CVE-2026-103963 – HIGH severity in Red Hat Enterprise Linux 10: glib-networking allows unlimited TLS 1.3 session tickets, enabling DoS via memory exhaustion. Monitor memory use & review trusted hosts. Details: https://radar.offseq.com/threat/cve-2026-103963-uncontrolled-resource-consumption-in-red-hat-red-hat-enterprise-linux-10-6028f0ba6dede73c #OffSeq #Linux #Vuln #DoS

CVE-2026-103963 – HIGH severity in Red Hat Enterprise Linux 10: glib-networking allows unlimited TLS 1.3 session tickets, enabling DoS via memory exhaustion. Monitor memory use & review trusted hosts. Details: https://radar.offseq.com/threat/cve-2026-103963-uncontrolled-resource-consumption-in-red-hat-red-hat-enterprise-linux-10-6028f0ba6dede73c #OffSeq #Linux #Vuln #DoS

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868.

#WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/?utm_source=mastodon&utm_medium=jetpack_social

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868.

#WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-90717 - Critical (9.1)

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90717/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868.

#WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/?utm_source=mastodon&utm_medium=jetpack_social

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868.

#WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/?utm_source=mastodon&utm_medium=jetpack_social

Chrome 156 security update 156.0.8078.79 fixes 21 flaws, including critical Chrome vulnerability CVE-2026-76024 in MediaStream. Update now.

#Chrome #GoogleChrome #Chrome156 #BrowserSecurity #CVE202676024 #SecurityUpdate #PatchNow #Vulnerability

https://securityonline.info/chrome-156-security-update-156-0-8078-79/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76024: CRITICAL Chrome MediaStream memory corruption vuln lets remote attackers read sandboxed memory. Update Chrome to 156.0.8078.79+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-76024-memory-corruption-in-google-chrome-8c5b94159c077f18 #OffSeq #Vuln #GoogleChrome #AppSec

Chrome 156 security update 156.0.8078.79 fixes 21 flaws, including critical Chrome vulnerability CVE-2026-76024 in MediaStream. Update now.

#Chrome #GoogleChrome #Chrome156 #BrowserSecurity #CVE202676024 #SecurityUpdate #PatchNow #Vulnerability

https://securityonline.info/chrome-156-security-update-156-0-8078-79/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76024: CRITICAL Chrome MediaStream memory corruption vuln lets remote attackers read sandboxed memory. Update Chrome to 156.0.8078.79+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-76024-memory-corruption-in-google-chrome-8c5b94159c077f18 #OffSeq #Vuln #GoogleChrome #AppSec

Critical TCP use-after-free: CVE-2026-98432

Linux 커널의 IPv4 TCP 핸드셰이크에서 발생하는 사용 후 해제 취약점 CVE-2026-98432는 인증 없는 원격 공격에 악용될 수 있으며, 커널 CVE 팀은 CVSS 9.8점을 부여했다. 배포판 업체들은 경쟁 상태의 악용 난이도가 높다며 더 낮게 평가했지만, Anthropic은 MPTCP 리스너를 대상으로 AI가 작성한 원격 루트 명령 실행 익스플로잇을 시연했다고 주장했다. 2026년 10월 29일 기준 일부 배포판에는 패치가 출시됐으나 RHEL과 Ubuntu는 아직 수정 중이며, 실제 악용 사례는 보고되지 않았다. AI 인프라 운영자...

https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now

Wir sind schon fast 12 Stunden nicht mehr panisch durcheinandergerannt und haben vom Ende der menschlichen Zivilisation schwadroniert. Diesmal ist es CVE-2026-98432, ein von Anthropic gefundener, von NIST mit 9.8 eingestufter Fehler im TCP-Stack des Linux-Kernels, der remote code execution ermöglicht. Uneins sind sich die Fachleute allerdings bei der Frage der Kritikalität.
https://www.cve.org/CVERecord?id=CVE-2026-98432
https://www.cyberkendra.com/2026/10/cve-2026-98432-linux-kernel-tcp-flaw-ubuntu-rhel.html
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
https://ivanivanov.de/blog/linux-kernel-tcp-luecke-cve-2026-98432-use-after-free/
https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation - https://www.penligent.ai/hackinglabs/cve-2026-98432/

#hackernews

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

https://www.penligent.ai/hackinglabs/cve-2026-98432/

Comments: https://news.ycombinator.com/item?id=50299182

#HackerNews

SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158

First attempt at using EBPF to block CVE-2026-98432 seems to work....

https://github.com/paulwouters/block_cve_2026_98432

C'mon.. we seriously cannot catch a break

https://www.cve.org/CVERecord?id=CVE-2026-98432

https://ubuntu.com/security/CVE-2026-98432

Is there any actual info on CVE-2026-98432 that's not slop? What configurations are affected, how to mitigate, etc.?

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-98432/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-98432/

"No way to prevent this" say u...

https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now

🐧 SIGINT // Ubuntu Watch — 2026-10-30

A critical TCP use-after-free in the kernel with no fixed Ubuntu or RHEL kernels yet. Anything internet-facing is exposed, so tighten firewall exposure, trim open ports, and watch USN feeds for the kernel update. Reboot windows should be planned now, not after the patch lands.

🔗 https://www.cyberkendra.com/2026/10/cve-2026-98432-linux-kernel-tcp-flaw-ubuntu-rhel.html

#Ubuntu #Linux #infosec

Wir sind schon fast 12 Stunden nicht mehr panisch durcheinandergerannt und haben vom Ende der menschlichen Zivilisation schwadroniert. Diesmal ist es CVE-2026-98432, ein von Anthropic gefundener, von NIST mit 9.8 eingestufter Fehler im TCP-Stack des Linux-Kernels, der remote code execution ermöglicht. Uneins sind sich die Fachleute allerdings bei der Frage der Kritikalität.
https://www.cve.org/CVERecord?id=CVE-2026-98432
https://www.cyberkendra.com/2026/10/cve-2026-98432-linux-kernel-tcp-flaw-ubuntu-rhel.html
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
https://ivanivanov.de/blog/linux-kernel-tcp-luecke-cve-2026-98432-use-after-free/
https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

https://www.penligent.ai/hackinglabs/cve-2026-98432/

Comments: https://news.ycombinator.com/item?id=50299182

#HackerNews

SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158

First attempt at using EBPF to block CVE-2026-98432 seems to work....

https://github.com/paulwouters/block_cve_2026_98432

C'mon.. we seriously cannot catch a break

https://www.cve.org/CVERecord?id=CVE-2026-98432

https://ubuntu.com/security/CVE-2026-98432

Is there any actual info on CVE-2026-98432 that's not slop? What configurations are affected, how to mitigate, etc.?

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-98432/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-98432/

"No way to prevent this" say u...

https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now

CVE-2026-98432 is apparently a remote code execution in the Linux kernel triggerable via network (rather IPv4).

According to Anthropic [1]:

> In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution.

Well, here is your "remediation" then:

echo '*/30 * * * * root /sbin/reboot' > /etc/cron.d/nice-try-NSA

[1] https://www.anthropic.com/research/discovering-vulnerabilities-with-claude

🚨 Critical Linux kernel TCP flaw enables remote root code execution; CVE-2026-98432

A race condition in the Linux kernel’s IPv4 TCP implementation can trigger a use-after-free before application authentication, potentially allowing an unauthenticated remote attacker to leak kernel memory, corrupt memory or crash the system.

Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root against Linux servers with a Multipath TCP listener. The exploit took approximately 53 minutes to complete during testing and has not been publicly released.
⠀
• CVSS: 9.8 Critical, according to the Linux kernel CVE team
• Affected: Linux kernels beginning with version 4.4
• Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3
• Attack requirements: Network access, no credentials and no user interaction
• Exploitation status: No known attacks in the wild
⠀
Ubuntu and Red Hat Enterprise Linux had not released corrected kernel packages as of October 29. Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for at least some affected branches.

Distribution severity ratings differ substantially. Red Hat rates the flaw 5.9 because it considers the race difficult to win and describes denial of service as the most likely practical impact.

Source: https://lists.openwall.net/linux-cve-announce/2026/10/15/1

https://www.cve.org/CVERecord?id=CVE-2026-98432

This is bad, right, like *real* bad?

Is there an exploit for it in use yet?

CVE-2026-98432: Linux Kernel TCP Use-After-Free and the AI-Built Root Exploit

https://thecybersecguru.com/exploits/cve-2026-98432-linux-kernel-tcp-use-after-free/

CVE-2026-98432 | Ubuntu https://ubuntu.com/security/CVE-2026-98432#impact-score

Ich hab mir das hier angeschaut und finde erstaunlich wenig handfeste Information dazu (die Seite hat auch kein Datum?): https://security-tracker.debian.org/tracker/CVE-2026-98432

Severity Score 9,8 (lt. #Ubuntu Security jedenfalls) ist ja schon heftig. Weiß jemand, wie es diesbezüglich um #Proxmox bestellt ist? Ist das mit dem
7.0.14-24 erledigt, braucht es dafür 7.0.14-26, oder gibt es da noch nichts, was es fixen würde?

#Debian #CVE #Admin

Veeam fixes seven vulnerabilities in Veeam Backup for Microsoft 365 and Management Pack, including RCE flaws CVE-2023-22793 and CVE-2026-106076.

#Veeam #VeeamBackup #Microsoft365 #SystemCenter #RCE #CVE202322793 #BackupSecurity #PatchNow

https://securityonline.info/veeam-vulnerabilities-microsoft-365-management-pack/?utm_source=mastodon&utm_medium=jetpack_social

Veeam fixes seven vulnerabilities in Veeam Backup for Microsoft 365 and Management Pack, including RCE flaws CVE-2023-22793 and CVE-2026-106076.

#Veeam #VeeamBackup #Microsoft365 #SystemCenter #RCE #CVE202322793 #BackupSecurity #PatchNow

https://securityonline.info/veeam-vulnerabilities-microsoft-365-management-pack/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-61671 - High (8.1)

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61671 - High (8.1)

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61645 - Critical (9.1)

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61645 - Critical (9.1)

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45049 - High (8.3)

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45049 - High (8.3)

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119283 - High (7.5)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119283 - High (7.5)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119325 - High (7.5)

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId par...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119325/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119325 - High (7.5)

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId par...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119325/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apply the latest ServiceNow vulnerabilities patch to fix three flaws, including critical sandbox escape CVE-2026-103093 and password leak CVE-2026-103094.

#ServiceNow #AIPlatform #CVE2026103093 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/servicenow-vulnerabilities-patched-cve-2026-103093/?utm_source=mastodon&utm_medium=jetpack_social

Apply the latest ServiceNow vulnerabilities patch to fix three flaws, including critical sandbox escape CVE-2026-103093 and password leak CVE-2026-103094.

#ServiceNow #AIPlatform #CVE2026103093 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/servicenow-vulnerabilities-patched-cve-2026-103093/?utm_source=mastodon&utm_medium=jetpack_social

Apply the latest ServiceNow vulnerabilities patch to fix three flaws, including critical sandbox escape CVE-2026-103093 and password leak CVE-2026-103094.

#ServiceNow #AIPlatform #CVE2026103093 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/servicenow-vulnerabilities-patched-cve-2026-103093/?utm_source=mastodon&utm_medium=jetpack_social

Apply the latest ServiceNow vulnerabilities patch to fix three flaws, including critical sandbox escape CVE-2026-103093 and password leak CVE-2026-103094.

#ServiceNow #AIPlatform #CVE2026103093 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/servicenow-vulnerabilities-patched-cve-2026-103093/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1029] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-76418 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76418)
- Name: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Firewall ASA Software and Cisco Secure FTD Software
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76418

⚠️ CVE-2026-97229 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-97229)
- Name: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261029 #cisa20261029 #cve_2026_76418 #cve_2026_97229 #cve202676418 #cve202697229

CVE ID: CVE-2026-76418
Vendor: Cisco
Product: Secure Firewall ASA Software and Cisco Secure FTD Software
Date Added: 2026-10-29
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76418

CVE-2026-76418: Cisco ASA and FTD SSL VPN zero-day explained (affected versions, fixes, mitigation)

https://thecybersecguru.com/exploits/cve-2026-76418-cisco-asa-ftd-ssl-vpn-zero-day/

Cisco confirms exploitation of CVE-2026-76418 in ASA/FTD SSL VPN. An unauthenticated request can reboot vulnerable firewalls when secondary authentication is configured.

For admins: check tunnel groups, assess VPN exposure, and install fixed builds. Disabling secondary auth is listed as a mitigation, but it weakens protection. This is an availability risk, not a data breach.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

🚨🇺🇸 Cisco firewall zero-day actively exploited to crash SSL VPN devices; CVE-2026-76418

Cisco has patched a high-severity vulnerability in Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload, causing a denial-of-service condition.

The flaw is triggered by a crafted request sent to the SSL VPN service when secondary authentication is configured on an affected tunnel group. A successful VPN login is not required.
⠀
• CVSS: 8.6
• Affected: Cisco Secure Firewall ASA and FTD with reachable SSL VPN services and secondary authentication
• Fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1
• Fixed FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
⠀
Cisco confirmed active exploitation in October but did not identify the attackers, targets or scale of the activity. No complete workaround is available, and administrators are urged to install a fixed release.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface. https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/

Here's a summary of recent geopolitical, technology, and cybersecurity news:

Geopolitical: The US has reportedly warned Gulf states to prepare for a "short, intense military campaign" against Iran following the upcoming midterm elections (Oct 28).

Technology: Google DeepMind unveiled Genie 4, an advanced AI model capable of creating interactive virtual worlds from text prompts (Oct 28).

Cybersecurity: Cisco issued warnings regarding the active exploitation of a Secure Firewall 0-day vulnerability (CVE-2026-76418) causing Denial of Service, and an SD-WAN flaw (CVE-2026-20127) utilized to deploy KeyDrift malware (Oct 28-29). Japan Airlines also disclosed a data breach affecting 92,000 customers (Oct 28).

#Cybersecurity #AnonNews_irc #News

Patch CVE-2026-76418 now. This high-severity Cisco Secure Firewall vulnerability is exploited in the wild to trigger SSL VPN DoS reloads on ASA and FTD.

#Cisco #CiscoASA #CiscoFTD #CVE202676418 #SSLVPN #ZeroDay #Cybersecurity #Vulnerability

https://securityonline.info/cisco-secure-firewall-vulnerability-exploited-ssl-vpn/?utm_source=mastodon&utm_medium=jetpack_social

Cisco zero-day: CVE-2026-76418 (8.6 high)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

#cisco #zeroday #eitw #CVE

@ammarfaizi2 alpine Linux was down because of this wkwkwk

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

📢 Incident GitLab Alpine Linux : exploitation tentée de CVE-2026-97229 (CVSS 10.0)

Le 28 octobre 2026, l'équipe Alpine Linux a publié un post-mortem détaillé sur son site officiel (alpinelinux.org) concernant une tentative d'exploitation de leur instance GitLab entre le 20 et le 21 octobre 2026. CVE-2026-97229 est une vulnérabilité critique (CVSS 10.0)…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-29-incident-gitlab-alpine-linux-exploitation-tentee-de-cve-2026-97229-cvss-10-0/
🌐 source : https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
🟡 vérification factuelle moyenne
#AlpineLinux #GitLab #Cyberveille

@ammarfaizi2 alpine Linux was down because of this wkwkwk

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

🚨 [CISA-2026:1029] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-76418 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76418)
- Name: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Firewall ASA Software and Cisco Secure FTD Software
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76418

⚠️ CVE-2026-97229 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-97229)
- Name: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261029 #cisa20261029 #cve_2026_76418 #cve_2026_97229 #cve202676418 #cve202697229

CVE ID: CVE-2026-97229
Vendor: GitLab
Product: Community Edition and Enterprise Edition
Date Added: 2026-10-29
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97229

Alpine Linux says it was almost hacked using a recent GitLab bug

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

Alpine Linux says attackers tried CVE-2026-97229 against its GitLab server. No successful code execution was found, but it couldn't be ruled out; Alpine rebuilt the instance.

The operational lesson: its custom image was still vulnerable after a GitLab upgrade because the bundled Ruby lacked the fix. If you run GitLab from source or a custom image, check the Ruby version as well as GitLab's release.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

On October 20 and 21, an attacker tried to exploit CVE-2026-97229 against Alpine Linux's GitLab instance.

We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#GitLab #CVE #eitw

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
https://news.ycombinator.com/item?id=50282544

#hackernews #tech

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

Link: https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
Discussion: https://news.ycombinator.com/item?id=50282544

Alpine Linux says an attacker tried to exploit GitLab CVE-2026-97229 (CVSS 10.0) on Oct 20 and 21, a week after GitLab's Oct 12 fix. Alpine had upgraded to 19.3.4 by mistake, not fixed 19.3.5, and 19.3.6 still lacked the fix, a patch to GitLab's bundled Ruby. With some logs gone it cannot rule out success, so it rebuilt the instance; it found no tampering with packages or releases.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#GitLab #AlpineLinux #InfoSec #Cybersecurity

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
Link: https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
Comments: https://news.ycombinator.com/item?id=50282544

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

Link: https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html
Discussion: https://news.ycombinator.com/item?id=50282544

🚨 #GitLab had a "security incident" where a hacker almost-but-not-quite-exploited a #vulnerability that was already patched. 😱 But don't worry, they totally rebuilt everything from scratch just in case. 🔨 It's like fixing a leak after the plumber already came, just to be super-duper sure. 🙄
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html #Security #Incident #HackerNews #Cybersecurity #Patch #HackerNews #ngated

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

Comments: https://news.ycombinator.com/item?id=50282544

#HackerNews #GitLab #Security #CVE-2026-97229 #Cybersecurity #Incident #Vulnerability #Exploitation

GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux https://lobste.rs/s/2zsjwt #linux #security
https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

An attacker targeted GitLab vulnerability CVE-2026-97229 (CVSS 10 RCE) on Alpine Linux's server. Alpine rebuilt GitLab and reset all passwords.

#GitLab #AlpineLinux #CVE202697229 #RCE #Ruby #Onigmo #ActiveExploitation #SupplyChainSecurity

https://securityonline.info/alpine-linux-gitlab-cve-2026-97229/?utm_source=mastodon&utm_medium=jetpack_social

We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuilt
GitLab from scratch.

Alpine packages and releases were not affected, and no signing keys were exposed.

All GitLab passwords have been reset. If you reused yours elsewhere, change it there.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#AlpineLinux #security

🟠 CVE-2026-13303 - High (8.7)

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13303 - High (8.7)

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118683 - High (8.8)

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119197 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119197 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119194 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119194/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118660 - High (8.6)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119049 - High (7.6)

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through ass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-42922: FUXA 1.3.2-2809 CRITICAL /nodered auth bypass lets unauthenticated attackers run code via crafted HTTP requests. No patch — restrict /nodered & monitor traffic. https://radar.offseq.com/threat/a-authorization-bypass-vulnerability-exists-in-the-nodered-functionality-of-fuxa-versions-cve-2026-3040efed3ab26978 #OffSeq #CVE202642922 #vuln #infosec

🟠 CVE-2026-119028 - High (8.8)

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an en...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Stopping Remote Code Execution with Sandboxes, CVE-2026-115995: Rust Zip https://cosmonic.com/blog/stopping-remote-code-execution-with-a-sandbox/

TIL Yamaha makes WiFi routers. Of course they have a command injection vuln.

https://nvd.nist.gov/vuln/detail/cve-2026-97854

🔴 CVE-2026-97854 - Critical (9.8)

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-97854 | Yamaha NWR100 routers have a CRITICAL OS command injection vuln (CVSS 9.8). Remote attackers can execute arbitrary commands — no patch yet. Restrict access ASAP. Details: https://radar.offseq.com/threat/cve-2026-97854-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-20db87dc9dd568b0 #OffSeq #Yamaha #Vuln #Infosec

CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas

Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT
Description:
AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas wi...

https://aws.amazon.com/security/security-bulletins/rss/2026-153-aws/

#aws #security

🟠 CVE-2026-119052 - High (7.5)

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39736 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49142 - High (8.8)

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Patch CVE-2026-118264 now. This 9.1 CVSS Echo Go framework vulnerability allows a WebSocket upgrade bypass of route-level access controls.

#Golang #EchoFramework #WebSocket #CVE2026118264 #AppSec #Cybersecurity #Vulnerability #InfoSec

https://meterpreter.org/echo-go-framework-websocket-bypass-cve-2026-118264/?utm_source=mastodon&utm_medium=jetpack_social

Jenkins fixes 15 vulnerabilities, including remote code execution flaws CVE-2026-117612 and CVE-2026-117614. Upgrade to 2.588 or LTS 2.580.2 now.

#Jenkins #CICD #DevSecOps #CVE2026117612 #RCE #XStream #SupplyChainSecurity #PatchNow

https://securityonline.info/jenkins-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-119027 - High (7.5)

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI docume...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110184 - High (7.5)

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119025 - High (7.5)

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Radius Xenia M2M Platform’s password recovery is vulnerable (CVE-2026-114358). Unauthenticated remote SQL injection allows DB access & modification. Restrict interface access & monitor logs. Details: https://radar.offseq.com/threat/this-vulnerability-exists-in-the-radius-xenia-m2m-platform-due-to-insufficient-validation-of-user-185ce1ea5c45889e #OffSeq #Security #SQLi #CVE2026114358

CVE-2026-109516: CRITICAL auth bypass in guruteam Bot for Telegram on WooCommerce (<=1.3.0). Unauthenticated attackers can hijack any WP account, incl. admin. Disable plugin or block REST endpoints until patched. https://radar.offseq.com/threat/cve-2026-109516-cwe-287-improper-authentication-in-guruteam-bot-for-telegram-on-woocommerce-292ec2d16c9aa743 #OffSeq #WordPress #CVE2026109516

CVE-2026-66088 | Severity: CRITICAL | openEQUELLA <2026.1 lets users with script access run arbitrary OS commands via system.execute(). Full system compromise possible. Patch to v2026.1+ ASAP. https://radar.offseq.com/threat/in-openequella-before-20261-the-systemexecute-function-available-to-the-scripting-engine-runs-supplied-b8bc6b1fae12ee97 #OffSeq #Vuln #openEQUELLA #CVE202666088

CVE-2026-66088 (CRITICAL, CVSS 9.4) in openEQUELLA <2026.1: system.execute() lets users run arbitrary OS commands as the service account. Full system compromise possible. Patch to 2026.1+ & restrict scripting rights now. https://radar.offseq.com/threat/cve-2026-66088-cwe-78-os-command-injection-in-apereo-foundation-openequella-0f357edf54f76fa6 #OffSeq #Vuln #openEQUELLA

🟠 CVE-2026-113387 - High (8.6)

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-113387/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86377 - High (7.6)

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Out-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

D-Link DIR-505 v1.10B02 (CVE-2026-118579) – CRITICAL flaw in /secmark1524.cgi enables remote unauthenticated backdoor creation. No patch; public exploit exists. Isolate devices and monitor for updates. https://radar.offseq.com/threat/a-weakness-has-been-identified-in-d-link-dir-505-110b02-cve-2026-118579-3434a71826170643 #OffSeq #CVE2026118579 #IoTSecurity #Vuln

CVE-2026-118579: D-Link DIR-505 v1.10B02 has a CRITICAL web management backdoor (CVSS 9.3) via /secmark1524.cgi. Public exploit code is live. Restrict remote admin & monitor closely. https://radar.offseq.com/threat/cve-2026-118579-backdoor-in-d-link-dir-505-bc3b2c9ce51cde6d #OffSeq #CVE #Infosec #RouterSecurity

🔴 CVE-2026-118579 - Critical (9.8)

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118579/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93851 - High (8)

Mattermost versions 11.9.x &lt;= 11.9.1, 11.8.x &lt;= 11.8.5, 11.7.x &lt;= 11.7.10 fail to validate the target post ID in the Agents plugin&#039;s mention reminder component, which allows an authenticated user who can post in a channel visible to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Hat tip to The Hacker News for finding the exploitation evidence for CVE-2026-41709, which was added to CISA's KEV Catalog:

WARP PANDA: Multiple intrusions at U.S.-based entities included targets in the legal sector. WARP PANDA deployed several forms of malware in victims’ VMware vCenter environments. In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.

https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/
https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #zeroday #vmware #cve #KEV #ArmoryCastle

The vulnerability in question is CVE-2026-41709 (CVSS score: 2.7), an insufficient logging vulnerability that could permit a malicious actor with admin access to perform certain operations without being logged. https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

CISA adds Linux kernel vulnerability CVE-2026-46300, chained with PHP2Shell for root, and VMware ESX flaw CVE-2026-41709 to KEV. Patch now.

#CISA #KEV #LinuxKernel #PHP2Shell #VMware #ESX #CVE202646300 #ActiveExploitation

https://securityonline.info/cisa-kev-linux-kernel-php2shell-vmware-esx/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1028] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-41709 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41709)
- Name: Broadcom VMWare ESX Insufficient Logging Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Broadcom
- Product: VMware ESX
- Notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-41709

⚠️ CVE-2026-46300 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-46300)
- Name: Linux Kernel Missing Initialization of a Variable Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 ; https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c ; https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 ; https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 ; https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e ; https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a ; https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 ; https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46300

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261028 #cisa20261028 #cve_2026_41709 #cve_2026_46300 #cve202641709 #cve202646300

CVE ID: CVE-2026-41709
Vendor: Broadcom
Product: VMware ESX
Date Added: 2026-10-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41709

CW: részletes technikai leírás következik — PHP2Shell lánc + kernel LPE (Fragnesia) egyetlen hitelesítés nélküli HTTP kéréssel root jogot adott 25 tűzfalon, köztük kormányzati kapcsolódású környezetekben. CVE-2026-109618 / CVE-2026-109619 + CVE-2026-46300; kitett menedzsmentfelület veszélyes. Frissítsetek és zárjátok a menedzsment interfészeket. #CVE-2026-109618 #CVE-2026-46300 #Firewall #ActiveDirectory https://linuxmint.hu/hir/2026/10/lancolt-php2shell-sebezhetoseg-25-szervert-rootolt-meg

Kernel security reboots Friday, Oct 30, 8:00 AM–12:00 PM PDT (15:00–19:00 UTC): a number of OSL-hosted services, including our FTP mirrors, will each be down for a few minutes while their servers move to a fixed kernel for CVE-2026-46300. Details: https://status.osuosl.org/pages/maintenance/526712bf10cd4e587b000014/6ae28f958ca069152f7f8fc2

CISA adds Linux kernel vulnerability CVE-2026-46300, chained with PHP2Shell for root, and VMware ESX flaw CVE-2026-41709 to KEV. Patch now.

#CISA #KEV #LinuxKernel #PHP2Shell #VMware #ESX #CVE202646300 #ActiveExploitation

https://securityonline.info/cisa-kev-linux-kernel-php2shell-vmware-esx/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1028] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-41709 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41709)
- Name: Broadcom VMWare ESX Insufficient Logging Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Broadcom
- Product: VMware ESX
- Notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-41709

⚠️ CVE-2026-46300 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-46300)
- Name: Linux Kernel Missing Initialization of a Variable Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 ; https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c ; https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 ; https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 ; https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e ; https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a ; https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 ; https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46300

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261028 #cisa20261028 #cve_2026_41709 #cve_2026_46300 #cve202641709 #cve202646300

CVE ID: CVE-2026-46300
Vendor: Linux
Product: Kernel
Date Added: 2026-10-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46300

What. The. Fuck.

https://access.redhat.com/security/cve/cve-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.

🟠 CVE-2026-109411 - High (8.1)

An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-109411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118688 - High (7.9)

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118688/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118686 - High (7.5)

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New perfect 10. 🥳

https://nvd.nist.gov/vuln/detail/cve-2026-115905

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

🟠 CVE-2026-13451 - High (7.7)

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability all...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13451/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118650 - High (7.5)

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84725 - High (8.1)

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the serve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93522 - High (7.8)

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in https://x.org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93522/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93521 - High (7.8)

A buffer overflow in RandR
ChangeProviderProperty requests in https://x.org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93521/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Juniper security bulletin fixes 18 Session Smart Router vulnerabilities, including CVSS 9.8 flaws CVE-2026-103406 and CVE-2026-103409. Update now.

#Juniper #SessionSmartRouter #SDWAN #CVE2026103406 #CVE2026103409 #NetworkSecurity #PatchNow #Vulnerability

https://securityonline.info/juniper-session-smart-router-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Apache Kafka fixes 12 vulnerabilities, including CVE-2026-110985, which skips JWT signature verification and grants full cluster access. Patch now.

#ApacheKafka #Kafka #CVE2026110985 #JWT #OAuth #DataStreaming #DoS #PatchNow

https://securityonline.info/apache-kafka-vulnerabilities-jwt-bypass/?utm_source=mastodon&utm_medium=jetpack_social

Jenkins fixes 15 vulnerabilities, including remote code execution flaws CVE-2026-117612 and CVE-2026-117614. Upgrade to 2.588 or LTS 2.580.2 now.

#Jenkins #CICD #DevSecOps #CVE2026117612 #RCE #XStream #SupplyChainSecurity #PatchNow

https://securityonline.info/jenkins-vulnerabilities-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

#hackers have begun exploiting a critical #Brotli #vulnerability known as #Node2Shell, #Broccoli2Shell, and #HTTP2Shell.

https://nvd.nist.gov/vuln/detail/cve-2026-111497

#infosec #security #cisa #exploit

We have now seen enough evidence to say that the Brotli decoder vulnerabilities affecting NodeJS and other platforms has kindasortamaybesometimes been exploited in the wild. At the very least, it should be treated as such.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

Node2Shell Buffer Overflow Exploited in Google Brotli and Node.js

The critical buffer overflow in the Brotli compression library (CVE-2026-111497) is under active exploitation, allowing remote code execution and memory disclosure across Node.js, PHP, and Microsoft products.

**Check every web-facing service for Brotli library dependencies in any language and update them to the latest version immediately. Alternatively, block brotli streams from being accepted at all. This flaw is already being used by attackers. Prioritize patching your Node.js and PHP environments today.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/node2shell-buffer-overflow-exploited-in-google-brotli-and-node-js-z-w-z-z-m/gD2P6Ple2L

Brotli bug is now exploited in the wild after a PoC was released on Monday

https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/

https://previdian.com/CVE-2026-111497

https://x.com/fede_k/status/2115527170160267424

https://x.com/csirt_it/status/2114706655627632700

We've built a scanner to detect the exposure of your website to Node2Shell (CVE-2026-111497). We have emergency remediation measures ready if you need help - just reach out and our team can help.
https://nodejsguard.io/

Latest cybersecurity reports highlight critical PHP vulnerabilities being actively exploited globally, necessitating emergency patching. CISA confirmed exploitation of the Node2Shell/Brotli flaw (CVE-2026-111497). China-linked groups leveraged a BeyondTrust zero-day (CVE-2026-102764), and AI agents reportedly compromised live websites during testing (Oct 27-28, 2026). In technology, Amazon Business introduced new agentic AI tools. Geopolitically, Israel's elections are heading towards a coalition deadlock.

#Cybersecurity #AnonNews_irc #News

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js

I thought 'brotli' was an Indian side-order until I discovered CVE-2026-111497.

(Sorry, I thought that quite funny even if it isn't. /via @jschauma good post at https://www.netmeister.org/blog/defense-ddos.html)

Juniper security bulletin fixes 18 Session Smart Router vulnerabilities, including CVSS 9.8 flaws CVE-2026-103406 and CVE-2026-103409. Update now.

#Juniper #SessionSmartRouter #SDWAN #CVE2026103406 #CVE2026103409 #NetworkSecurity #PatchNow #Vulnerability

https://securityonline.info/juniper-session-smart-router-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

『UEFI 爆出固件漏洞：影响 PXE 网络启动，评分 9.5，已存在 16 年｜CVE-2026-97631』
安全研究人员最近公开了一个存在约 16 年的 UEFI 固件漏洞，编号为 CVE-2026-97631，严重程度评分高达 9.5 分（满分 10 分）。 据 Ars Technica 报道，这个漏洞存
……
阅读全文： :sys_link: https://www.appinn.com/uefi-edk2-vulnerability-cve-2026-97631/

#小众软件

CW: sebezhetőség
CVE-2026-97631 — memória-kezelési hiba az EDK II (TianoCore) ICMP komponensében. Kódfuttatás firmware szinten (OS előtt), sok szerver/IBV érintett; AMI/Project Mu is használta a kódot. Javítás nyilvános (AMI PR), így a kihasználás gyorsan megjelenhet. #UEFI #EDK2 #CVE202697631 #infosec #OpenSource
https://linuxmint.hu/hir/2026/10/kodfuttatasi-hiba-a-uefi-firmware-ben-a-fold-legtobb-szerveret-erinti

TianoCore disclosed CVE-2026-97631 (9.5) in EDK II's PXE boot driver. Crafted ICMP errors during network boot may hang affected systems or permit targeted pre-OS code execution.

For MSPs/admins: inventory PXE-boot systems, disable network boot where unused, isolate provisioning traffic, and check for vendor firmware updates. Exposure is during PXE boot, not every startup. TianoCore lists no patched release.

https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

SANS Stormcast Thursday, October 29th, 2026: ClickFix Campaign Targets macOS and Windows; EDK II UEFI PXE Pre-Boot RCE (CVE-2026-97631); Qwen AI Model Data Exfiltration; LiteLLM Master Key Leak
https://isc.sans.edu/podcastdetail/10156

Patch CVE-2026-97631 now. This critical 9.5 CVSS EDK II PXE vulnerability allows unauthenticated pre-boot RCE via crafted ICMP error packets.

#EDKII #TianoCore #UEFI #PXEBoot #CVE202697631 #Cybersecurity #Vulnerability #InfoSec #13302

https://securityonline.info/edk-ii-pxe-vulnerability-pre-boot-rce-cve-2026-97631/?utm_source=mastodon&utm_medium=jetpack_social

AMI publicly proposed a fix for CVE-2026-97631 before the planned coordinated disclosure, Ars reports. TianoCore says an attacker able to reach a vulnerable EDK II device during PXE boot can execute code before the OS loads; its advisory lists no patched version. Check with your firmware vendor and consider disabling network boot if possible.

https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

#UEFI #Firmware #InfoSec #Cybersecurity

Faille UEFI CVE-2026-97631 : un paquet ICMP suffit pour exécuter du code avant le Secure Boot https://www.it-connect.fr/faille-uefi-edk-ii-pxe-icmp-cve-2026-97631/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

A 16-year-old buffer overflow vulnerability, tracked as CVE-2026-97631, affects EDK II open-source code used for UEFI firmware up to edk2-stable202608.

The flaw stems from incorrect size checks in IPv4 and IPv6 network-boot code when copying error messages, allowing code execution during network boot before the operating system and Secure Boot load.

Affected packages include distributions from Red Hat, SUSE, and Debian.

https://en.hacks.gr/sfalma-sto-edk-ii-mporei-na-epitrepsei-ektelesi-kodika-prin-fortothei-to-leitoyrgiko-systima/

#UEFI #Firmware #EDKII #Debian

🚨🇺🇸 Critical 16-year-old EDK II flaw enables code execution before Secure Boot

A critical buffer overflow in TianoCore EDK II, the open-source foundation used to build much of the world’s UEFI firmware, can allow an unauthenticated attacker to run code before the operating system loads.

Tracked as CVE-2026-97631, the vulnerability carries a CVSS score of 9.5 and has existed in the code since November 2010.
⠀
The flaw resides in the PXE network-boot driver, which copies incoming ICMP error messages into a fixed 504-byte buffer without properly limiting their size.
⠀
An attacker who can reach a machine while it is booting over the network can send a crafted ICMP message that:

• Crashes the firmware and prevents the operating system from loading
• Executes attacker-controlled code in the pre-boot environment
• Runs before Secure Boot and measured-boot protections evaluate the operating system
⠀
Reliable code execution requires knowledge of the target’s firmware build. Systems that boot exclusively from local storage are not exposed through this attack path.
⠀
An upstream fix was merged into EDK II on October 15, but no stable EDK II release currently includes it. Server and motherboard vendors must integrate the patch and distribute BIOS or UEFI updates to customers.

Source: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

EDK2 PXE Flaw (CVE-2026-97631): Find What You Run https://cloudsleuth.io/blog/edk2-pxe-flaw-cve-2026-97631-find-what-you-run/

CVE-2026-97631: How a 16-Year-Old EDK II PXE Bug Exposes UEFI Firmware Before the OS Loads

https://thecybersecguru.com/news/cve-2026-97631-edk2-pxe-uefi-vulnerability/

🧐😱🫣
Critical UEFI Firmware Flaw
CVE-2026-97631

CVE-2026-97631

pls stop

🟠 CVE-2026-56828 - High (8.8)

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56828/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93520 - High (7.8)

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in https://x.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93520/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93519 - High (7.8)

A buffer overflow when handling pointer barriers in the XFIXES extension in https://x.org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Ultimate Member <2.14.0 is vulnerable (CRITICAL, CVSS 9.8) to deserialization of untrusted data (CVE-2026-115968), enabling object injection and possible system takeover. Patch to 2.14.0+ ASAP. https://radar.offseq.com/threat/cve-2026-115968-deserialization-of-untrusted-data-in-ultimate-member-92e650ae59939656 #OffSeq #WordPress #Infosec #Vulnerability

Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286) https://ricardojoserf.github.io/axisrce

🟠 CVE-2026-93518 - High (7.8)

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in https://x.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Details and a PoC exploit are public for jackson-databind vulnerability CVE-2026-110879 (CVSS 9.8), a bypass of the CVE-2026-54512 fix. Patch now.

#Jackson #jacksondatabind #Java #CVE2026110879 #Deserialization #PoC #Spring #AppSec

https://securityonline.info/jackson-databind-vulnerability-cve-2026-110879-poc/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-67074 | CRITICAL RCE in HCL BigFix AEX 13.0.0.1 (CVSS 9.1) 🛡️ Exploitation allows arbitrary code execution with app privileges. No patch yet — restrict access & monitor. More: https://radar.offseq.com/threat/cve-2026-67074-cwe-94-code-injection-in-hcl-software-bigfix-aex-a5f31975501a4a18 #OffSeq #CVE #RCE #BigFix

🏆 New Achievement! Cart Before The Hearse!

Step right up, online merchants! For only the low, low price of ignoring CVE-2026-48356, attackers are now offering a full remote code execution package for your Adobe Commerce or Magento store — hundreds of shops already redecorated, free of charge. CISA has slapped a patch deadline of November 10, 2026 on this critical file upload flaw, which lets uninvited guests take over your store like a haunted Best Buy. (1/3)

🔴 CVE-2026-114278 - Critical (9.8)

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-114278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118485 - High (8.1)

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed (URL-encoded ../) sequences in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-118477 - Critical (9.8)

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118477/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-118477 – HIGH severity OS Command Injection in EISGE Kalifast (>=0 <2026.02.1). Authenticated users can run arbitrary commands via ei_git_repo_url. Patch now: 2026061802 🛡️ https://radar.offseq.com/threat/cve-2026-118477-cwe-78-os-command-injection-in-eisge-kalifast-96357c3746a79f11 #OffSeq #infosec #vulnerability #CVE2026118477

🟠 CVE-2026-86378 - High (8.8)

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103780 - Critical (9.8)

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103780/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Dell fixes PowerProtect Data Domain vulnerabilities in DD OS, including four CVSS 9.8 flaws like CVE-2026-86400 allowing root command execution.

#Dell #PowerProtect #DataDomain #DDOS #Backup #CVE202686400 #Ransomware #PatchNow

https://securityonline.info/dell-powerprotect-data-domain-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-86400 - Critical (9.8)

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Impr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86396 - High (8.8)

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Impr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CW: részletes technikai leírás következik — PHP2Shell lánc + kernel LPE (Fragnesia) egyetlen hitelesítés nélküli HTTP kéréssel root jogot adott 25 tűzfalon, köztük kormányzati kapcsolódású környezetekben. CVE-2026-109618 / CVE-2026-109619 + CVE-2026-46300; kitett menedzsmentfelület veszélyes. Frissítsetek és zárjátok a menedzsment interfészeket. #CVE-2026-109618 #CVE-2026-46300 #Firewall #ActiveDirectory https://linuxmint.hu/hir/2026/10/lancolt-php2shell-sebezhetoseg-25-szervert-rootolt-meg

Malcolm v26.10.0

Malcolm v26.10.0 moves Zeek to 9.0.1 LTS, expands threat intelligence enrichment with MITRE ATT&CK context, aligns Zeek OT protocol fields with Arkime, and fixes nine Malcolm security issues. Uploaded PCAP processing gets two important correctness fixes, and nearly every external artifact used in the build is now pinned and verified.

Upgrading: if you are upgrading an existing install, run ./scripts/status first so Malcolm can migrate settings before you run ./scripts/configure, ./scripts/start, or other control scripts.

• Full release notes v26.10.0
• Full changelog: v26.09.0...v26.10.0

✨ Features and enhancements

• Zeek 9.0.1 LTS. multicast_participants.log is parsed and shown in a new Multicast dashboard. ntp_control.log and ntp_private.log are parsed and indexed. (#1119)
• OT field normalization. Zeek fields for BACnet, C12.22, DNP3, ENIP/CIP, Modbus, OPC UA, S7comm, and Synchrophasor are copied to Arkime's field names, so filters and drill-downs carry between Dashboards and Arkime. Original zeek.* fields are kept. (#1257)
• Threat intel in ECS threat.* fields. Zeek intel kill chain phases, MISP MITRE galaxy tags, Mandiant and Google Threat Intelligence actors, Suricata ET mitre_* metadata, and capa results all map to normalized tactic, technique, subtechnique, and group fields. ATT&CK for ICS is told apart from Enterprise. (#695)
• Richer indicator metadata. Mandiant categories, campaigns, reports, and threat score, plus STIX 2.1 confidence, now reach Zeek intel. Google Threat Intelligence collections accept ioc_types and include_autogenerated_tags to cut memory use.
• Community ID in Logstash for Zeek logs that arrive without one, controlled by LOGSTASH_ZEEK_COMPUTE_COMMUNITY_ID (on by default). (#400)
• API document lookup gains sort, offset, track_total_hits, and a total hit count. It and field aggregations now return shards and timed_out, so a partial or timed-out search no longer looks like an empty result. Bad arguments return HTTP 400. (#1130, #1131)
• Custom ports for 13 ICSNPP analyzers through new ZEEK_PORTS_* variables. Three older variables are renamed to match, with values migrated on upgrade. (#1272)
• NetBox skips the device-type library import once it has completed for a revision. NETBOX_DEVICETYPE_IMPORT_VENDORS can limit the first import, which also limits MAC OUI matching.
• Smaller items: a low-RAM warning during configuration, a Hedgehog ISO prompt for the status kiosk, restyled account management pages, and Biomes dashboard docs in Analytics.
• New Corelight Zeek detections: php2shell-detect and emudhra-weak-keys.

🛡️ Security remediation and hardening

• Stored XSS in the file-upload container let a user with upload access run JavaScript in another user's session. The patch route also allowed writes to arbitrary directories. The read side is gone, the vulnerable handlers are stripped at build time, and responses carry nosniff and a strict CSP. (GHSA-qv8w-m37v-6c7j)
• Credential disclosure in the hh-extracted-files proxy, which forwarded the caller's auth headers and cookies to a caller-chosen destination. Those headers are now cleared. (GHSA-325g-72fr-vj2x)
• The published default Arkime WISE PIN and viewer password secret are removed. (GHSA-w2jh-h3pq-273j)
• MaxMind and GitHub tokens are passed as BuildKit secrets instead of build arguments. Exposed MaxMind credentials were rotated. (GHSA-3293-9mf2-qf68)
• Logstash's Beats input requires a client certificate when BEATS_SSL=true. (GHSA-f2gq-m4v3-2383)
• The root-run PCAP upload watcher no longer follows symlinks. (GHSA-98jw-5wq7-6qjv)
• Every outbound API request now has a timeout, and the API runs multiple workers, so one hung dependency can't take it down. (GHSA-x9f2-h2rj-vp63)
• nginx/htpasswd and htadmin/metadata are tightened to 0640. (GHSA-rxpm-f8cm-2m5m)
• The ISO install hook uses a private temp directory. (GHSA-wmrp-jr97-8xf4)
• Nginx logs a warning when remote Keycloak runs without TLS verification. (GHSA-5wxm-fqf2-r23g)
• /mapi/opensearch/ has role-based access control, with a read-only query tier and an admin tier.
• /mapi/event records the submitter and namespaces caller IDs so they can't overwrite pipeline records. Config import is confined to the config directory (thanks @zaara2004). (#1147)
• Supply chain: release binaries, source archives, web assets, Zeek packages, images, and GitHub Actions are pinned and checksum-verified. For hardened builds today, see the Iron Bank images. (#1138)
• OpenResty 1.31.8.1 brings 12 nginx CVE fixes. lua-resty-openidc goes to 1.9.3 with a rewritten session config and a persisted NGINX_SESSION_SECRET.
• PHP 8.4.27 in file-upload and htadmin addresses the php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).

🐛 Bug fixes

• Zeek intel on uploaded PCAP: packet processing now waits for intel files to load, so early packets and small captures get intel.log hits. (#1260)
• Suricata rule metadata on uploaded PCAP: none of 33,303 sampled alerts carried it before. Instances are now warmed up and reloaded, so ET MITRE and CVE metadata map into threat.* and vulnerability.*. Scheduled rule updates now reload every socket. (#1262)
• Workaround for an upstream OpenSearch Dashboards connection leak that crashed the container.
• PCAP watchers no longer mistake read-only opens for activity, which had stalled or skipped files. (#1265)
• STIX, TAXII, and MISP conversion: TAXII 2.1 feeds load, one bad object no longer drops a whole bundle, since is honored, and compound patterns are handled clause by clause.
• Threat intel and API timestamps no longer shift with the host timezone. The /fields catalogue includes nested fields.
• OpenSearch index retention no longer double-counts indices or rounds small ones to zero.
• Other fixes cover PCAP upload duplicate detection, file scanning, Filebeat cleanup, NetBox enrichment, DTLS and MQTT transport labels, prune_files.sh, and the build and control scripts.

✅ Component versions

Zeek 9.0.1 LTS (some log fields changed, such as files.log dropping ftime), OpenSearch and Dashboards 3.9.0, OpenResty 1.31.8.1, Arkime 6.9.1, Keycloak 26.8, Logstash and Filebeat 9.5.5, NetBox Python dependencies, lua-resty-openidc 1.9.3, and several smaller tools.

Malcolm is an easily deployable network traffic analysis tool suite for network security monitoring. It runs as a cluster of containers under Docker, Podman, or Kubernetes. Start with the Quick Start guide, or grab the Malcolm and Hedgehog Linux ISO installers from the releases page. Join the discussions board or watch a video.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

🔒 New CSAF advisory published

VDE-2026-127
Welotec: PHP2Shell Vulnerabilities in SMART EMS
CVE-2026-109618, CVE-2026-109619

Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to a…

HTML: https://certvde.com/en/advisories/VDE-2026-127
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-127.json

#OT #Advisory

PHP2Shell: One Vulnerable PHP Server Can Become Your Next Major Security Incident

The vulnerability is in PHP. The real failure may be in your IT operations.

On October 21, 2026, security researchers disclosed two critical vulnerabilities in PHP that can allow an unauthenticated attacker to execute code remotely. Within days, exploitation reports emerged, and CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Both received a CVSS 4.0 severity score of 9.2. PHP is widely deployed, making the potential attack surface enormous.

This isn’t a theoretical risk to put on next quarter’s security roadmap.
It’s an operational problem that needs attention now.

Why PHP2Shell is different

Most people hear about a vulnerability and immediately ask: Which application is affected?

PHP2Shell changes the conversation because the flaw sits in the PHP runtime itself, below application-level defenses.

The vulnerabilities involve memory-management errors that can leave PHP in an unsafe state when handling requests. Under the right conditions, an attacker can exploit that behavior to execute arbitrary code or expose sensitive process memory.

An attacker doesn’t necessarily need a valid account or a compromised employee laptop. A vulnerable, internet-facing PHP service may be enough.

And the implications go beyond the web application itself. Successful remote code execution can give an attacker a foothold to steal credentials, access sensitive files, establish persistence, or move toward other systems.

The critical detail: an application-level security check cannot reliably protect against a vulnerability that can be triggered before application code runs.

That is why PHP2Shell requires infrastructure-level remediation, not simply a code change in your application.

The uncomfortable question: Do you know where you’re running PHP?

PHP is not limited to the application your engineering team actively maintains.

It may be running in a WordPress installation, a legacy internal tool, a customer portal, a third-party application, a container, or a server that nobody remembers deploying.

The affected environments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team has identified Apache mod_php as particularly concerning.

For a 50- or 200-person company without a large security team, the difficult part may not be understanding the vulnerability. It may be answering five basic questions:

• Which internet-facing systems run PHP?
• Which versions are installed, including bundled and containerized versions?
• Who owns each system, and who can patch it?
• Have the vulnerable systems actually been updated and restarted?
• Has anything suspicious happened since the vulnerability became exploitable?

If those answers require days of Slack messages and spreadsheet archaeology, your company has an operational security gap.

What companies should do now

1. Find every affected PHP installation

Inventory production servers, development environments, containers, hosted applications, and third-party software that bundles PHP.

Don’t rely on the engineering team’s memory or a list of approved assets. Verify the running versions and configurations.

2. Patch to a fixed release

The PHP security releases addressing the two PHP2Shell vulnerabilities are:

• PHP 8.5.12 or later
• PHP 8.4.27 or later
• PHP 8.3.36 or later
• PHP 8.2.35 or later

These are the minimum fixed releases for the respective branches; use the latest supported security release available. PHP 8.1 and older branches are end-of-life and require migration to a supported version.

Verify the actual runtime, deploy the appropriate update, restart affected services where necessary, and confirm that the fix is active. Updating a development dependency doesn’t patch a production server. If you cannot patch immediately, restrict exposure and apply the PHP team’s recommended temporary mitigations. Disabling session upload-progress tracking can reduce risk, but it is not a substitute for installing the security update.

Important: A separate PHP issue, CVE-2026-115560, was disclosed shortly afterward. It involves a specific combination of session configuration and application behavior and is not fixed by the PHP2Shell releases above. Check the latest PHP security advisories rather than assuming one update resolves every newly disclosed PHP vulnerability.

3. Look for signs of compromise

Patching closes the known vulnerability. It does not prove that nobody exploited it before the update.
Review web-server, application, authentication, and endpoint telemetry for suspicious activity. Pay particular attention to unexpected child processes launched by PHP workers, unfamiliar files, new accounts, unusual outbound connections, and unexplained changes to services.

Don’t rely exclusively on matching a known malicious request. Exploitation can be difficult to identify from application logs alone, especially when the vulnerable behavior occurs before application code executes. If you find evidence of compromise, treat it as an incident: investigate the host, contain the threat, assess credential exposure, and follow an appropriate recovery process.

4. Turn the response into a repeatable process

PHP2Shell is one example of a recurring problem: a critical vulnerability is disclosed, and every organization must quickly discover its exposure, assign ownership, remediate affected systems, and document the outcome.
The companies that handle this well aren’t necessarily the ones with the largest security budgets. They are the ones that can answer those questions quickly and consistently.

Where EspressoLabs fits

EspressoLabs is building an AI-native IT, security, and compliance platform for small and midsize businesses. The goal is to make security operations more accessible without requiring every company to assemble an enterprise-sized IT and security team.

An incident like PHP2Shell illustrates why that matters.

1. Better visibility into your environment.
You cannot protect an asset you don’t know exists. An effective IT operations process starts with discovering systems, understanding their software and configuration, and identifying who owns them.

2. Faster remediation and verification.
Security teams need more than a vulnerability alert. They need a clear path from identifying an affected system to assigning remediation, tracking progress, and verifying that the change was completed. EspressoLabs can help streamline the IT operations and follow-through around that process.

3. Security that doesn’t stop at the endpoint.
Endpoint protection is important, but it cannot replace patching a vulnerable server-side runtime. Companies need complementary controls across infrastructure, identity, endpoint security, and application operations.

4. Evidence that security work actually happened.
For companies preparing for SOC 2 or maintaining an existing program, asset inventories, remediation records, assigned ownership, and documented follow-up can support a stronger vulnerability-management process. Those records do not, by themselves, establish SOC 2 compliance; controls must also be appropriately designed, implemented, and tested.

One important distinction: an IT management platform does not automatically patch every PHP installation, detect every exploit, or replace specialist incident response. Coverage depends on the systems integrated, permissions granted, and controls deployed. Internet-facing applications and runtimes still need explicit assessment and remediation.

The broader objective is to make these tasks part of routine operations rather than a fire drill every time a critical CVE hits the news.

The CTO’s PHP2Shell checklist

If I were responsible for technology at a 100-person company today, this would be my immediate checklist:

• Inventory all PHP runtimes and internet-facing applications.
• Identify affected versions, including bundled and containerized installations.
• Assign an owner and deadline to every affected asset.
• Patch to a fixed, supported PHP release and verify the running version.
• Review exposure during the pre-patch window for signs of compromise.
• Investigate suspicious processes, files, credentials, and outbound traffic.
• Review the latest PHP advisories for additional vulnerabilities, including CVE-2026-115560.
• Document remediation and improve the process for the next critical vulnerability.

The bottom line

PHP2Shell is a reminder that security isn’t just about buying the right tools. It’s about knowing what you operate, understanding where you’re exposed, and being able to act before a vulnerability becomes a breach.
If your team needs a spreadsheet, three meetings, and a week of investigation to discover which systems are affected by a critical vulnerability, the problem is bigger than PHP.

You need a better way to run IT and security.

EspressoLabs helps SMBs build a more manageable approach to IT, security, and compliance, without the cost and complexity of traditional enterprise operations.
If you’re also working toward SOC 2, explore our EspressoLabs SOC 2 offer to see how we can help make the journey more accessible.

Misc

• Sources: Wiz Research
• Canadian Centre for Cyber Security

Rate this:

@cxiao @ifin has a good summary that indicates... Probably? https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

🖲️ #Noticia de #CiberSeguridad #CiberGuerra #CiberAtaque #CiberNoticia
⚫ Explotación efectiva de PHP2Shell confirmada (de nuevo, ahora por KEV)
🔗 http://blog.segu-info.com.ar/2026/10/explotacion-activa-de-php2shell.html

Como ya
adelantamos hace tres días, las dos vulnerabilidades críticas de ejecución remota de código (CVE-2026-109618 y CVE-2026-109619), conocidas como
PHP2Shell, han sido explotadas con éxito en entornos controlados.

Inicialmente, la actividad maliciosa fue

An MLflow vulnerability, CVE-2026-116690, is exploited in the wild as proof-of-concept code for it and RCE flaw CVE-2026-116692 goes public. Patch now.

#MLflow #AISecurity #MLOps #CVE2026116690 #CVE2026116692 #PoC #ActiveExploitation #RCE

https://securityonline.info/mlflow-vulnerability-exploited-poc/?utm_source=mastodon&utm_medium=jetpack_social

An MLflow vulnerability, CVE-2026-116690, is exploited in the wild as proof-of-concept code for it and RCE flaw CVE-2026-116692 goes public. Patch now.

#MLflow #AISecurity #MLOps #CVE2026116690 #CVE2026116692 #PoC #ActiveExploitation #RCE

https://securityonline.info/mlflow-vulnerability-exploited-poc/?utm_source=mastodon&utm_medium=jetpack_social

Veeam fixes seven vulnerabilities in Veeam Backup for Microsoft 365 and Management Pack, including RCE flaws CVE-2023-22793 and CVE-2026-106076.

#Veeam #VeeamBackup #Microsoft365 #SystemCenter #RCE #CVE202322793 #BackupSecurity #PatchNow

https://securityonline.info/veeam-vulnerabilities-microsoft-365-management-pack/?utm_source=mastodon&utm_medium=jetpack_social

Veeam fixes seven vulnerabilities in Veeam Backup for Microsoft 365 and Management Pack, including RCE flaws CVE-2023-22793 and CVE-2026-106076.

#Veeam #VeeamBackup #Microsoft365 #SystemCenter #RCE #CVE202322793 #BackupSecurity #PatchNow

https://securityonline.info/veeam-vulnerabilities-microsoft-365-management-pack/?utm_source=mastodon&utm_medium=jetpack_social

Kerio Connect vulnerability CVE-2026-112353, a stored XSS flaw via SVG attachments, is exploited in the wild to steal mailboxes. Update to 10.0.8p2.

#KerioConnect #GFI #CVE2026112353 #XSS #EmailSecurity #Proofpoint #ActiveExploitation #PatchNow

https://securityonline.info/kerio-connect-vulnerability-cve-2026-112353-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Veeam Backup & Replication 13 (CVE-2026-108142) : une faille critique exploitable sans authentification https://www.it-connect.fr/veeam-backup-replication-13-faille-critique-cve-2026-108142/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Veeam

Red Hat OpenJDK 25.0.5 for Windows fixes CRITICAL vulns incl. CVE-2026-83374 (PKCS5 padding). Update immediately to mitigate threats. Applies to all Red Hat OpenJDK 25 Windows users. Full advisory: https://radar.offseq.com/threat/red-hat-security-advisory-openjdk-2505-security-update-for-windows-builds-b5844861bdb81e62 #OffSeq #Java #Security #RedHat

Red Hat OpenJDK 25.0.5 for Windows fixes CRITICAL vulns incl. CVE-2026-83374 (PKCS5 padding). Update immediately to mitigate threats. Applies to all Red Hat OpenJDK 25 Windows users. Full advisory: https://radar.offseq.com/threat/red-hat-security-advisory-openjdk-2505-security-update-for-windows-builds-b5844861bdb81e62 #OffSeq #Java #Security #RedHat

For those still taking notes, two bonus failures: CVE-2026-65339 let apps quietly leak your sensitive information via the Audio component, and CVE-2026-86990 let malicious apps access your camera without permission via CoreMedia. Your camera. Without asking. We trust this lands with appropriate weight.

Please update to iOS or iPadOS 18.7.11 immediately, or Human Resources will be notified.

Reward: Compliance certificate pending. Check back after you've applied the patch. (2/3)

For those still taking notes, two bonus failures: CVE-2026-65339 let apps quietly leak your sensitive information via the Audio component, and CVE-2026-86990 let malicious apps access your camera without permission via CoreMedia. Your camera. Without asking. We trust this lands with appropriate weight.

Please update to iOS or iPadOS 18.7.11 immediately, or Human Resources will be notified.

Reward: Compliance certificate pending. Check back after you've applied the patch. (2/3)

PHP "php2shell" (CVE-2026-109618/109619) is in CISA KEV and under attack: no-login code execution on PHP web servers. That includes the web UI on OPNsense, pfSense and Unraid, and PHP apps on Synology and QNAP. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the vendor update), then restart PHP.

Also: Nextcloud's built-in Collabora CODE app (CVE-2026-110447), update to 26.4.303.

This week's issue:
https://patchorpass.beehiiv.com/p/patchorpass-2-php-php2shell-exploit-patch-now-plus-nextcloud-collabora?utm_source=mastodon&utm_medium=social&utm_campaign=issue-2

#infosec #homelab #selfhosted #nextcloud

Body-parser vulnerability CVE-2026-111181 (CVSS 7.5) enables Express denial of service with one request. Upgrade to body-parser 2.4.0 or 1.20.9.

#Express #NodeJS #bodyparser #CVE2026111181 #DoS #JavaScript #npm #WebSecurity

https://securityonline.info/body-parser-vulnerability-cve-2026-111181/?utm_source=mastodon&utm_medium=jetpack_social

CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog the very next morning. RESOLUTION NOTES: Patch your on-premises VeloCloud Orchestrator across all three release trains immediately and restrict VCO access to trusted administrators only — something you arguably should have done before handing out logins like candy corn.

Reward: You've received a Tier 1 Escalation Badge and absolutely zero sympathy. (2/3)

@glyph I think what happened here has just happened to @pillow.

We published a GHSA as Moderate with no CVSS score. https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh

TIL that GitHub has their own copy of the same GHSA in their global DB, they review, adjust version ranges, and calculate a CVSS. In this case they made it a Critical with CVSS 4.0 score of 9.2. That goes into the CVE+OSV+Dependabot+world... https://github.com/advisories/GHSA-w889-685w-c8fh

Interestingly, Amazon downscored it as Important with CVSS v3 7.0
https://explore.alas.aws.amazon.com/CVE-2026-112900.html

Threat actors began probing the critical Oracle EBS vulnerability CVE-2026-101767 on honeypots within a week of Oracle releasing emergency security patches.

#Oracle #EBS #CVE2026101767 #Cybersecurity #ThreatIntel

https://meterpreter.org/oracle-ebs-vulnerability-probes/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Rapid Response: CVE-2026-101767 (CVSS 9.8) could allow unauthenticated takeover of Oracle E-Business Suite.

Censys identified 2,246 exposed web properties. Exposure does not confirm vulnerability.

Patch and investigate: https://censys.com/advisory/cve-2026-101767/

#CensysARC #Cybersecurity #VulnerabilityManagement #Oracle #InfoSec

🚨🇺🇸 Hackers begin targeting critical Oracle E-Business Suite flaw

Threat actors are scanning for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite that can be chained to remote code execution.
⠀
The vulnerability carries a CVSS score of 9.8 and affects E-Business Suite versions 12.2.3 through 12.2.15.
⠀
An attacker with HTTP access to the Thin Client Framework servlet can execute SQL with the privileges of the APPS database user and then run operating-system commands as the EBS application account.
⠀
Depending on the deployment, compromised systems may expose financial, payroll, human resources and procurement information.
⠀
Defused recorded exploratory exploitation attempts against its Oracle EBS decoys on October 27, one week after Oracle released patches. Shadowserver currently tracks more than 670 internet-exposed EBS instances, although it is unknown how many remain vulnerable.
⠀
Oracle has not classified the flaw as actively exploited, and successful compromises have not been publicly confirmed.

Administrators should immediately apply Oracle’s October 2026 Critical Patch Update. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.

Source: https://www.oracle.com/security-alerts/cpuoct2026.html

The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

@kpcyrd Those are mostly "a malicious CA can make you trust stuff you wouldn't otherwise trust through some trickery with weird DNs and extensions".

That's from the category of "if you already have root access, you can achieve arbitrary code execution".

For example CVE-2026-95209 (https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18). This is GnuTLS failing closed, and apparently that's a DoS CVE now? And some from that set then get a sky-high 9.1 CVSS base score from NIST "vulnrichment": https://github.com/cisagov/vulnrichment/blob/f291aa1cda6de51bb64b97a80628b902c04f19c2/2026/88xxx/CVE-2026-88647.json#L12.

Latest cybersecurity reports highlight critical PHP vulnerabilities being actively exploited globally, necessitating emergency patching. CISA confirmed exploitation of the Node2Shell/Brotli flaw (CVE-2026-111497). China-linked groups leveraged a BeyondTrust zero-day (CVE-2026-102764), and AI agents reportedly compromised live websites during testing (Oct 27-28, 2026). In technology, Amazon Business introduced new agentic AI tools. Geopolitically, Israel's elections are heading towards a coalition deadlock.

#Cybersecurity #AnonNews_irc #News

@kpcyrd Those are mostly "a malicious CA can make you trust stuff you wouldn't otherwise trust through some trickery with weird DNs and extensions".

That's from the category of "if you already have root access, you can achieve arbitrary code execution".

For example CVE-2026-95209 (https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18). This is GnuTLS failing closed, and apparently that's a DoS CVE now? And some from that set then get a sky-high 9.1 CVSS base score from NIST "vulnrichment": https://github.com/cisagov/vulnrichment/blob/f291aa1cda6de51bb64b97a80628b902c04f19c2/2026/88xxx/CVE-2026-88647.json#L12.

Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357.

For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#Cybersecurity #Infosec #MSP #VPN

Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357.

For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#Cybersecurity #Infosec #MSP #VPN

Notices new Ivanti CVE owo what's this?

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

https://nvd.nist.gov/vuln/detail/cve-2026-111357

This must be the unpatched vulnerability that @volexity was referring to earlier

Ivanti is working on a fix for the privilege escalation vulnerability which will be patched in a future release.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#ivanti #zeroday #cve #eitw

🚨🇦🇪 Telegram zero-day can enable code execution through malicious animated content

A vulnerability in Telegram’s rlottie animation library can allow attackers to execute arbitrary code within the application process.

Tracked as CVE-2026-111105, the flaw carries a CVSS score of 7.0 and was publicly disclosed by Trend Micro’s Zero Day Initiative after remaining unresolved at the client-code level.
⠀
The vulnerability is caused by improper validation of attacker-controlled animation data, resulting in a write before the beginning of an allocated memory buffer.
⠀
Despite reports describing the flaw as a zero-click sticker attack, ZDI’s final advisory says user interaction is required. The victim must visit a malicious page or open a malicious file for exploitation to occur.
⠀
Telegram told ZDI that server-side sticker validation mitigates the vulnerability. However, ZDI continued seeking a client-side fix and ultimately published the issue as a zero-day advisory on October 15.
⠀
No affected client versions, patched versions or confirmed in-the-wild attacks have been disclosed.

Users should keep Telegram updated and avoid opening untrusted animated files, sticker packs or external links until a client-side fix is confirmed.

Source: https://www.zerodayinitiative.com/advisories/ZDI-26-757/

Patch the Ivanti Connect Secure vulnerability now. This Ivanti Connect Secure zero-day chain with CVE-2026-104935 is actively exploited in the wild.

#Ivanti #IvantiConnectSecure #ZeroDay #CVE2026104935 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ivanti-connect-secure-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357.

For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#Cybersecurity #Infosec #MSP #VPN

Patch the Ivanti Connect Secure vulnerability now. This Ivanti Connect Secure zero-day chain with CVE-2026-104935 is actively exploited in the wild.

#Ivanti #IvantiConnectSecure #ZeroDay #CVE2026104935 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ivanti-connect-secure-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357.

For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#Cybersecurity #Infosec #MSP #VPN

CVE-2026-94055: use-after-free in Exim before 4.100.1 with non-default GnuTLS TLS settings. CVSS 3.7. Low severity, patch still under review, so track it and upgrade when 4.100.1 lands. #CVE #infosec #Exim https://www.valtersit.com/cve/CVE-2026-94055/

CVE-2026-93964 Missing auth in NginxProxyManager up to 2.15.1, CVSS 5.3, public exploit, no patch. Unauthenticated openssl processing on the validate endpoint. Update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93964/

CVE-2026-93971 info disclosure in aiyiyi121 SxDevOps 1.0/1.1, remotely exploitable, CVSS 5.3. Patch exists - update now. #CVE #infosec https://www.valtersit.com/cve/CVE-2026-93971/

CVE-2026-93974: SQL injection in SourceCodester Online Reviewer Management System 1.0, remote, exploit published, no patch. CVSS 7.3. Patch or restrict access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93974/

CVE-2026-93961: improper access control in Dromara UJCMS usernameExist lets remote attackers probe usernames, CVSS 5.3. No patch yet, vendor unresponsive. Restrict API exposure and monitor. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93961/

CVE-2026-93962 Kamailio CDP Diameter receiver heap buffer overflow, remotely exploitable, public exploit out. CVSS 8.3. No official patch yet; upgrade to 6.0.8 resolves it. Patch now. #CVE #infosec #Kamailio https://www.valtersit.com/cve/CVE-2026-93962/

CVE-2026-8177 targets perl-XML-LibXML in Red Hat products (HIGH severity). Exploitation can result in Denial of Service via malformed UTF-8 in XML node names. Update your packages now. https://radar.offseq.com/threat/red-hat-security-advisory-perl-xml-libxml-security-update-410e28a1121fd06c #OffSeq #RedHat #Perl #Vulnerability

CVE-2026-8177 targets perl-XML-LibXML in Red Hat products (HIGH severity). Exploitation can result in Denial of Service via malformed UTF-8 in XML node names. Update your packages now. https://radar.offseq.com/threat/red-hat-security-advisory-perl-xml-libxml-security-update-410e28a1121fd06c #OffSeq #RedHat #Perl #Vulnerability

🟠 CVE-2026-59185 - High (8.5)