Yoosee GM8135S Camera v21.00.01.36 faces CRITICAL risk (CVE-2026-116116): improper cryptographic signature verification in Secure Boot. Local, privileged access required. No patch; public exploit exists. Mitigate access. https://radar.offseq.com/threat/cve-2026-116116-improper-verification-of-cryptographic-signature-in-yoosee-gm8135s-camera-2ebc37c26530cbf4 #OffSeq #CVE2026116116 #IoTSec

Yoosee GM8135S Camera v21.00.01.36 faces CRITICAL risk (CVE-2026-116116): improper cryptographic signature verification in Secure Boot. Local, privileged access required. No patch; public exploit exists. Mitigate access. https://radar.offseq.com/threat/cve-2026-116116-improper-verification-of-cryptographic-signature-in-yoosee-gm8135s-camera-2ebc37c26530cbf4 #OffSeq #CVE2026116116 #IoTSec

#Nodejs released #fixes for ten #vulnerabilities, including CVE-2026-111497 in the Brotli decoder enabling remote code execution or disruption. Updates for versions 26.x, 24.x and 22.x are urged; end-of-life versions remain exposed. https://cybernews.com/security/php-node-js-vulnerabilities-patch-exploit/?eicker.news #tech #news #ainews

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws
https://isc.sans.edu/podcastdetail/10150

Oh man, light a candle for #infosec, #sysop, and #ops, cause if you thought the #php #cve was fun, wait till you hear about CVE-2026-111497, AKA as Node2Shell, HTTP2Shell, and Broccoli2Shell, a high-severity out-of-bounds write vulnerability in the Brotli decoder that can permit remote code execution (#RCE). The bug allows data to overwrite memory buffers when a process decompresses untrusted Brotli streams. It was surfaced by #OpenAI’s red team.

Fixed versions were released this weekend, but systems using system-linked Brotli libraries (e.g., Debian, Alpine) must verify their distribution-specific package updates, as the Node.js binary release does not patch those external dependencies.

While researchers from Imperva demonstrated successful code execution on a specific Node.js 24.22.0 Linux arm64 build, no widespread exploitation in the wild has been reported as of October 25, 2026..

https://nvd.nist.gov/vuln/detail/cve-2026-111497

Microsoft's out-of-band .NET security update fixes Brotli flaw CVE-2026-111497 and Linux tarball bug CVE-2026-114148. Update to 8.0.33 or 9.0.22.

#DotNET #Microsoft #Brotli #CVE2026111497 #CVE2026114148 #CVE202670197 #ASPNETCore #CyberSecurity

https://securityonline.info/dotnet-security-update-brotli-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-111497-POC

example

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

.NET October 2026 Out-of-Band Security Updates

Microsoft가 .NET 8~10 및 .NET 11 RC3용 긴급(OOB) 보안 업데이트를 배포했다. 핵심 이슈인 CVE-2026-111497은 Brotli 압축 해제 과정의 버퍼 오버플로로, 인증되지 않은 공격자가 프로세스 메모리를 읽거나 손상시켜 정보 유출·DoS·권한 상승을 유발할 수 있다. Brotli 데이터를 처리하는 ASP.NET Core 요청 압축 해제, HttpClient 자동 응답 압축 해제, System.IO.Compression Brotli API 사용 애플리케이션은 영향을 점검해야 하며, 자체 포함 배포와 컨테이너는 런타임이 포함...

https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
- **Mandatory B2B e-invoicing in Germany (2027/2028)** – XRechnung, ZUGFeRD standards, and open-source tools like *ivly*.
- **PHP vulnerabilities (PHP2Shell, CVE-2026-109618/109619)** – Critical RCE flaws leading to widespread patching and outages.
- **Node.js/Brotli exploit (CVE-2026-111497)** – RCE vulnerability affecting HTTP libraries and [1/2]

#Nodejs released #fixes for ten #vulnerabilities, including CVE-2026-111497 in the Brotli decoder enabling remote code execution or disruption. Updates for versions 26.x, 24.x and 22.x are urged; end-of-life versions remain exposed. https://cybernews.com/security/php-node-js-vulnerabilities-patch-exploit/?eicker.news #tech #news #ainews

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws
https://isc.sans.edu/podcastdetail/10150

Oh man, light a candle for #infosec, #sysop, and #ops, cause if you thought the #php #cve was fun, wait till you hear about CVE-2026-111497, AKA as Node2Shell, HTTP2Shell, and Broccoli2Shell, a high-severity out-of-bounds write vulnerability in the Brotli decoder that can permit remote code execution (#RCE). The bug allows data to overwrite memory buffers when a process decompresses untrusted Brotli streams. It was surfaced by #OpenAI’s red team.

Fixed versions were released this weekend, but systems using system-linked Brotli libraries (e.g., Debian, Alpine) must verify their distribution-specific package updates, as the Node.js binary release does not patch those external dependencies.

While researchers from Imperva demonstrated successful code execution on a specific Node.js 24.22.0 Linux arm64 build, no widespread exploitation in the wild has been reported as of October 25, 2026..

https://nvd.nist.gov/vuln/detail/cve-2026-111497

Microsoft's out-of-band .NET security update fixes Brotli flaw CVE-2026-111497 and Linux tarball bug CVE-2026-114148. Update to 8.0.33 or 9.0.22.

#DotNET #Microsoft #Brotli #CVE2026111497 #CVE2026114148 #CVE202670197 #ASPNETCore #CyberSecurity

https://securityonline.info/dotnet-security-update-brotli-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

CW: CVE-2026-111497 — memóriahiba a Google Brotli dekóderében, távoli RCE lehetősége.

Érintett: Node.js (22/24/26 javítva), Bun, Python (brotli/brotlicffi), Envoy/Istio és mások. Frissíts a javított runtime-/library-verzióra, indítsd újra a szolgáltatásokat és építsd újra a konténer-image-eket; ha nem mehetsz frissítéssel, tiltsd a br dekódolást.

https://linuxmint.hu/hir/2026/10/a-nodejs-rce-mogott-allo-brotli-dekoder-hiba-a-bun-t-a-pythont-es-mas-szeles-korben

#security #CVE-2026-111497 #NodeJS #Python #OpenSource

CW: Biztonsági — Imperva bemutatta a "Node2Shell" PoC-t: manipulált Brotli-adat távoli kódfuttatást érhet el a Node.js beépített dekóderében (CVE-2026-111497). Javítások okt.21-én kiadva (pl. 24.22.1). Érintett ágak: 22.x, 24.x, 26.x. Részletek: https://linuxmint.hu/hir/2026/10/kutatok-node2shell-rce-tamadast-mutattak-be-nodejs-build-ellen-manipulalt-brotli-adattal
#NodeJS #Brotli #CVE-2026-111497 #infosec #OpenSource

CW: biztonsági

A Node.js okt.21-i kiadásban egy Brotli dekóderben talált határon túli írás (CVE-2026-111497) távoli kódfuttatást tehet lehetővé minden támogatott ágban (22.x, 24.x, 26.x). Javított verziók: 22.23.4, 24.22.1, 26.12.1. Nincsen átmeneti workaround — frissítés szükséges. #NodeJS #Security #CVE #Brotli #OpenSource

https://linuxmint.hu/hir/2026/10/nodejs-brotli-dekoder-hibaja-tavoli-kodfuttatast-tehet-lehetove-minden-tamogatott

👉 For everyone who started #Node2Shell triage over the weekend, we see you and your huge effort! If you need a hand, we just added detection for CVE-2026-111497 to our Network Scanner, in every paid plan. ( ⏭️ Free trial link below.)

The scan tests if your endpoint decodes Brotli with a vulnerable decoder, so you see reachability (not a version guess). Once it completes, you get a PDF report with: 👇

✅ the finding and the request and response behind it

✅ the fixed release for Node.js, Bun, or Envoy

✅ the CVSS score and severity rating

✅ remediation steps you can hand to whoever owns the fix

❗One thing to check before you call it patched: the runtime hides in more places than your package.json shows. Container base images, Envoy and Istio sidecars, and Python services that use the Brotli or brotlicffi packages all carry their own copy of the decoder.

Need to check every service, rescan after each patch, or document findings for compliance? Start Node2Shell detection with the Network Scanner with a free trial. ⬇️ ⬇️ ⬇️

#Node2Shell details: https://pentest-tools.com/vulnerabilities-exploits/node2shell-brotli-decoder-remote-code-execution_29896

Free Pentest-Tools.com trial: https://app.pentest-tools.com/trial/signup

#offensivesecurity #pentesting #vulnerabilitymanagement #ethicalhacking #cybersecurity

The shit just keeps on coming 😬

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

@offby1 this might be a duplicate, but maybe not?
https://strobes.co/blog/http2shell-brotli-rce-cve-2026-111497/

@jschauma For Debian sid/unstable, there is a patched package in the Bug Tracking System by Salvatore Bonaccorso who is part of the Debian security team; his changes are also in the salsa Git repo).

The bug log seems to indicate that the Debian maintainer doesn't consider there is any hurry for sid. So I downloaded the source package, visually inspected the patch, applied it, verified that the two modified source files were now identical to those from upstream commit b418fa81c48262a86a9 which is referenced at the bottom of the Debian security tracker page for CVE-2026-111497, built the source package and upgraded the relevant binary packages.

To be on the safe side, I also uninstalled libio-compress-brotli-perl which is built from a different source package, although that one is quite possibly not affected by the bug (the package was only recommended by other packages I have installed, not depended on).

"The public PoC's own author states it plainly: the highest verified result is bounded command execution, demonstrated only on a deliberately non-PIE, ASLR-off local harness — not a portable remote exploit."

#node2shell

https://medium.com/@guidancewhite/cve-2026-111497-node2shell-how-brotlis-counter-exhaustion-turned-an-error-into-an-arbitrary-47ded2c7617b

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion: https://news.ycombinator.com/item?id=50219177

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Link: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion: https://news.ycombinator.com/item?id=50219177

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

🚨 Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

#node2shell #brotli #vuln #cybersecurity

@hrbrmstr
Sure is, and thanks!

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929/1

@ntkramer @nikolaydudaev

Ubuntu still considers the #brotli RCE (CVE-2026-111497) as "medium" priority:

https://ubuntu.com/security/CVE-2026-111497

Some other Linuxes:

AlpineLinux: https://security.alpinelinux.org/vuln/CVE-2026-111497

Debian: https://security-tracker.debian.org/tracker/CVE-2026-111497

Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-111497

RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-111497
https://access.redhat.com/security/cve/cve-2026-111497

SuSE: https://www.suse.com/security/cve/CVE-2026-111497.html

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
Link: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Comments: https://news.ycombinator.com/item?id=50219177

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Link: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion: https://news.ycombinator.com/item?id=50219177

@jerry Don't worry, it's worse than you think: https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of Brotli https://lobste.rs/s/al3yyf #security #web
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Uh oh: ⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.

ht @jerry
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Link: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
Discussion: https://news.ycombinator.com/item?id=50219177

Please be sure you don’t take your eye off the big node.js/brotli vulnerability while php2shell was sucking all the air from the room. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Oh look, a cyber soap opera: #Node2Shell gets a sequel as #HTTP2Shell, casting a wide net over unsuspecting HTTP libraries and apps. 🎭 Apparently, the solution is to drown devs in an avalanche of #buzzwords like "Advanced AppSec" and "AI SAST" while praying to the cloud gods for salvation. ☁️🔧
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 #cybersecurity #AppSec #HackerNews #ngated

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

Comments: https://news.ycombinator.com/item?id=50219177

#HackerNews #Node2Shell #HTTP2Shell #Vulnerability #Cybersecurity #HTTP2 #Libraries

Node.js Releases Critical Security Updates to Fix Brotli Remote Code Execution and Network Flaws

Node.js released security updates for 10 vulnerabilities, including a critical remote code execution flaw in the Brotli decoder (CVE-2026-111497) and multiple network validation bypasses. These vulnerabilities reside in the core runtime, requiring administrators to update host systems, rebuild container images, and restart all services.

**If you run Node.js anywhere, update it right away to version 22.23.4, 24.22.1 or 26.12.1, then rebuild any containers or apps that bundle Node.js and restart all Node.js services (your usual dependency scanners won't catch this, so check the runtime versions yourself). If you're still on old versions like 20.x, 23.x or 25.x, they will never be fixed. Move to a supported version ASAP. Until you can patch, block Brotli-compressed (br) traffic at your proxy or firewall as a temporary shield.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/node-js-releases-critical-security-updates-to-fix-brotli-remote-code-execution-and-network-flaws-e-l-q-t-c/gD2P6Ple2L

2/3 Also done today:

Checked the Node.js October security release (Brotli CVE-2026-111497). Our streaming server never decompresses untrusted Brotli data, so the risk is low. We'll update as soon as the FreeBSD package is out.

The streaming server now properly verifies the database's TLS certificate.

Rewrote our rc.d scripts the way rc.subr intends: supervisor pidfile, automatic restart after a crash, and "service restart" works on the first try. Background: https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/

Package updates on the host and in all jails

nginx: separate cache directories, a nearby DNS resolver (thousands of DNS errors gone) and a catch-all for unknown hostnames

We retired our Tor onion service

Lots of small cleanups after a deep health check

RE: https://fosstodon.org/@keepassxc/117320648185069600

🚨Attention! Yesterday, we published new 2.8.0-1 binaries for macOS (DMG) and Linux (AppImage) to fix three separate upstream Qt bugs on macOS and to ship an updated version of Brotli that fixes CVE-2026-111497.

The new version will not show up as an update automatically, but we recommend everyone to install it from https://keepassxc.org/download/ until the release of 2.8.1.

Möchte nicht wissen, wie viele Firmen diese Woche keine Updates für PHP (CVE-2026-109618, CVE-2026-109619), Node.js (CVE-2026-111497), ca-certificate (eMudhra) etc. installiert haben, weil Patchday nur 1x pro Quartal oder so.

CVE-2026-111497 is classified as CWE-787. Can *anyone* confirm that it works with ASLR enabled, or was that *completely omitted* from all reports?

Node2Shell CVE-2026-111497: Brotli Out-of-Bounds Write

https://thecybersecguru.com/exploits/node2shell-cve-2026-111497-nodejs-brotli-rce/

Node2Shell vuln affected Python too

CVE-2026-111497("Node2Shell")은 Node.js 자체 결함이 아니라 Google Brotli C 디코더의 범위를 벗어난 쓰기(CWE-787) 취약점으로, PyPI의 Brotli와 brotlicffi도 동일한 벤더드 소스를 사용해 영향을 받는다. 공격자가 조작한 Brotli 스트림을 처리하게 만들 수 있는 Python 서비스에서는 프로세스 크래시·메모리 노출·잠재적 RCE 가능성이 있으므로 Brotli를 1.2.1 이상, brotlicffi를 1.2.1.0 이상으로 즉시 업데이트해야 한다. 기사에 따르면 해당 Python 패키지의 수정 릴리스는 보안 공지 없이 배포됐고 OSV·PYSEC·...

https://opensourcemalware.com/blog/node2shell-affects-python

🟠 CVE-2026-116180 - High (7.7)

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116180 - High (7.7)

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116183 - High (7.5)

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116183 - High (7.5)

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116191 - High (7.5)

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116191 - High (7.5)

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116208 - High (8.1)

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cros...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116208 - High (8.1)

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cros...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116171 - High (7.5)

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116171 - High (7.5)

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116201 - High (8.8)

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116201 - High (8.8)

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-116207 - Critical (9.1)

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-116207 - Critical (9.1)

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116204 - High (8.1)

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116204 - High (8.1)

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116177 - High (7.5)

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116177 - High (7.5)

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116149 - High (8.1)

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116149 - High (8.1)

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116211 - High (8.2)

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116211 - High (8.2)

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116199 - High (8.1)

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116199 - High (8.1)

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: grokability Snipe-IT (<8.6.3) suffers improper auth in GoogleAuthController (CVE-2026-116199). Deactivated users can regain admin via Google SSO. Patch to 8.6.3+ now. https://radar.offseq.com/threat/cve-2026-116199-improper-authorization-in-grokability-snipe-it-c10467b7c5886087 #OffSeq #CVE2026116199 #SnipeIT #Vuln

🟠 CVE-2026-116189 - High (7.5)

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116189/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116189 - High (7.5)

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116189/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116179 - High (7.5)

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116179 - High (7.5)

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116176 - High (8.2)

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116176 - High (8.2)

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116067 - High (8.2)

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-116067 – HIGH severity path traversal in ananthakumaran paisa (<0.7.8). Unauthenticated attackers can read files & delete backups via crafted '../' filenames. Upgrade to 0.7.8+ ASAP. https://radar.offseq.com/threat/cve-2026-116067-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-001c746719f461d8 #OffSeq #PathTraversal #Security #CVE2026_116067

🟠 CVE-2026-116068 - High (8.8)

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnviro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116068/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-115251: Duplicator WordPress plugin (v1.5.17 – <5.0.0) HIGH severity. Multisite child admins can execute arbitrary PHP code in the shared plugin dir — network-wide risk. Restrict admin access & monitor usage. https://radar.offseq.com/threat/cve-2026-115251-cwe-269-improper-privilege-management-in-duplicator-a398971080f44e92 #OffSeq #WordPress #Infosec #Vuln

CVE-2026-115557 (CRITICAL): Python CPython ssl module accepted compromised certs when revocation was misconfigured. Fix: versions >3.16.0 auto-reject known bad certs via denylist. Patch now. https://radar.offseq.com/threat/cve-2026-115557-cwe-299-improper-check-for-certificate-revocation-in-python-software-foundation-cpython-fb92d56c9f38c582 #OffSeq #Python #CVE #SSL #AppSec

CVE-2026-115995 (CRITICAL): Unitree Go2 <1.1.11.5 has remote OS command injection in chat_go/set_volume (gpt_thread.py). Remote attackers could fully compromise systems. Upgrade to 1.1.11.5 ASAP. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-unitree-robotics-unitree-go2-up-to-11114-cve-2026-115995-64c6c5b520bc3457 #OffSeq #CVE #Infosec #Robotics

CVE-2026-115995 (CRITICAL, CVSS 9.4): OS command injection in Unitree Go2 (1.1.11.0 – 1.1.11.4) enables remote code execution via set_volume in chat_go. Upgrade to 1.1.11.5 to remediate. https://radar.offseq.com/threat/cve-2026-115995-os-command-injection-in-unitree-robotics-unitree-go2-28735a7dafc55240 #OffSeq #CVE2026115995 #Robotics #Vuln

🔴 CVE-2026-115995 - Critical (9.6)

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os comm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

CVE-2026-91403: How eMudhra’s Weak CA Keys Broke Java TLS Trust

https://thecybersecguru.com/news/cve-2026-91403-java-tls-vulnerability/

Oracle Java SE & GraalVM are vulnerable (CVE-2026-114820, CRITICAL, CVSS 9.1). Remote attackers can access & modify critical data via multiple network protocols. Update to the latest versions now. Details: https://radar.offseq.com/threat/cve-2026-114820-easily-exploitable-vulnerability-allows-unauthenticated-attacker-with-network-access-f9ee4fd5c21dce72 #OffSeq #JavaSecurity #CVE2026114820

CVE-2026-114820: CRITICAL vuln (CVSS 9.1) in Oracle Java SE & GraalVM (multiple supported versions) allows remote, unauthenticated attackers to access/modify critical data via JSSE APIs. Patch immediately. https://radar.offseq.com/threat/vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle-graalvm-enterprise-edition-cve-2026-dae362ae45879d06 #OffSeq #Java #Oracle #Vuln

🔴 CVE-2026-114820 - Critical (9.1)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-114820/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99054 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tipc: destroy topsrv workqueues before closing connections

tipc_topsrv_stop() closed subscriber connections while the topology
server's send and receive workqueues were still ru...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99083 - High (8.8)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerbero...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99083/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99032 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net/smc: protect clcsock lifetime in smc_getname

smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99032 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net/smc: protect clcsock lifetime in smc_getname

smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: GitroomHQ postiz-app (2.15.0 – 2.25.2) vulnerable to CVE-2026-115933. Shared secret flaw allows forging of session/invite/reset tokens — risking full account compromise. Restrict access, monitor usage. https://radar.offseq.com/threat/cve-2026-115933-cwe-290-in-gitroomhq-postiz-app-49e726f3e86131f8 #OffSeq #CVE2026115933 #AppSec #Security

🔴 CVE-2026-115933 - Critical (9.9)

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-115932 - Critical (9.6)

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-115932 (CRITICAL, CVSS 9.6) in GitroomHQ postiz-app (2.23.0 – 2.25.2): Directory traversal lets registered users read server files & send them to Discord. Disable self-registration & monitor input. https://radar.offseq.com/threat/cve-2026-115932-cwe-22-in-gitroomhq-postiz-app-59156eb748f8fa71 #OffSeq #CVE #Security #AppSec

🟠 CVE-2026-114191 - High (7.5)

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-114191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-114429: WPVR WordPress plugin (8.5.49 to <9.0.3) has a HIGH severity stored XSS (CWE-79). Contributor+ roles can inject scripts into tours, risking session hijack. Upgrade to 9.0.3+ to patch. https://radar.offseq.com/threat/cve-2026-114429-cwe-79-cross-site-scripting-xss-in-wpvr-4123adc1c7635358 #OffSeq #WordPress #XSS #Vuln

🔴 CVE-2026-99078 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-110956 - Critical (9.8)

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110956/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99051 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

fsverity: RCU-delay the freeing of struct fsverity_info

__fsverity_get_info() calls rhashtable_lookup_fast(), which just uses
rcu_read_lock() and doesn't directly synchronize wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99059 - High (7.7)

In the Linux kernel, the following vulnerability has been resolved:

wireguard: noise: reject response consumption after intermediate initiation

Two threads begin processing the identical response message, received
twice. The first thread, A, run...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99082 - High (8.8)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Use active memslots for the per-vCPU MMIO cache

KVM tags the per-vCPU MMIO cache with a memslot generation so that a
memslot update invalidates cached MMIO information...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-99079 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Prevent stale XSK buffer release on refill retry

When an XDP redirect to an AF_XDP socket fails because its RX ring is
full, the XSK core frees the buffer. During the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99013 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Reject concurrent BIS listener setup

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99013 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Reject concurrent BIS listener setup

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99042 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

io_connect_bpf_populate() fills connect.port and connect.v6_addr for
AF_INET6 only when addr_len >= sizeof(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99053 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tipc: hold a reference to nodes found by link name

tipc_node_find_by_name() returns a node after dropping its RCU read lock
without taking a reference. The LINK_SET, LINK_GET a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-115931 - Critical (9.9)

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-115931 (CRITICAL, CVSS 9.9): GitroomHQ postiz-app (2.23.0 < 2.25.2) allows file reads and backend shutdowns via unrestricted helper function access. Restrict self-registration and monitor logs. https://radar.offseq.com/threat/cve-2026-115931-cwe-470-in-gitroomhq-postiz-app-f8eeba46566eb1fe #OffSeq #CVE #Vuln #AppSec

🟠 CVE-2026-99050 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix race when arming the IRQ poll worker

gpio_mpsse_irq_enable() arms the poll worker before publishing it:
schedule_work() runs before the worker is added to priv-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99050/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-94075 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99081 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: fix DMA mapping length for padded small packets

Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99064 - High (8.1)

In the Linux kernel, the following vulnerability has been resolved:

cipso: adjust cached option offsets when removing CIPSO

cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.

For e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99056 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

strparser: make sure __strp_recv isn't running before tearing down the parser

The comment above strp_done() claims that if strp is stopped,
strp_recv will no longer be called. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99046 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

gve: fix XSK buffer leak on error descriptor

When the error bit is set in the RX completion descriptor, the buf_state
and its attached buffer should be freed. In the case of AF_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99030 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99018 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel
shadow call stack pointer (gp) only when...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99018 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel
shadow call stack pointer (gp) only when...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99016 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

riscv: futex: untag the user pointer before the atomic access

access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()
and futex_atomic_cmpxchg_inatomic() hand...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99016/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99016 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

riscv: futex: untag the user pointer before the atomic access

access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()
and futex_atomic_cmpxchg_inatomic() hand...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99016/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99014 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
address used for the PA_LINK lookup from hci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-99014 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix command skb lifetime during scan setup

During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
address used for the PA_LINK lookup from hci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-99014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110018 - High (8.8)

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/reg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116009 - High (8.8)

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url med...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116014 - High (8.1)

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116019 - High (8.8)

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116019/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-116019: Grav CMS (2.0.15 - <2.2.13) HIGH severity vuln allows users with page-edit rights to bypass allowlists & call arbitrary static methods. Impact: file deletion, overwrites, data leaks. Upgrade to 2.2.13+ https://radar.offseq.com/threat/cve-2026-116019-exposed-dangerous-method-or-function-in-getgrav-grav-5350f3be642f4f6d #OffSeq #GravCMS #Vuln

WP Social Feed Gallery (<=5.0.13) has a MEDIUM severity missing authorization vuln (CVE-2026-114705). Unauthorized access/modification possible. No patch yet — restrict access & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-114705-missing-authorization-in-quadlayers-wp-social-feed-gallery-ecc23a110959f484 #OffSeq #WordPress #Vuln #Infosec

Igor Funa Ad Inserter plugin (versions <2.8.19) has a MEDIUM severity reflected XSS vuln (CVE-2026-114194, CVSS 6.5). No known active exploits. Limit untrusted input & use WAF rules until patch confirmed. More: https://radar.offseq.com/threat/cve-2026-114194-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-77b5e2c3592fc272 #OffSeq #XSS #Infosec

🟠 CVE-2026-116011 - High (7.5)

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested obj...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116011/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-114196 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-114196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111402 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-112866 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-112866/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-115806 - Critical (9.8)

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115806/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-115806 | CRITICAL RCE in codexonics Prime Mover plugin (<=2.2.1). Unauthenticated attackers exploit unsafe PHP deserialization via wp-comments-post.php, leading to full site takeover. Avoid export/restore until patched. https://radar.offseq.com/threat/cve-2026-115806-cwe-502-deserialization-of-untrusted-data-in-codexonics-prime-mover-backup-and-0214b871cad8c626 #OffSeq #WordPress #Infosec

🟠 CVE-2026-50057 - High (7.8)

A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50057/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115938 - High (8.8)

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115935 - High (8.8)

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.

A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115935/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115937 - High (7.5)

The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:

* commerceTransactionHash — selects which Craft Commerce transaction is completed
* id — selects which M...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Wasmtime Cranelift backend suffers CRITICAL (CVSS 9.9) numeric truncation vuln (CVE-2026-115889) in <36.0.19 & >=37.0.0 <43.0.0. Risk: sandbox escape & code exec. Upgrade to 36.0.19 or 43.0.0+ now. https://radar.offseq.com/threat/cve-2026-115889-cwe-197-numeric-truncation-error-in-bytecodealliance-wasmtime-0eb82f1023cb1792 #OffSeq #CVE2026115889 #WebAssembly #Security

🔴 CVE-2026-115889 - Critical (9.9)

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115895 - High (8.8)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a Ja...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE ID: CVE-2026-110447
Vendor: Collabora
Product: Collabora Online – Built-in CODE Server
Date Added: 2026-10-23
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110447

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF

#CISA #KEV #CollaboraOnline

@Sempf CVE-2026-110447 was just added to the KEV Catalog. 3 day due date:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-110447&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=All&url=

#CISA #KEV #collaboraonline

🟠 CVE-2026-65825 - High (7.5)

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65825/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115778 - High (7.5)

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115776 - High (7.5)

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no max...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115776/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79977 - High (8.2)

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79977/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57845 - High (8.8)

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115810 - High (7.7)

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115810/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

PHP Vulnerabilities Expose Millions to Remote Code Execution Risks

Millions of websites are at risk of remote code execution attacks due to widespread PHP vulnerabilities, with over 22.6 million exposed instances identified globally. Patching these flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), is crucial to prevent exploitation.

https://osintsights.com/php-vulnerabilities-expose-millions-to-remote-code-execution-risks?utm_source=mastodon&utm_medium=social

#PhpVulnerabilities #RemoteCodeExecution #Cve2026109618 #Cve2026109619 #EmergingThreats

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Unit 42 reported that attackers leveraged agentic AI platforms for post-exploitation activity after abusing PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Targeting a European government entity, they accessed password hashes and MFA secrets within two hours, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation.

https://en.hacks.gr/nees-epitheseis-se-kyverniseis-kai-etaireies-axiopoioyn-sovara-kena-asfaleias-stin-php/

#PHP #ActiveDirectory #Vulnerability #ArtificialIntelligence

3 real PHP2Shell RCE demos with reverse-shell:

• phpMyAdmin 5.2.2 / PHP 8.4.26 (both CVEs)
https://youtu.be/dNtQxA8WSxY

• WordPress 7.1.2 / PHP 8.3.35 (both CVEs)
https://youtu.be/ln0rwy_Arjc

• PHP 8.5.4 exact lab (CVE-2026-109618)
https://youtu.be/4fdF4740Ewg

Currently building PHPCANNON. Some apps are easier to pwn than others. Got about 30-40 working exploits so far.

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

Palo Alto retracts claim of PHP2Shell exploitation at European government agency

Palo Alto Networks Unit 42는 PHP의 두 원격 코드 실행 취약점(CVE-2026-109618, CVE-2026-109619, 통칭 PHP2Shell)을 CVSS 9.2로 분류하고 즉시 패치를 권고했습니다. 취약점은 OOM 상황에서 longjmp() 기반 오류 처리가 초기화되지 않았거나 해제된 요청 메모리/전역 포인터를 남겨, 후속 요청에서 임의 코드 실행으로 이어질 수 있다는 내용입니다. 다만 유럽 정부기관 침해가 이 CVE들의 실제 악용이었다는 기존 주장은 초기 접근 경로를 확인할 수 없어...

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

"Black October 2026" marks critical cybersecurity events, including the AI-assisted discovery of PHP2Shell vulnerabilities (CVE-2026-109618/109619) leading to global government website shutdowns and emergency patching (Oct 21). Oracle Health also reported a breach impacting 20M patients. Geopolitically, the US reduced embassy staff in four Middle Eastern nations (Jordan, Lebanon, Qatar, UAE) amid escalating threats (Oct 24).
#AnonNews_irc #Cybersecurity #News

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Two severe remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP versions back to PHP 5.4 have been disclosed.

The PHP Foundation released patches only for PHP 8.2 and newer.

Agencies like CERT-EU and the NSA recommended isolating internet-facing applications if immediate remediation is not feasible.

https://en.hacks.gr/sovara-kena-asfaleias-stin-php-apeiloyn-ekatommyria-istoselides-pagkosmios-2/

#PHP #Vulnerability #WebDevelopment #SoftwareSecurity

The PHP development team released emergency security updates addressing two severe vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both with a 9.2 CVSS rating.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Apache mod_php presents the highest risk via unauthenticated requests.

Fixed versions are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

No complete wo…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-apo-tin-php-gia-dyo-sovara-provlimata/

#PHP #WebServer #Vulnerability #Patch

Two severe vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been confirmed in PHP allowing unauthenticated remote code execution.

The flaws existed in code present for over a decade and affect versions dating back to PHP 5.4.

The PHP Foundation released patches for PHP 8.2 and above on October 21, 2026.

Security agencies recommend isolating public-facing applications or taking systems offline if immediate updates a…

https://en.hacks.gr/sovara-kena-asfaleias-stin-php-apeiloyn-ekatommyria-istoselides-pagkosmios/

#PHP #CVE2026109618 #Vulnerability #Patch

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

PHP announced an out-of-cycle security release scheduled for October 21, 2026, at 14:00 UTC to address two remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619.

The official fixes apply to supported branches 8.2 through 8.5, following a pre-release notice prompted by an information leak on Hacker News.

No exploitation has been reported as of the announcement.

https://en.hacks.gr/ektaktes-enimeroseis-asfaleias-etoimazei-i-php-gia-dyo-sovara-kena/

#PHP #Vulnerability #Patch #WebDevelopment

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
- **Mandatory B2B e-invoicing in Germany (2027/2028)** – XRechnung, ZUGFeRD standards, and open-source tools like *ivly*.
- **PHP vulnerabilities (PHP2Shell, CVE-2026-109618/109619)** – Critical RCE flaws leading to widespread patching and outages.
- **Node.js/Brotli exploit (CVE-2026-111497)** – RCE vulnerability affecting HTTP libraries and [1/2]

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #technologyAtKukei https://masto.kukei.eu/browse/technology category:
Here are the most discussed topics from the Mastodon posts:

1. **PHP Vulnerabilities (PHP2Shell, CVE-2026-109618, CVE-2026-109619)**
- Critical remote code execution flaws in PHP leading to widespread patching and outages.

2. **AI and Large Language Models (LLMs)**
- Discussions on AI tools (Claude, ChatGPT, Gemini), their applications, [1/3]

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

"Black October 2026" marks critical cybersecurity events, including the AI-assisted discovery of PHP2Shell vulnerabilities (CVE-2026-109618/109619) leading to global government website shutdowns and emergency patching (Oct 21). Oracle Health also reported a breach impacting 20M patients. Geopolitically, the US reduced embassy staff in four Middle Eastern nations (Jordan, Lebanon, Qatar, UAE) amid escalating threats (Oct 24).
#AnonNews_irc #Cybersecurity #News

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

Palo Alto Networks Repor Critical PHP2Shell Flaws Affecting PAN-OS Management Interfaces

Palo Alto Networks confirms vulnerability of the management interface of PAN-OS devices to two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution.

**If you run Palo Alto firewalls or Panorama, make sure the management interface is never reachable from the internet and can be accessed only from trusted internal networks or a single jump box. Then check your version (`show system info`) and install the fixed PAN-OS hotfix for your branch as soon as it is released this week to patch CVE-2026-109618 and CVE-2026-109619.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/palo-alto-networks-repor-critical-php2shell-flaws-affecting-pan-os-management-interfaces-d-d-k-0-t/gD2P6Ple2L

PHP2Shell: What Is Easy and What Is Hard to Exploit

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of pre-authentication RCE flaws in PHP's request parser, reachable through any PHP endpoint on default configs (session upload progress and file uploads). Crashing a worker is trivial but reliable code execution needs per-build memory offsets. The problem is that one calibrated exploit works on every identical stock image like default docker images.

**If your website or application runs on PHP, update right now to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all PHP and web server workers, because a patched server with old workers still running is still vulnerable. If you can't patch immediately, set `session.upload_progress.enabled = Off` as a temporary stopgap (it blocks only one of the two attack paths), restart all workers, and watch your logs for memory errors, crashes and web processes starting shells, since a successful attack can look like a perfectly normal request.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/obstacles-to-weaponizing-php2shell-likely-constrain-immediate-widespread-exploitation-0-3-u-e-l/gD2P6Ple2L

If you are looking for detection rules for recent vulnerabilities, you can use rulezet

https://rulezet.org/vulnerability/CVE-2026-109618

It's pretty nifty.

#rulezet #opensource #opendata #cybersecurity #detectionengineering

PHP, nuova vulnerabilità RCE: rischio circoscritto e mitigazione disponibile

A pochi giorni dal rilascio delle correzioni per le vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il PHP Security Team ha comunicato il...

🔗️ [Cert-agid] https://link.is.it/fRRlPN

The wording implies they've seen php2shell being exploited in the wild, because they observed agentic post-exploitation activity? Also, their IOC's are not specific to these vulnerabilities. https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

Möchte nicht wissen, wie viele Firmen diese Woche keine Updates für PHP (CVE-2026-109618, CVE-2026-109619), Node.js (CVE-2026-111497), ca-certificate (eMudhra) etc. installiert haben, weil Patchday nur 1x pro Quartal oder so.

Clouding publica un repositori APT/YUM amb PHP per a les distribucions que Sury ja no compila: Ubuntu 14.04, 16.04, 18.04 i 20.04.

Paquets construïts des del codi font d'Ondrej Sury, amb el pegat de PHP2Shell (CVE-2026-109618 i CVE-2026-109619) inclòs. De PHP 5.6 a 8.5, un component per versió i un extra "deps".

https://php-repos.clouding.io/es

#php #php2shell #seguretat #linux

CW: kritikus PHP-sebezhetőségek (CVE-2026-109618, CVE-2026-109619) távoli kódfuttatást tesznek lehetővé. Javítások: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Érint: PHP‑FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed. Nincs teljes kerülő; telepítsd a javítást és indítsd újra a PHP workereket. Részletek: https://linuxmint.hu/hir/2026/10/kritikus-php-sebezhetosegek-tavoli-kodfuttatast-tesznek-lehetove-surgossegi-javitasok #PHP #CVE #InfoSec #OpenSource

"Black October" marks a cybersecurity alarm, with experts warning of expanding AI-enabled hacking following a severe PHP vulnerability discovered this week. Millions of PHP2Shell exploit attempts are deploying Mirai malware via RCE flaws (CVE-2026-109618/19). Additionally, China-linked APT41 is suspected in BlackX UEFI bootkit attacks targeting Central Asian diplomats. Geopolitically, Moscow agreed to resume peace talks with Ukraine but ruled out a ceasefire (Oct 23, 2026).

#AnonNews_irc #Cybersecurity #News

Півчетвертої ночі закінчили термінові правки на нашому сервері. Причина в тому, що в світі знайшли дві критичні вразливості в самій мові PHP. Їх назвали PHP2Shell, це CVE-2026-109618 і CVE-2026-109619. Оцінка 9.2 з 10, а для експлуатації не потрібна авторизація.

Основна наша система написана іншою мовою, але кілька окремих сервісів працювали на PHP. Ми несемо відповідальність за все, що крутиться на нашому сервері, тому закрили всі.

Що відомо станом на зараз.

Виправлення вийшли 21 жовтня у версіях 8.5.12, 8.4.27, 8.3.36 та 8.2.35. Старші гілки офіційних патчів не отримали.

Знайшли діри дослідники з допомогою моделей ШІ: першу версію компанія Calif ще в серпні, а Wiz незалежно виявила обидві. Дослідники кажуть, що вада існувала роками, але ШІ зробив її експлуатацію практичною.

Інформація витекла за день до виходу патчу. Спроби атак фіксували ще 17 жовтня, за кілька днів до публічного розкриття. Деякі уряди, за повідомленнями, на час відключили свої сайти.

Масштаб. PHP стоїть на близько 70% сайтів, де відома серверна мова. Це не означає, що стільки зламано: надійних цифр підтверджених зломів поки немає, і дослідники пишуть, що експлуатація складніша, ніж здавалось у перший день. Але ризик реальний, а старих версій без підтримки в мережі дуже багато.

Що зробити вам.

Перевірте, чи є PHP на сервері та в контейнерах: php -v, docker images.
Оновіть PHP і перезапустіть php-fpm або веб-сервер.
Якщо оновитись не можете одразу, вимкніть session.upload_progress.enabled.
Подивіться на дивні дочірні процеси від користувача веб-сервера і нові php файли.
Якщо сервіси були відкриті в мережі з 17 жовтня, змініть ключі та токени.

Бережіть себе і свої сервери 🙏

#PHP #PHP2Shell #Security #InfoSec #CVE #Fediverse #Linux #DevOps #SelfHosting

PHP Vulnerabilities Expose Millions to Remote Code Execution Risks

Millions of websites are at risk of remote code execution attacks due to widespread PHP vulnerabilities, with over 22.6 million exposed instances identified globally. Patching these flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), is crucial to prevent exploitation.

https://osintsights.com/php-vulnerabilities-expose-millions-to-remote-code-execution-risks?utm_source=mastodon&utm_medium=social

#PhpVulnerabilities #RemoteCodeExecution #Cve2026109618 #Cve2026109619 #EmergingThreats

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Unit 42 reported that attackers leveraged agentic AI platforms for post-exploitation activity after abusing PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Targeting a European government entity, they accessed password hashes and MFA secrets within two hours, established an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation.

https://en.hacks.gr/nees-epitheseis-se-kyverniseis-kai-etaireies-axiopoioyn-sovara-kena-asfaleias-stin-php/

#PHP #ActiveDirectory #Vulnerability #ArtificialIntelligence

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

Palo Alto retracts claim of PHP2Shell exploitation at European government agency

Palo Alto Networks Unit 42는 PHP의 두 원격 코드 실행 취약점(CVE-2026-109618, CVE-2026-109619, 통칭 PHP2Shell)을 CVSS 9.2로 분류하고 즉시 패치를 권고했습니다. 취약점은 OOM 상황에서 longjmp() 기반 오류 처리가 초기화되지 않았거나 해제된 요청 메모리/전역 포인터를 남겨, 후속 요청에서 임의 코드 실행으로 이어질 수 있다는 내용입니다. 다만 유럽 정부기관 침해가 이 CVE들의 실제 악용이었다는 기존 주장은 초기 접근 경로를 확인할 수 없어...

https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

Two severe remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP versions back to PHP 5.4 have been disclosed.

The PHP Foundation released patches only for PHP 8.2 and newer.

Agencies like CERT-EU and the NSA recommended isolating internet-facing applications if immediate remediation is not feasible.

https://en.hacks.gr/sovara-kena-asfaleias-stin-php-apeiloyn-ekatommyria-istoselides-pagkosmios-2/

#PHP #Vulnerability #WebDevelopment #SoftwareSecurity

The PHP development team released emergency security updates addressing two severe vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both with a 9.2 CVSS rating.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Apache mod_php presents the highest risk via unauthenticated requests.

Fixed versions are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

No complete wo…

https://en.hacks.gr/epeigoyses-enimeroseis-asfaleias-apo-tin-php-gia-dyo-sovara-provlimata/

#PHP #WebServer #Vulnerability #Patch

Two severe vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been confirmed in PHP allowing unauthenticated remote code execution.

The flaws existed in code present for over a decade and affect versions dating back to PHP 5.4.

The PHP Foundation released patches for PHP 8.2 and above on October 21, 2026.

Security agencies recommend isolating public-facing applications or taking systems offline if immediate updates a…

https://en.hacks.gr/sovara-kena-asfaleias-stin-php-apeiloyn-ekatommyria-istoselides-pagkosmios/

#PHP #CVE2026109618 #Vulnerability #Patch

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

PHP announced an out-of-cycle security release scheduled for October 21, 2026, at 14:00 UTC to address two remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619.

The official fixes apply to supported branches 8.2 through 8.5, following a pre-release notice prompted by an information leak on Hacker News.

No exploitation has been reported as of the announcement.

https://en.hacks.gr/ektaktes-enimeroseis-asfaleias-etoimazei-i-php-gia-dyo-sovara-kena/

#PHP #Vulnerability #Patch #WebDevelopment

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #technologyAtKukei https://masto.kukei.eu/browse/technology category:
Here are the most discussed topics from the Mastodon posts:

1. **PHP Vulnerabilities (PHP2Shell, CVE-2026-109618, CVE-2026-109619)**
- Critical remote code execution flaws in PHP leading to widespread patching and outages.

2. **AI and Large Language Models (LLMs)**
- Discussions on AI tools (Claude, ChatGPT, Gemini), their applications, [1/3]

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisco, Citrix, F5 and more.

#PHP2Shell #PHP #CVE2026109618 #CVE2026109619 #PatchNow #QNAP #PaloAltoNetworks #CyberSecurity

https://securityonline.info/php2shell-affected-products-list/?utm_source=mastodon&utm_medium=jetpack_social

Censys’ PHP2Shell tracker reports 32.4M PHP services still running affected versions tied to CVE-2026-109618 and CVE-2026-109619; 9.78M have moved to fixed releases. Version-based counts are estimates, not proof of exploitability. 🔎 https://php2shell.censys.com/ #PHP #Cybersecurity

Patch your sh!t ffs…

L’atac encadenava quatre peticions: pressió de memòria, desbordament de memòria a través d’una cookie de sessió, més pressió i, finalment, l’etapa d’execució. L’informe vincula aquest atac a CVE-2026-109618, no a la via del CVE-2026-109619

PHP2Shell és el nom amb què la indústria de seguretat agrupa les dues vulnerabilitats crítiques del nucli de PHP, CVE-2026-109618 i CVE-2026-109619, que han causat una onada de pànic i d'actualitzacions a correcuita de servidors aquesta setmana

⚠️ CRITICAL: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks confirmed two critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PAN-OS and multiple network products. Public proof-of-concept exploits exist for the underlying PHP2Shell flaws, enabling unauthenticated remote code execution. All Palo Alto management interf…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.

What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.

Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.

As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.

#php #cybersecurity #patchmanagement #php2shell #wordpress

Palo Alto Networks Repor Critical PHP2Shell Flaws Affecting PAN-OS Management Interfaces

Palo Alto Networks confirms vulnerability of the management interface of PAN-OS devices to two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution.

**If you run Palo Alto firewalls or Panorama, make sure the management interface is never reachable from the internet and can be accessed only from trusted internal networks or a single jump box. Then check your version (`show system info`) and install the fixed PAN-OS hotfix for your branch as soon as it is released this week to patch CVE-2026-109618 and CVE-2026-109619.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/palo-alto-networks-repor-critical-php2shell-flaws-affecting-pan-os-management-interfaces-d-d-k-0-t/gD2P6Ple2L

PHP2Shell: What Is Easy and What Is Hard to Exploit

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) is a pair of pre-authentication RCE flaws in PHP's request parser, reachable through any PHP endpoint on default configs (session upload progress and file uploads). Crashing a worker is trivial but reliable code execution needs per-build memory offsets. The problem is that one calibrated exploit works on every identical stock image like default docker images.

**If your website or application runs on PHP, update right now to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all PHP and web server workers, because a patched server with old workers still running is still vulnerable. If you can't patch immediately, set `session.upload_progress.enabled = Off` as a temporary stopgap (it blocks only one of the two attack paths), restart all workers, and watch your logs for memory errors, crashes and web processes starting shells, since a successful attack can look like a perfectly normal request.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/obstacles-to-weaponizing-php2shell-likely-constrain-immediate-widespread-exploitation-0-3-u-e-l/gD2P6Ple2L

PHP, nuova vulnerabilità RCE: rischio circoscritto e mitigazione disponibile

A pochi giorni dal rilascio delle correzioni per le vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il PHP Security Team ha comunicato il...

🔗️ [Cert-agid] https://link.is.it/fRRlPN

The wording implies they've seen php2shell being exploited in the wild, because they observed agentic post-exploitation activity? Also, their IOC's are not specific to these vulnerabilities. https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/

Möchte nicht wissen, wie viele Firmen diese Woche keine Updates für PHP (CVE-2026-109618, CVE-2026-109619), Node.js (CVE-2026-111497), ca-certificate (eMudhra) etc. installiert haben, weil Patchday nur 1x pro Quartal oder so.

Clouding publica un repositori APT/YUM amb PHP per a les distribucions que Sury ja no compila: Ubuntu 14.04, 16.04, 18.04 i 20.04.

Paquets construïts des del codi font d'Ondrej Sury, amb el pegat de PHP2Shell (CVE-2026-109618 i CVE-2026-109619) inclòs. De PHP 5.6 a 8.5, un component per versió i un extra "deps".

https://php-repos.clouding.io/es

#php #php2shell #seguretat #linux

CW: kritikus PHP-sebezhetőségek (CVE-2026-109618, CVE-2026-109619) távoli kódfuttatást tesznek lehetővé. Javítások: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Érint: PHP‑FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed. Nincs teljes kerülő; telepítsd a javítást és indítsd újra a PHP workereket. Részletek: https://linuxmint.hu/hir/2026/10/kritikus-php-sebezhetosegek-tavoli-kodfuttatast-tesznek-lehetove-surgossegi-javitasok #PHP #CVE #InfoSec #OpenSource

PHP 漏洞通報是個失誤

原發文者承認，自己曾在 Hacker News 提前提及 PHP 即將修補的兩項可造成遠端程式碼執行（RCE, Remote Code Execution）的弱點，編號為 CVE（Common Vulnerabilities and Exposures，公開資安弱點編號）-2026-109618 與 CVE-2026-109619。他原本只是想提醒同樣自行編譯 PHP 的人儘快留意更新，卻意外干擾協調式弱點揭露（coordinated disclosure，讓修補與公開時程配合的做法），使既定公開時程調整，也增加許多人的應變負擔，因此公開致歉並表示願意承擔責任。

他說，發文當下完全不知道存在保密期限（embargo）；他的消息來源告知沒有保密約定，而對方也是從更上游得到相同說法。這起事件讓他深感不安、睡眠受影響，並認為自己的善意提醒造成了意料之外的連鎖效應。他也表示，日後會更謹慎處理未公開的資安訊息。
https://news.ycombinator.com/item?id=50193416
#php

Півчетвертої ночі закінчили термінові правки на нашому сервері. Причина в тому, що в світі знайшли дві критичні вразливості в самій мові PHP. Їх назвали PHP2Shell, це CVE-2026-109618 і CVE-2026-109619. Оцінка 9.2 з 10, а для експлуатації не потрібна авторизація.

Основна наша система написана іншою мовою, але кілька окремих сервісів працювали на PHP. Ми несемо відповідальність за все, що крутиться на нашому сервері, тому закрили всі.

Що відомо станом на зараз.

Виправлення вийшли 21 жовтня у версіях 8.5.12, 8.4.27, 8.3.36 та 8.2.35. Старші гілки офіційних патчів не отримали.

Знайшли діри дослідники з допомогою моделей ШІ: першу версію компанія Calif ще в серпні, а Wiz незалежно виявила обидві. Дослідники кажуть, що вада існувала роками, але ШІ зробив її експлуатацію практичною.

Інформація витекла за день до виходу патчу. Спроби атак фіксували ще 17 жовтня, за кілька днів до публічного розкриття. Деякі уряди, за повідомленнями, на час відключили свої сайти.

Масштаб. PHP стоїть на близько 70% сайтів, де відома серверна мова. Це не означає, що стільки зламано: надійних цифр підтверджених зломів поки немає, і дослідники пишуть, що експлуатація складніша, ніж здавалось у перший день. Але ризик реальний, а старих версій без підтримки в мережі дуже багато.

Що зробити вам.

Перевірте, чи є PHP на сервері та в контейнерах: php -v, docker images.
Оновіть PHP і перезапустіть php-fpm або веб-сервер.
Якщо оновитись не можете одразу, вимкніть session.upload_progress.enabled.
Подивіться на дивні дочірні процеси від користувача веб-сервера і нові php файли.
Якщо сервіси були відкриті в мережі з 17 жовтня, змініть ключі та токени.

Бережіть себе і свої сервери 🙏

#PHP #PHP2Shell #Security #InfoSec #CVE #Fediverse #Linux #DevOps #SelfHosting

🟠 CVE-2026-50056 - High (7.8)

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10632 - High (8.7)

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10632/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106765 - High (7.5)

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-107685: agentjido req_llm WebSocket client (1.9.0 – 1.28.x) disables TLS certificate validation, letting on-path attackers hijack or modify OpenAI sessions 🛡️ Avoid vulnerable versions & monitor vendor updates. https://radar.offseq.com/threat/improper-certificate-validation-vulnerability-in-the-websocket-streaming-client-in-agentjido-reqllm-46b1400882c2a012 #OffSeq #CVE #Vulnerability #Cybersecurity

Okta Patches Command Injection and Authentication Bypass in Access Gateway

Okta released security updates for Access Gateway to fix a command injection flaw (CVE-2026-115547) and an authentication bypass (CVE-2026-115546) that allow attackers to take full control of the appliance. The updates also address two remote code execution vulnerabilities in the PHP runtime used by the gateway.

**If you run Okta Access Gateway, upgrade it to version 2026.10.2 or later to fix the admin takeover flaws, and install version 2026.44.0 to fix the PHP flaws. Make sure the Admin Console can only be reached from trusted internal IP addresses, and check for any unexpected admin logins or configuration changes.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/okta-patches-command-injection-and-authentication-bypass-in-access-gateway-r-q-6-8-m/gD2P6Ple2L

Okta Patches Command Injection and Authentication Bypass in Access Gateway

Okta released security updates for Access Gateway to fix a command injection flaw (CVE-2026-115547) and an authentication bypass (CVE-2026-115546) that allow attackers to take full control of the appliance. The updates also address two remote code execution vulnerabilities in the PHP runtime used by the gateway.

**If you run Okta Access Gateway, upgrade it to version 2026.10.2 or later to fix the admin takeover flaws, and install version 2026.44.0 to fix the PHP flaws. Make sure the Admin Console can only be reached from trusted internal IP addresses, and check for any unexpected admin logins or configuration changes.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/okta-patches-command-injection-and-authentication-bypass-in-access-gateway-r-q-6-8-m/gD2P6Ple2L

Okta Patches Command Injection and Authentication Bypass in Access Gateway

Okta released security updates for Access Gateway to fix a command injection flaw (CVE-2026-115547) and an authentication bypass (CVE-2026-115546) that allow attackers to take full control of the appliance. The updates also address two remote code execution vulnerabilities in the PHP runtime used by the gateway.

**If you run Okta Access Gateway, upgrade it to version 2026.10.2 or later to fix the admin takeover flaws, and install version 2026.44.0 to fix the PHP flaws. Make sure the Admin Console can only be reached from trusted internal IP addresses, and check for any unexpected admin logins or configuration changes.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/okta-patches-command-injection-and-authentication-bypass-in-access-gateway-r-q-6-8-m/gD2P6Ple2L

Okta Patches Command Injection and Authentication Bypass in Access Gateway

Okta released security updates for Access Gateway to fix a command injection flaw (CVE-2026-115547) and an authentication bypass (CVE-2026-115546) that allow attackers to take full control of the appliance. The updates also address two remote code execution vulnerabilities in the PHP runtime used by the gateway.

**If you run Okta Access Gateway, upgrade it to version 2026.10.2 or later to fix the admin takeover flaws, and install version 2026.44.0 to fix the PHP flaws. Make sure the Admin Console can only be reached from trusted internal IP addresses, and check for any unexpected admin logins or configuration changes.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/okta-patches-command-injection-and-authentication-bypass-in-access-gateway-r-q-6-8-m/gD2P6Ple2L

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Storybook dev server vulnerability CVE-2026-114125 (CVSS 9.4) enables code injection from malicious websites. Upgrade to 10.6.2, 9.1.21 or 8.6.19.

#Storybook #CVE2026114125 #CodeInjection #JavaScript #npm #DevSecOps #SupplyChain #CyberSecurity

https://securityonline.info/storybook-dev-server-vulnerability-cve-2026-114125/?utm_source=mastodon&utm_medium=jetpack_social

Storybook dev server vulnerability CVE-2026-114125 (CVSS 9.4) enables code injection from malicious websites. Upgrade to 10.6.2, 9.1.21 or 8.6.19.

#Storybook #CVE2026114125 #CodeInjection #JavaScript #npm #DevSecOps #SupplyChain #CyberSecurity

https://securityonline.info/storybook-dev-server-vulnerability-cve-2026-114125/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.

#Ruby #Onigmo #GitLab #CVE2026110264 #CVE202697229 #CVE202689078 #RCE #CyberSecurity

https://securityonline.info/ruby-security-update-onigmo-gitlab-cves/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.

#Ruby #Onigmo #GitLab #CVE2026110264 #CVE202697229 #CVE202689078 #RCE #CyberSecurity

https://securityonline.info/ruby-security-update-onigmo-gitlab-cves/?utm_source=mastodon&utm_medium=jetpack_social

This week has been extremely busy. I have seen 4x RCE vulnerabilities, compromised eMudhra CA certificates that spill into their own CVE for Java with a CVSS of 9.1, and 3x DoS type of vulnerabilities, all in very popular and widely used software that can either crash under specific conditions or give remote code execution capabilities to threat actors. The mentioned vulnerabilities are:

PHP RCE: CVE-2026-109618/109619/115560
Gitlab RCE: CVE-2026-110264
Node2Shell \ HTTP2Shell RCE: CVE-2026-111497
ISC Bind 9 RCE: CVE-2026-94300

ISC Bind 9 DoS: CVE-2026-19630/96888/97313
Windows SMB Server DoS: CVE-2026-91403
Unbound DNS-over-QUIC Bug: CVE-2026-97206
Oracle Java (JSSE) containing compromised eMudhra certificates: CVE-2026-91403

Patching all these vulnerabilities on endpoints and servers will take a humungous amount of time and effort, as it can't be done overnight and is heavily dependent on the size of your environment. It's good that we are getting security patches for software that had critical vulnerabilities present for years without anyone discovering them, like in the Gitlab case where the RCE vulnerability went undiscovered for 12 years across all their releases.

What will happen over the coming years is that we will get a massive influx of vulnerabilities just like the one seen this week, but over time it will stabilise more as software becomes more secure, and we will start seeing fewer vulnerabilities overall.

#Gitlab #eMudhra #Node2Shell #CyberSecurity #Vulnerabilities

CW: technikai sebezhetőség

Ruby 4.0.9, 3.4.12 és 3.3.13 javít három Onigmo regex-motort érintő hibát, amelyek négy kritikus GitLab RCE-hez vezettek (pl. CVE-2026-110264, CVE-2026-97229). Érintett: ha támadó-vezérelt sztringből fordítasz Regexp.new/union/compile vagy /#{input}/-et. Ideiglenes védelem: ne fordíts megbízhatatlan bemenetet; Regexp.timeout vagy mintahossz nem elég. Részletek: https://linuxmint.hu/hir/2026/10/harom-regexmotor-hibat-javitott-a-ruby-negy-kritikus-gitlab-rce-sebezhetoseget-okoztak

#Ruby #GitLab #CVE #InfoSec #OpenSource

CW: security

Kritikus, hitelesítés nélküli RCE a GitLabban — CVE-2026-110264 (CVSS 10.0). Érint minden saját üzemeltetésű kiadást 7.0 óta. Frissítsetek a javított kiadásokra: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 vagy 18.11.13. GitLab.com és Dedicated már kapta a javítást. Részletek: https://linuxmint.hu/hir/2026/10/kritikus-gitlab-sebezhetoseg-cvss-100-hitelesites-nelkuli-rce-t-tehet-lehetove-12-evnyi

#GitLab #CVE2026 #infosec #OpenSource

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.