] https://link.is.it/ZnvB1A

🔎 NEXUS8 WEEKLY DIGEST · 👤 THREAT ACTOR

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named…

Also tracked this week: Stolen UpdraftCentral keys used to backdoor WordPress sites · GitLab warns of new max severity…

https://nexus8.8bitsecurity.com/entity/signal_event-12861123

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)

#ZEN #SecDB #InfoSec

Palo Alto retracts claim of PHP2Shell exploitation at European government agency

This is my shocked face.

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

"Black October 2026" marks critical cybersecurity events, including the AI-assisted discovery of PHP2Shell vulnerabilities (CVE-2026-109618/109619) leading to global government website shutdowns and emergency patching (Oct 21). Oracle Health also reported a breach impacting 20M patients. Geopolitically, the US reduced embassy staff in four Middle Eastern nations (Jordan, Lebanon, Qatar, UAE) amid escalating threats (Oct 24).
#AnonNews_irc #Cybersecurity #News

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

Palo Alto Networks Repor Critical PHP2Shell Flaws Affecting PAN-OS Management Interfaces

Palo Alto Networks confirms vulnerability of the management interface of PAN-OS devices to two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution.

**If you run Palo Alto firewalls or Panorama, make sure the management interface is never reachable from the internet and can be accessed only from trusted internal networks or a single jump box. Then check your version (`show system info`) and install the fixed PAN-OS hotfix for your branch as soon as it is released this week to patch CVE-2026-109618 and CVE-2026-109619.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/palo-alto-networks-repor-critical-php2shell-flaws-affecting-pan-os-management-interfaces-d-d-k-0-t/gD2P6Ple2L

PHP2Shell: What Is Easy and What Is Hard to Exploit

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of pre-authentication RCE flaws in PHP's request parser, reachable through any PHP endpoint on default configs (session upload progress and file uploads). Crashing a worker is trivial but reliable code execution needs per-build memory offsets. The problem is that one calibrated exploit works on every identical stock image like default docker images.

**If your website or application runs on PHP, update right now to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all PHP and web server workers, because a patched server with old workers still running is still vulnerable. If you can't patch immediately, set `session.upload_progress.enabled = Off` as a temporary stopgap (it blocks only one of the two attack paths), restart all workers, and watch your logs for memory errors, crashes and web processes starting shells, since a successful attack can look like a perfectly normal request.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/obstacles-to-weaponizing-php2shell-likely-constrain-immediate-widespread-exploitation-0-3-u-e-l/gD2P6Ple2L

If you are looking for detection rules for recent vulnerabilities, you can use rulezet

https://rulezet.org/vulnerability/CVE-2026-109618

It's pretty nifty.

#rulezet #opensource #opendata #cybersecurity #detectionengineering

PHP, nuova vulnerabilità RCE: rischio circoscritto e mitigazione disponibile

A pochi giorni dal rilascio delle correzioni per le vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il PHP Security Team ha comunicato il...

🔗️ [Cert-agid] https://link.is.it/fRRlPN

CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.

#PHP2Shell #CISAKEV #PHP #CVE2026109618 #CVE2026109619 #Lazarus #ExploitedInTheWild #CyberSecurity

https://securityonline.info/php2shell-cisa-kev-confirmed-rce-dprk/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1026] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-109618 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- Name: PHP Memory Corruption Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618

⚠️ CVE-2026-109619 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- Name: PHP Stale Internal Request-State Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261026 #cisa20261026 #cve_2026_109618 #cve_2026_109619 #cve2026109618 #cve2026109619

🚨 NEW on CISA KEV — exploited in the wild

🛡 PHP Group PHP
PHP Stale Internal Request-State Vulnerability
CVE: CVE-2026-109619 · patch by 2026-10-29
📈 EPSS 100.0% exploitation probability

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-109619
#cybersecurity #KEV #CVE #infosec

CISA found enough evidence to add both php2shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to the KEV Catalog.

https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

#php2shell #php #CISA #KEV

CVE ID: CVE-2026-109619
Vendor: PHP Group
Product: PHP
Date Added: 2026-10-26
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109619

CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected DPRK-linked scanning.

#PHP2Shell #CISAKEV #PHP #CVE2026109618 #CVE2026109619 #Lazarus #ExploitedInTheWild #CyberSecurity

https://securityonline.info/php2shell-cisa-kev-confirmed-rce-dprk/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1026] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-109618 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- Name: PHP Memory Corruption Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618

⚠️ CVE-2026-109619 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- Name: PHP Stale Internal Request-State Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PHP Group
- Product: PHP
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261026 #cisa20261026 #cve_2026_109618 #cve_2026_109619 #cve2026109618 #cve2026109619

CISA found enough evidence to add both php2shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to the KEV Catalog.

https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

#php2shell #php #CISA #KEV

CVE ID: CVE-2026-109619
Vendor: PHP Group
Product: PHP
Date Added: 2026-10-26
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109619

⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR constate des tentatives d'exploitation des vulnérabilités CVE-2026-109618 et CVE-2026-109619 ciblant des déploiements spécifiques de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the...

🔗️ [Bleepingcomputer] https://link.is.it/ZnvB1A

🔎 NEXUS8 WEEKLY DIGEST · 👤 THREAT ACTOR

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named…

Also tracked this week: Stolen UpdraftCentral keys used to backdoor WordPress sites · GitLab warns of new max severity…

https://nexus8.8bitsecurity.com/entity/signal_event-12861123

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)

#ZEN #SecDB #InfoSec

Palo Alto retracts claim of PHP2Shell exploitation at European government agency

This is my shocked face.

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

Palo Alto Networks Repor Critical PHP2Shell Flaws Affecting PAN-OS Management Interfaces

Palo Alto Networks confirms vulnerability of the management interface of PAN-OS devices to two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution.

**If you run Palo Alto firewalls or Panorama, make sure the management interface is never reachable from the internet and can be accessed only from trusted internal networks or a single jump box. Then check your version (`show system info`) and install the fixed PAN-OS hotfix for your branch as soon as it is released this week to patch CVE-2026-109618 and CVE-2026-109619.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/palo-alto-networks-repor-critical-php2shell-flaws-affecting-pan-os-management-interfaces-d-d-k-0-t/gD2P6Ple2L

PHP2Shell: What Is Easy and What Is Hard to Exploit

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of pre-authentication RCE flaws in PHP's request parser, reachable through any PHP endpoint on default configs (session upload progress and file uploads). Crashing a worker is trivial but reliable code execution needs per-build memory offsets. The problem is that one calibrated exploit works on every identical stock image like default docker images.

**If your website or application runs on PHP, update right now to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all PHP and web server workers, because a patched server with old workers still running is still vulnerable. If you can't patch immediately, set `session.upload_progress.enabled = Off` as a temporary stopgap (it blocks only one of the two attack paths), restart all workers, and watch your logs for memory errors, crashes and web processes starting shells, since a successful attack can look like a perfectly normal request.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/obstacles-to-weaponizing-php2shell-likely-constrain-immediate-widespread-exploitation-0-3-u-e-l/gD2P6Ple2L

PHP, nuova vulnerabilità RCE: rischio circoscritto e mitigazione disponibile

A pochi giorni dal rilascio delle correzioni per le vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il PHP Security Team ha comunicato il...

🔗️ [Cert-agid] https://link.is.it/fRRlPN

Apache Camel fixes eight Apache Camel vulnerabilities, including XXE flaw CVE-2026-90885 and S3 injection CVE-2026-95664. Upgrade to 4.23.0.

#ApacheCamel #XXE #CVE202690885 #CVE202695664 #CVE202694386 #Java #OpenSource #CyberSecurity

https://securityonline.info/apache-camel-vulnerabilities-xxe-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-99083 - High (8.8)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerbero...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99083/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Yoosee GM8135S Camera v21.00.01.36 faces CRITICAL risk (CVE-2026-116116): improper cryptographic signature verification in Secure Boot. Local, privileged access required. No patch; public exploit exists. Mitigate access. https://radar.offseq.com/threat/cve-2026-116116-improper-verification-of-cryptographic-signature-in-yoosee-gm8135s-camera-2ebc37c26530cbf4 #OffSeq #CVE2026116116 #IoTSec

Incorrect default permissions (CVE-2026-113345, HIGH, CVSS 7.8) in Japan MLIT's Inspection Support System let local users alter app files, risking code execution. No patch yet — restrict access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-113345-incorrect-default-permissions-in-ministry-of-land-infrastructure-transport-and-tourism-b1dd0c4094dd454d #OffSeq #vuln #infosec #japan

🚨 Microsoft issues emergency .NET updates after earlier patches failed to fully fix two vulnerabilities

Microsoft says its October 13 updates did not completely address CVE-2026-102870 and CVE-2026-70197, prompting new out-of-band security releases for .NET 8, 9, 10 and 11.
⠀
CVE-2026-102870 is a high-severity remote code execution flaw in the Blazor WebAssembly debugger.

Attacker-controlled data from a debugged application could escape a generated C# string and execute code on a developer’s computer when they evaluate an expression. The vulnerability has a CVSS score of 8.8 and requires user interaction.
⠀
The emergency updates also address:

• CVE-2026-70197, a SocketAsyncEventArgs memory corruption flaw
• CVE-2026-111497, a Brotli decoder out-of-bounds write
• CVE-2026-114148, a Linux source-build tarball ownership issue
⠀
Microsoft warns that updating the shared .NET runtime alone is not enough to fix the Blazor vulnerability when affected NuGet packages are referenced directly.

Developers should update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including version 10.0.14 for .NET 10 projects.

Source: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates

🟠 CVE-2026-116199 - High (8.1)

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: grokability Snipe-IT (<8.6.3) suffers improper auth in GoogleAuthController (CVE-2026-116199). Deactivated users can regain admin via Google SSO. Patch to 8.6.3+ now. https://radar.offseq.com/threat/cve-2026-116199-improper-authorization-in-grokability-snipe-it-c10467b7c5886087 #OffSeq #CVE2026116199 #SnipeIT #Vuln

🟠 CVE-2026-116211 - High (8.2)

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116180 - High (7.7)

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116183 - High (7.5)

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116176 - High (8.2)

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116201 - High (8.8)

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116204 - High (8.1)

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116189 - High (7.5)

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116189/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116179 - High (7.5)

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116149 - High (8.1)

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116208 - High (8.1)

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cros...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116067 - High (8.2)

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-116067 – HIGH severity path traversal in ananthakumaran paisa (<0.7.8). Unauthenticated attackers can read files & delete backups via crafted '../' filenames. Upgrade to 0.7.8+ ASAP. https://radar.offseq.com/threat/cve-2026-116067-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-001c746719f461d8 #OffSeq #PathTraversal #Security #CVE2026_116067

🟠 CVE-2026-116068 - High (8.8)

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnviro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116068/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-115557 (CRITICAL): Python CPython ssl module accepted compromised certs when revocation was misconfigured. Fix: versions >3.16.0 auto-reject known bad certs via denylist. Patch now. https://radar.offseq.com/threat/cve-2026-115557-cwe-299-improper-check-for-certificate-revocation-in-python-software-foundation-cpython-fb92d56c9f38c582 #OffSeq #Python #CVE #SSL #AppSec

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Last week it was #PHP, this week we start with some nice #Java patch day it seems...

https://nvd.nist.gov/vuln/detail/cve-2026-114820

Oracle Java SE & GraalVM are vulnerable (CVE-2026-114820, CRITICAL, CVSS 9.1). Remote attackers can access & modify critical data via multiple network protocols. Update to the latest versions now. Details: https://radar.offseq.com/threat/cve-2026-114820-easily-exploitable-vulnerability-allows-unauthenticated-attacker-with-network-access-f9ee4fd5c21dce72 #OffSeq #JavaSecurity #CVE2026114820

CVE-2026-114820: CRITICAL vuln (CVSS 9.1) in Oracle Java SE & GraalVM (multiple supported versions) allows remote, unauthenticated attackers to access/modify critical data via JSSE APIs. Patch immediately. https://radar.offseq.com/threat/vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle-graalvm-enterprise-edition-cve-2026-dae362ae45879d06 #OffSeq #Java #Oracle #Vuln

🔴 CVE-2026-114820 - Critical (9.1)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-114820/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99054 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tipc: destroy topsrv workqueues before closing connections

tipc_topsrv_stop() closed subscriber connections while the topology
server's send and receive workqueues were still ru...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99016 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

riscv: futex: untag the user pointer before the atomic access

access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()
and futex_atomic_cmpxchg_inatomic() hand...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99016/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99014 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
address used for the PA_LINK lookup from hci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99032 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net/smc: protect clcsock lifetime in smc_getname

smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99046 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak on error descriptor

When the error bit is set in the RX completion descriptor, the buf_state
and its attached buffer should be freed. In the case of AF_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-99078 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99030 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99051 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

fsverity: RCU-delay the freeing of struct fsverity_info

__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses
rcu_read_lock() and doesn't directly synchronize wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99064 - High (8.1)

In the Linux kernel, the following vulnerability has been resolved:

cipso: adjust cached option offsets when removing CIPSO

cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.

For e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99082 - High (8.8)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use active memslots for the per-vCPU MMIO cache

KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-99079 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on refill retry

When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99042 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

io_connect_bpf_populate() fills connect.port and connect.v6_addr for
AF_INET6 only when addr_len >= sizeof(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99056 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

strparser: make sure __strp_recv isn't running before tearing down the parser

The comment above strp_done() claims that if strp is stopped,
strp_recv will no longer be called. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99081 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: fix DMA mapping length for padded small packets

Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99059 - High (7.7)

In the Linux kernel, the following vulnerability has been resolved:

wireguard: noise: reject response consumption after intermediate initiation

Two threads begin processing the identical response message, received
twice. The first thread, A, run...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99053 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tipc: hold a reference to nodes found by link name

tipc_node_find_by_name() returns a node after dropping its RCU read lock
without taking a reference. The LINK_SET, LINK_GET a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99050 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix race when arming the IRQ poll worker

gpio_mpsse_irq_enable() arms the poll worker before publishing it:
schedule_work() runs before the worker is added to priv-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99050/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99018 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel
shadow call stack pointer (gp) only when...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99013 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Reject concurrent BIS listener setup

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50056 - High (7.8)

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115810 - High (7.7)

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115810/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57845 - High (8.8)

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Okta Patches Command Injection and Authentication Bypass in Access Gateway

Okta released security updates for Access Gateway to fix a command injection flaw (CVE-2026-115547) and an authentication bypass (CVE-2026-115546) that allow attackers to take full control of the appliance. The updates also address two remote code execution vulnerabilities in the PHP runtime used by the gateway.

**If you run Okta Access Gateway, upgrade it to version 2026.10.2 or later to fix the admin takeover flaws, and install version 2026.44.0 to fix the PHP flaws. Make sure the Admin Console can only be reached from trusted internal IP addresses, and check for any unexpected admin logins or configuration changes.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/okta-patches-command-injection-and-authentication-bypass-in-access-gateway-r-q-6-8-m/gD2P6Ple2L

Rapid7 disclosed 17 Zimbra Collaboration Suite flaws, including CVE-2026-10632 and CVE-2026-93640, allowing XSS and root privilege escalation.

#Zimbra #Rapid7 #EmailSecurity #PrivilegeEscalation #XSS #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/zimbra-collaboration-suite-vulnerabilities-rapid7/?utm_source=mastodon&utm_medium=jetpack_social

Rapid7 disclosed 17 Zimbra Collaboration Suite flaws, including CVE-2026-10632 and CVE-2026-93640, allowing XSS and root privilege escalation.

#Zimbra #Rapid7 #EmailSecurity #PrivilegeEscalation #XSS #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/zimbra-collaboration-suite-vulnerabilities-rapid7/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-50057 - High (7.8)

A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50057/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Rapid7 disclosed 17 Zimbra Collaboration Suite flaws, including CVE-2026-10632 and CVE-2026-93640, allowing XSS and root privilege escalation.

#Zimbra #Rapid7 #EmailSecurity #PrivilegeEscalation #XSS #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/zimbra-collaboration-suite-vulnerabilities-rapid7/?utm_source=mastodon&utm_medium=jetpack_social

Rapid7 disclosed 17 Zimbra Collaboration Suite flaws, including CVE-2026-10632 and CVE-2026-93640, allowing XSS and root privilege escalation.

#Zimbra #Rapid7 #EmailSecurity #PrivilegeEscalation #XSS #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/zimbra-collaboration-suite-vulnerabilities-rapid7/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-10632 - High (8.7)

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10632/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106765 - High (7.5)

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Okta Patches Command Injection and Authentication Bypass in Access Gateway

Okta released security updates for Access Gateway to fix a command injection flaw (CVE-2026-115547) and an authentication bypass (CVE-2026-115546) that allow attackers to take full control of the appliance. The updates also address two remote code execution vulnerabilities in the PHP runtime used by the gateway.

**If you run Okta Access Gateway, upgrade it to version 2026.10.2 or later to fix the admin takeover flaws, and install version 2026.44.0 to fix the PHP flaws. Make sure the Admin Console can only be reached from trusted internal IP addresses, and check for any unexpected admin logins or configuration changes.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/okta-patches-command-injection-and-authentication-bypass-in-access-gateway-r-q-6-8-m/gD2P6Ple2L

Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.

#Ruby #Onigmo #GitLab #CVE2026110264 #CVE202697229 #CVE202689078 #RCE #CyberSecurity

https://securityonline.info/ruby-security-update-onigmo-gitlab-cves/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

CW: technikai sebezhetőség

Ruby 4.0.9, 3.4.12 és 3.3.13 javít három Onigmo regex-motort érintő hibát, amelyek négy kritikus GitLab RCE-hez vezettek (pl. CVE-2026-110264, CVE-2026-97229). Érintett: ha támadó-vezérelt sztringből fordítasz Regexp.new/union/compile vagy /#{input}/-et. Ideiglenes védelem: ne fordíts megbízhatatlan bemenetet; Regexp.timeout vagy mintahossz nem elég. Részletek: https://linuxmint.hu/hir/2026/10/harom-regexmotor-hibat-javitott-a-ruby-negy-kritikus-gitlab-rce-sebezhetoseget-okoztak

#Ruby #GitLab #CVE #InfoSec #OpenSource

CW: security

Kritikus, hitelesítés nélküli RCE a GitLabban — CVE-2026-110264 (CVSS 10.0). Érint minden saját üzemeltetésű kiadást 7.0 óta. Frissítsetek a javított kiadásokra: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 vagy 18.11.13. GitLab.com és Dedicated már kapta a javítást. Részletek: https://linuxmint.hu/hir/2026/10/kritikus-gitlab-sebezhetoseg-cvss-100-hitelesites-nelkuli-rce-t-tehet-lehetove-12-evnyi

#GitLab #CVE2026 #infosec #OpenSource

Nyolc eMudhra köztes CA privát kulcsa kompromittálódott. Chrome és Firefox gyorsan blokkolta a tanúsítványokat; Go (CVE-2026-111943), Firefox (CVE-2026-113470), certifi, NSS, webpki-roots, Homebrew stb. javítások már kiadva. Ha saját trust store-od van vagy cert bundle-t használsz, ellenőrizd a frissítéseket. https://linuxmint.hu/hir/2026/10/nyolc-emudhra-ca-kulcs-kompromittalodott-veszhelyzeti-javitasok-indultak-a-bongeszokben #Security #TLS #OpenSource #Linux #CVE

Storybook dev server vulnerability CVE-2026-114125 (CVSS 9.4) enables code injection from malicious websites. Upgrade to 10.6.2, 9.1.21 or 8.6.19.

#Storybook #CVE2026114125 #CodeInjection #JavaScript #npm #DevSecOps #SupplyChain #CyberSecurity

https://securityonline.info/storybook-dev-server-vulnerability-cve-2026-114125/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

FortiSIEM vulnerability CVE-2026-106173 is exploited in the wild after Horizon3 released details and a PoC exploit. Upgrade to 7.5.1 now.

#FortiSIEM #Fortinet #CVE2026106173 #ExploitedInTheWild #PoC #RCE #Horizon3 #CyberSecurity

https://securityonline.info/fortisiem-cve-2026-106173-exploited-poc/?utm_source=mastodon&utm_medium=jetpack_social

🚨 PoC published for a critical unauthenticated Fortinet FortiSIEM remote code execution vulnerability; CVE-2026-106173

PoC: https://github.com/horizon3ai/CVE-2026-106173

The flaw affects FortiSIEM's gRPC QueryResultReq handler. Improper validation of attacker-controlled metadata allows path traversal and arbitrary file writes, which can be chained into remote code execution by overwriting files that are later executed by the system.

CVSS: 9.4 Critical
Affected: FortiSIEM 7.0.0 through 7.5.0 across multiple release branches
Fixed: FortiSIEM 7.5.1 or 7.6.0 and later

The PoC targets the exposed gRPC service on TCP/27918 and demonstrates blind command execution through the arbitrary file-write chain.

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)

#ZEN #SecDB #InfoSec

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)

#ZEN #SecDB #InfoSec

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)

#ZEN #SecDB #InfoSec

📈 CVE Published in last 7 days (2026-10-19 - 2026-10-19)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 314
- High: 1367
- Medium: 1422
- Low: 307
- None: 503

Status:
- : 43
- Analyzed: 239
- Awaiting Analysis: 1494
- Deferred: 941
- Modified: 1
- Received: 780
- Rejected: 117
- Undergoing Analysis: 298

CISA KEVs:
- CISA-2026:1020 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1020)
- CISA-2026:1023 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

Top CNAs:
- Oracle: 1078
- VulnCheck: 457
- Chrome: 353
- GitHub, Inc.: 290
- kernel.org: 220
- VulDB: 202
- Apache Software Foundation: 150
- Apple Inc.: 134
- WPScan: 128
- Patchstack: 91

Top Affected Products:
- UNKNOWN: 3233
- Google Chrome: 178
- Oracle Mysql Cluster: 62
- Oracle Mysql Server: 60
- Oracle Essbase: 36
- Oracle Java Se: 35
- Oracle Siebel Crm Deployment: 29
- Oracle Graalvm: 25
- Oracle Graalvm for Jdk: 22
- Oracle Outside In Technology: 16

Top EPSS Score:
- CVE-2026-109619 - 100.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619)
- CVE-2026-109618 - 99.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618)
- CVE-2026-111497 - 32.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111497)
- CVE-2026-112195 - 4.13 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112195)
- CVE-2026-113802 - 3.47 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113802)
- CVE-2026-103038 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-103038)
- CVE-2026-113506 - 2.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113506)
- CVE-2026-113391 - 2.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-113391)
- CVE-2026-112301 - 2.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112301)
- CVE-2026-112370 - 2.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112370)