Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #newsAtKukei https://masto.kukei.eu/browse/news category:
- **Ukraine drone strikes on Russian data centers** disrupting cloud services, payment systems, and navigation apps.
- **New critical PHP vulnerability (CVE-2026-111497)** affecting servers, with active exploits emerging.
- **Swiss churches issue joint ethical AI guidelines** addressing humanity in the digital age.
- **US DOJ sues to block Alaska [1/2]

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

node2shell (CVE-2026-111497): What to patch and how to find exposed services
#CVE_2026_111497 #Node.js
https://cycode.com/blog/node2shell-cve-2026-111497/

So, uhm, sounds like #node2shell CVE-2026-111497 is not restricted to nodejs alone, but any Google Brotli consumer. I don't think that's been called out widely. Check your other integrations.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

Imperva demonstrated remote code execution on stock Node.js 24 via an out-of-bounds write in the bundled Brotli decoder, CVE-2026-111497. Any service decompressing untrusted Brotli input risks full server compromise. #NodeJs #BrotliDecoder #AppSec

https://cyberworldops.eu/en/crafted-brotli-input-yields-code-execution-on-a-stock-nodejs-24-build

#git command https remote is affected by the #brotli buffer overflow vulnerability CVE-2026-111497 since it enables compression support:

https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/http.c#L2284
https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/remote-curl.c#L980

Make sure to update brotli as soon as possible.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

#infosec #cybersecurity #CVE_2026_111497

For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497

#infosec #cybersecurity #CVE_2026_111497

Node2Shell : la faille Brotli qui expose Node.js à une exécution de code à distance https://www.it-connect.fr/node2shell-nodejs-brotli-rce-cve-2026-111497/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

The brotli problem is indeed in the C library:

CVE-2026-111497: out-of-bounds write permits remote code execution

A public PoC is out for CVE-2026-114509, a Laravel authentication bypass in TokenGuard enabling account takeover. Upgrade to 12.68.0 or 13.29.0.

#Laravel #TokenGuard #CVE2026114509 #AuthBypass #PoC #PHP #WebSecurity #CyberSecurity

https://securityonline.info/laravel-authentication-bypass-cve-2026-114509-poc/?utm_source=mastodon&utm_medium=jetpack_social

CVE ID: CVE-2026-110447
Vendor: Collabora
Product: Collabora Online – Built-in CODE Server
Date Added: 2026-10-23
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110447

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF

#CISA #KEV #CollaboraOnline

@Sempf CVE-2026-110447 was just added to the KEV Catalog. 3 day due date:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-110447&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=All&url=

#CISA #KEV #collaboraonline

CVE ID: CVE-2026-110447
Vendor: Collabora
Product: Collabora Online – Built-in CODE Server
Date Added: 2026-10-23
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110447

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF

#CISA #KEV #CollaboraOnline

@Sempf CVE-2026-110447 was just added to the KEV Catalog. 3 day due date:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-110447&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=All&url=

#CISA #KEV #collaboraonline

CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT
Description:
Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI ...

https://aws.amazon.com/security/security-bulletins/rss/2026-146-aws/

#aws #security

CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT
Description:
Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI ...

https://aws.amazon.com/security/security-bulletins/rss/2026-146-aws/

#aws #security

🟠 CVE-2026-79982 - High (8.8)

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79982 - High (8.8)

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79979 - High (7.8)

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79979 - High (7.8)

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79977 - High (8.2)

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79977/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79977 - High (8.2)

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79977/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-107685 (CRITICAL, CVSS 9.1): agentjido req_llm <1.29.0 WebSocket client disables TLS verification, exposing OpenAI sessions to MITM attacks. Restrict use or network access until patched. https://radar.offseq.com/threat/cve-2026-107685-cwe-295-improper-certificate-validation-in-agentjido-reqllm-c06aa809808f4159 #OffSeq #CVE #infosec #vulnerability

CISA warns of nine Kiloview E3 vulnerabilities in the NDI encoder, including CVSS 9.9 flaws CVE-2026-107861 and CVE-2026-110243. Update to V1.30.

#Kiloview #NDI #CVE2026107861 #CVE2026110243 #CVE202692450 #CISA #ICS #CyberSecurity

https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/?utm_source=mastodon&utm_medium=jetpack_social

Kiloview E3 firmware (<1.30) hit by CVE-2026-107861: CRITICAL command injection (CWE-78). Authenticated users can execute OS commands as root — full device compromise possible. Patch unavailable. Restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-107861-cwe-78-in-kiloview-e3-firmware-23f97073d04a678f #OffSeq #Infosec #Vuln

CISA warns of nine Kiloview E3 vulnerabilities in the NDI encoder, including CVSS 9.9 flaws CVE-2026-107861 and CVE-2026-110243. Update to V1.30.

#Kiloview #NDI #CVE2026107861 #CVE2026110243 #CVE202692450 #CISA #ICS #CyberSecurity

https://securityonline.info/kiloview-e3-vulnerabilities-ndi-encoder/?utm_source=mastodon&utm_medium=jetpack_social

Kiloview E3 Firmware (<1.30) hit by CVE-2026-110243, a CRITICAL command injection (CVSS 9.9). Authenticated users with network config can execute root OS commands. No patch — restrict interface access. Details: https://radar.offseq.com/threat/cve-2026-110243-cwe-78-in-kiloview-e3-firmware-b693a1be0d634280 #OffSeq #Infosec #Kiloview #CVE2026110243

🟠 CVE-2026-115863 - High (7.6)

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dn...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115863/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-115863 - High (7.6)

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dn...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115863/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-55981 in Creative Sound Blaster Katana V2, V2X, SE (v1.30.260813.1100) allows firmware modification & upload. No fix yet — monitor for updates and restrict device access. https://radar.offseq.com/threat/cve-2026-55981-vulnerability-in-creative-labs-creative-sound-blaster-katana-v2-v2x-se-b5b2482bb26c4567 #OffSeq #infosec #firmware #vulnerability

CVE-2026-54630 (CRITICAL): Part-DB-server <2.12.1 lets authenticated users upload .phar files, enabling remote code execution as www-data. Patch to 2.12.1+ and restrict user permissions. https://radar.offseq.com/threat/cve-2026-54630-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-part-db-part-db-server-3e3f77096f8d900f #OffSeq #CVE #RCE #infosec

🔴 CVE-2026-115812 - Critical (9.8)

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.

Multi Model Server is end of life and no fixed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115812/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-115812 - Critical (9.8)

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.

Multi Model Server is end of life and no fixed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115812/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:1023] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-114625 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-114625)
- Name: Arista VeloCloud Orchestrator SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Arista
- Product: VeloCloud Orchestrator
- Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114625

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261023 #cisa20261023 #cve_2026_114625 #cve2026114625

🔴 New security advisory:

CVE-2026-114625 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-114625-velocloud-orchestrator-privilege-escalation-exploited-in

by Yazoul AI

#InfoSec #SecurityPatching #HackerNews

CVE ID: CVE-2026-114625
Vendor: Arista
Product: VeloCloud Orchestrator
Date Added: 2026-10-23
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114625

🚨 [CISA-2026:1023] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1023)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-114625 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-114625)
- Name: Arista VeloCloud Orchestrator SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Arista
- Product: VeloCloud Orchestrator
- Notes: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114625

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261023 #cisa20261023 #cve_2026_114625 #cve2026114625

CVE ID: CVE-2026-114625
Vendor: Arista
Product: VeloCloud Orchestrator
Date Added: 2026-10-23
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114625

Arista Fixes Actively Exploited VeloCloud Orchestrator Zero-Day

Arista patched a critical SQL injection zero-day (CVE-2026-114625) in VeloCloud Orchestrator that allows low-privileged users to gain full superuser control. Attackers are currently using this flaw to compromise SD-WAN management systems and potentially access connected edge devices.

**If you run an on-premises VeloCloud Orchestrator, this is urgent. Your VeloCloud is under active attack. Update immediately to version 5.2.3.18, 6.1.3.10 or 6.4.2.12, and make sure the web management interface is reachable only from trusted admin networks. Before patching, save all system and database logs. Block 74.82.197.86 and 38.54.50.151 and check your web logs for odd URL paths or bursts of requests. If anything looks suspicious, change all passwords and credentials stored in the orchestrator.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/arista-fixes-actively-exploited-velocloud-orchestrator-zero-day-e-o-u-v-8/gD2P6Ple2L

CVE-2026-114625: CRITICAL SQL injection in Arista VeloCloud Orchestrator (<5.2.3.18, <6.1.3.10, <6.4.2.12). Actively exploited! Authenticated users can escalate to operator. Patch ASAP. Block 74.82.197.86 & 38.54.50.151. https://radar.offseq.com/threat/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months-d21f081e4a87c8fd #OffSeq #Vulnerability #Arista

Arista patched CVE-2026-114625 in on-prem VeloCloud Orchestrator, confirmed under active exploitation. Compromise of VCO risks full SD-WAN management plane control. Patch immediately and review orchestrator logs for anomalous access. #Arista #VeloCloud #ZeroDay #ThreatIntel

https://cyberworldops.eu/en/arista-fixes-velocloud-orchestrator-flaw-under-active-exploitation-cve

Cybersecurity Awareness Month isn't over yet: Arista VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625 (CVSSv3.1: 9.9 critical , CVSS4: 9.4)

This issue was detected by Arista and is known to be actively exploited.

https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

#arista #zeroday #CVE #eitw

🚨 Critical Arista VeloCloud Orchestrator SQL injection flaw actively exploited

Arista has disclosed CVE-2026-114625, a critical vulnerability affecting on-premises VeloCloud Orchestrator deployments.
⠀
The SQL injection flaw allows any authenticated user, including someone with the lowest built-in Enterprise Read Only role, to gain operator privileges and impersonate a local “superuser operator.”

Arista says the vulnerability is being actively exploited.
⠀
CVSS: 9.9

Affected:

• VCO 5.2.x before 5.2.3.18
• VCO 6.1.x before 6.1.3.10
• VCO 6.4.x before 6.4.2.12

Fixed:

• VCO 5.2.3.18
• VCO 6.1.3.10
• VCO 6.4.2.12
⠀
Hosted and Dedicated instances have already been patched. VeloCloud Edge and Gateway products are not directly affected.

Administrators should update immediately and investigate affected systems for signs of compromise.

Source: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

Arista says VeloCloud Orchestrator vulnerability CVE-2026-114625, a CVSS 9.9 SQL injection, is exploited in the wild. Upgrade on-prem VCO now.

#Arista #VeloCloud #CVE2026114625 #SQLInjection #SDWAN #ExploitedInTheWild #ZeroDay #CyberSecurity

https://securityonline.info/velocloud-orchestrator-cve-2026-114625-exploited/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-87901 - High (8.3)

Improper sanitization in the registration module allows reflected Cross-Site Scripting.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-87901 - High (8.3)

Improper sanitization in the registration module allows reflected Cross-Site Scripting.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93640 - High (7.8)

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93640/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-46651 - Critical (9.8)

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core ac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55486 - Critical (9.3)

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) https://jackalsyn.com/posts/php-up-2026.html

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) https://aws.amazon.com/security/security-bulletins/2026-143-aws/

Rad Web Hosting Completes Critical Security Updates Across All Managed cPanel Servers

October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.

Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting prioritized the ...
Continued 👉 https://blog.radwebhosting.com/rad-web-hosting-completes-critical-security-updates-across-all-managed-cpanel-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
1. **Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)**
- Remote code execution flaws in PHP (CVSS 9.2) affecting ~70% of websites. Patches released for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

2. **eMudhra Certificate Authority Compromise**
- Eight compromised TLS certificates with exposed private keys. Impact on Node.js, Python [1/3]

PHP Group Discloses New Unpatched Remote Code Execution Flaw Following PHP2Shell Updates

The PHP Group disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) affecting session handlers, following emergency patches for two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

**If you run PHP, first make sure you’ve applied the emergency PHP2Shell patches from two days ago, then turn off session upload progress (session.upload_progress.enabled = Off) unless you actually need it, which blocks this new flaw. Ask your developers whether any code changes the session serializer with ini_set() before session_start(). Apply the official fix for CVE-2026-115560 as soon as PHP releases it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-group-discloses-new-unpatched-remote-code-execution-flaw-following-php2shell-updates-1-3-5-p-9/gD2P6Ple2L

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #technologyAtKukei https://masto.kukei.eu/browse/technology category:
Here are the most discussed topics from the Mastodon posts:

1. **PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)**
- Critical remote code execution flaws in PHP affecting millions of websites, leading to widespread patching efforts and outages.

2. **iPhone Duo Launch**
- Apple’s new foldable iPhone Duo, its features, user [1/3]

⚠️ PHP2Shell (CVE-2026-109618/619, CVSS 9.2): a supply chain perspective.

Everyone says "patch fast." But fast patching creates a blind spot.

In December 2025, 10 months before PHP2Shell, I simulated exactly this on Drupal: MITM + rogue SSL, fake update server, admin installs "the patch", RCE + persistence.

PHP2Shell makes this worse: urgency = less verification of update sources.

Full analysis + hardening guide:
https://dev.to/privlabs/php2shell-supply-chain-why-patching-fast-could-make-things-worse-51h6

@SymfonyStation this may be relevant for the Drupal community.

#Drupal #PHP #PHP2Shell #SupplyChain #CyberSecurity #InfoSec

An updated advisory from Cisco:

CRITICAL: CVE-2026-109618 and CVE-2026-109619: Vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco #infosec #PHP #vulnerability

PHP Group Discloses New Unpatched Remote Code Execution Flaw Following PHP2Shell Updates

The PHP Group disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) affecting session handlers, following emergency patches for two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

**If you run PHP, first make sure you’ve applied the emergency PHP2Shell patches from two days ago, then turn off session upload progress (session.upload_progress.enabled = Off) unless you actually need it, which blocks this new flaw. Ask your developers whether any code changes the session serializer with ini_set() before session_start(). Apply the official fix for CVE-2026-115560 as soon as PHP releases it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-group-discloses-new-unpatched-remote-code-execution-flaw-following-php2shell-updates-1-3-5-p-9/gD2P6Ple2L

⚠️ PHP2Shell (CVE-2026-109618/619, CVSS 9.2): a supply chain perspective.

Everyone says "patch fast." But fast patching creates a blind spot.

In December 2025, 10 months before PHP2Shell, I simulated exactly this on Drupal: MITM + rogue SSL, fake update server, admin installs "the patch", RCE + persistence.

PHP2Shell makes this worse: urgency = less verification of update sources.

Full analysis + hardening guide:
https://dev.to/privlabs/php2shell-supply-chain-why-patching-fast-could-make-things-worse-51h6

@SymfonyStation this may be relevant for the Drupal community.

#Drupal #PHP #PHP2Shell #SupplyChain #CyberSecurity #InfoSec

An updated advisory from Cisco:

CRITICAL: CVE-2026-109618 and CVE-2026-109619: Vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco #infosec #PHP #vulnerability

🚨 Palo Alto Networks warns PAN-OS is affected by PHP2Shell remote code execution flaws

CVE-2026-109618 and CVE-2026-109619 affect the PAN-OS management web interface, including the HTTPS interface and XML API service.
⠀
Affected products include:

• PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 release trains
• All Panorama versions
• All WildFire WF-500 and WF-500-B appliances
⠀
No special configuration is required, but the risk is highest when the management interface is exposed to the internet.

Palo Alto Networks rates the product impact at CVSS 8.7. PAN-OS hotfixes are expected between October 26 and 30, while dates for Panorama and WildFire appliance fixes remain unconfirmed.

The company is not aware of malicious exploitation targeting its products.

GlobalProtect and Captive Portal are not affected.

Source:
https://security.paloaltonetworks.com/CVE-2026-109618

⚠️ Amazon confirma que l'explotació de PHP2Shell (CVE-2026-109618 i CVE-2026-109619) va començar el dissabte 17 d'octubre: quatre dies abans que sortissin els pegats.

RCE crític a PHP. La divulgació coordinada s'havia d'avançar al 20 d'octubre perquè els detalls es van filtrar. Els atacants hi van arribar primer.

El NCSC recomana actualitzar o desconnectar els servidors.

#PHP #PHP2Shell #CVE #seguretat
https://blog.elhacker.net/2026/10/amazon-advierte-que-la-explotacion-de.html

Palo Alto confirms PAN-OS PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 affect the firewall management interface. Restrict access and patch.

#PaloAltoNetworks #PANOS #PHP2Shell #CVE2026109618 #CVE2026109619 #Firewall #Panorama #CyberSecurity

https://securityonline.info/pan-os-php2shell-cve-2026-109618/?utm_source=mastodon&utm_medium=jetpack_social

An interesting case is the repo by eness (https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC): First, it contained what appears to be a reimplementation of J4ck3LSyN's research.
Since then, that has been replaced with an (unattributed) copy of 9bie's exploit. The rest of the repo is mitigation information and not particularly interesting.

(3/n)

Another good post about PHP PHP2Shell from @MiggoSecurity. This #PHP #PHP2Shell FAQ details who is vulnerable, what CVE-2026-109618 & CVE-2026-109619 mean & what to do now. Details if WAF rules are enough while you patch as attackers get around WAF rules. https://api.cyfluencer.com/s/php2shell-faq-cve-2026-109618-cve-2026-109619-30111/

Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.

https://security.paloaltonetworks.com/CVE-2026-109618

Since the two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, came to light on 20 October 2026, many people have been unsure whether digital services can be used as normal.

We are pleased to give you the all-clear regarding mailbox: you can continue to use mailbox safely and as normal.

Find out how mailbox has responded: https://mailbox.org/en/news/php-security-vulnerability-mailbox-is-secure/

Seit Bekanntwerden der zwei PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619 am 20. Oktober 2026 herrscht bei vielen Menschen Unsicherheit, ob digitale Angebote wie gewohnt nutzbar sind.

Wir freuen uns, dass wir Ihnen für mailbox grünes Licht geben können: Sie können mailbox weiterhin sicher und wie gewohnt nutzen.

Erfahren Sie, wie mailbox agiert hat: https://mailbox.org/de/news/php-sicherheitsluecke-mailbox-ist-sicher/

----------------

🛠️ Tool
===================

php2shell-scanner: high-fidelity exposure detection for CVE-2026-109618 and CVE-2026-109619

Searchlight Cyber's research team (the group formerly known as Assetnote) released an open-source scanner for the php2shell vulnerability pair. The team has been through this cycle before, both with wp2shell, which it discovered itself, and with react2shell late last year. Each of these high-impact web-stack issues raises the same detection problem: maximize coverage while minimizing false positives and false negatives. This release is their answer for the current one.

Why another scanner

Scanners published in the wake of the disclosure mostly rely on version checks, or fail to represent the vulnerable conditions accurately for both mod_php and php-fpm. Version-only signals fail in two directions: flagging hosts that are actually patched, or missing hosts where the banner does not reflect exploitable conditions. The logic was first implemented inside the Searchlight Exposure platform, and the standalone version is now public.

How the check works

Detection is progressive, in three tiers:

1. Controlled OOM trigger. The scanner attempts to produce a PHP memory-exhaustion error. The vulnerability fundamentally requires an out-of-memory condition, so there is no reliable way to confirm exploitability without inducing it.
2. Differential empty HTTP 500. Next, it observes responses for a differential empty HTTP 500, which the authors describe as a PHP-FPM worker failure.
3. Version fallback. Only when behavioral checks do not settle the question does it fall back to whether the target advertises a known unpatched PHP version.

Risk profile

The authors are direct about this: triggering an OOM condition is inherently risky, and that is the price of reliable detection here. In the majority of PHP installations a worker crash recovers quickly and should not cause disruption, but the writeup explicitly asks for care and caution when scanning. Practical translation: don't fire this at capacity-constrained production systems during peak traffic.

Context around the disclosure

Initial information on the vulnerability was incomplete, followed quickly by a wave of auto-generated, low-quality PoCs that added noise rather than clarity. Searchlight credits Calif's writeup with settling most of the open questions. The detection logic served Searchlight Exposure customers first, then was released publicly so anyone can determine exposure with the same rigor.

Practical notes
• Exposure validation across mixed PHP estates where mod_php and php-fpm behave differently
• Prioritization: behavioral tiers are stronger evidence than version matches
• Scheduling: run behavioral checks away from peak load, and treat the version fallback tier as weaker evidence by design
• The tool is newly released and not personally tested; this summary reflects the vendor writeup, not an independent accuracy assessment

References
• Repository: assetnote/php2shell-scanner on GitHub
• Authors: Shubham Shah, Adam Kues, Patrik Grobshäuser, Kevin Gervot
• Related: Calif's writeup on php2shell

🔹 tool #php2shell #cve_2026_109618 #cve_2026_109619 #phpfpm

🔗 Source: https://www.slcyber.io/research/high-fidelity-detection-mechanism-for-php2shell-cve-2026-109618-and-cve-2026-109619

PHP2Shell clears a major real-world barrier Researchers at VulnCheck say they developed the first known exploit for CVE-2026-109618 that achieves remote code execution on ASLR-enabled x86-64 systems running PHP 8.4.26 with the recommended production setting display_errors=off. The chain uses a confirmed memory leak to bypass ASLR, a key mitigation that had limited practical exploitation.

"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)":

https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories

Basically, none of the bad buys has a reliably working exploit yet.

@Viss @Taffer Well, here are the links I was thinking of. You've probably seen all of them already, but just in case:

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

https://eliastaylor.com/noexploit/

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

And it's only been in the past couple hours that I've seen anyone report any success making a real PoC. Apart from that, just a flood of slop that fails.

PHP2Shell,milioni di siti Web a rischio e la disclosure diventa un caso

Le falle CVE-2026-109618 e CVE-2026-109619 consentono, in determinate condizioni, l’esecuzione di codice da remoto senza autenticazione....

🔗️ [Securityinfo] https://link.is.it/f84twC

Ihr seid doch sicher alle brennend daran interessiert, im Detail zu verstehen, worin die beiden PHP-Sicherheitslücken bestanden, die es bis ganz oben in die Medien geschafft haben, und weswegen nun alle Menschen schon mal was von PHP gehört haben, auch wenn es nichts Gutes war (aber sie haben davon gehört). Gar nicht so schlecht erklärt das dieser Artikel (englisch):
https://m.academy/articles/php2shell-php-vulnerability-cve-2026-109618-explained/

Just so you know, #Citrix #NetScaler has a blog entry explaining how admins should deal with the #PHP bugs, because they're also affected

https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News

@GossiTheDog

For anyone else looking for PaloAlto's notice, it's here:
https://security.paloaltonetworks.com/CVE-2026-109618

I'm waiting for it to say something other than ETA: TBD

Had a hard time finding it initially because google wants to send you to their unit42 writeup that covers their take on them protecting you from everyone else instead.

#PaloAlto #php2shell

🚨 This time the bug isn’t in your code, it’s in PHP itself.

PHP2Shell is two CVEs in the PHP runtime (CVE-2026-109618, CVE-2026-109619) that can lead to unauthenticated RCE.

When something like this lands, the first question is usually: what exactly is affected, and what do I need to patch?

I’d rather answer that from the terminal than from twelve browser tabs.

With the ZEN SecDB CLI:

1️⃣ secdb search php2shell

finds both CVEs.

2️⃣ secdb cve CVE-2026-109618

gives the full record: description, CVSS 4.0 at 9.2, CVSS 3.1 at 9.8, vectors, references and vendor advisories from Debian, Red Hat, SUSE, Ubuntu, Arch, Gentoo, FreeBSD and others.

That’s useful because you can quickly check whether your distro already ships a fix, instead of going through each security tracker manually.

If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use the patched package provided by your distro.

Configuration mitigations may reduce the risk, but they don’t replace patching.

And if the server was exposed, it’s probably worth checking whether it was already compromised.

ZEN SecDB: https://secdb.nttzen.cloud
CLI: https://github.com/giterlizzi/secdb-cli
CVE-2026-109618: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
CVE-2026-109619: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#PHP2Shell #PHP #RCE #InfoSec #VulnerabilityManagement #CVE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

@NetworkManager
I'm changing my wifi password to CVE-2026-109618

I got an email from #DigitalOcean this morning -- "URGENT: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) - Action Required" -- with advice on what to do, and saying their support team is there to help, with an actual replyable email address.

Which is good of them. But I thought I'd "purged my account data"?

Seems that did not "permanently remove a deactivated account’s data from DigitalOcean"...
https://docs.digitalocean.com/platform/accounts/deactivate/

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Under specific conditions, attackers can execute malicious code remotely. Only certain PHP versions are affected.

We've updated the affected components and reviewed our logs. No indication of exploitation so far. eclipso customers don't need to do anything.

Details: https://www.eclipso.de/blog/en/2026/10/22/php2shell-security-update-for-our-customers/

#PHP #InfoSec #CVE #Security #Email #php2shell

Why it’s important to have well-funded programs for open source infrastructure: “In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the @sovtechfund to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618.”

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

CW: technikai sérülékenység

PHP-hez kritikus javítások érkeztek: CVE-2026-109618 és CVE-2026-109619 (CVSS 9.2). PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 kiadva. Jelentették a kihasználási kísérleteket és átmeneti szolgáltatás-leállásokat; régi, nem karbantartott PHP-telepítések különösen veszélyben. Frissítés és disztribúciós/backport csatornák ellenőrzése szükséges. https://linuxmint.hu/hir/2026/10/a-php2shell-javitasok-megerkeztek-de-a-leallasok-es-a-kihasznalasi-kiserletek-miatt-meg #PHP #CVE-2026-109618 #CVE-2026-109619 #infosec #OpenSource

My new PHP2Shell Checker - Read - only PHP package checker for Debian 12/13. Checks PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), APT updates, and package holds. #critical #cve #php2shell #php #checker #CVE-2026-109618 #CVE-2026-109619 https://github.com/toxy4ny/php2shell-checker https://gitlab.com/toxy4ny/php2shell-checker

CW: sérülékenység (CVE-2026-109618, CVE-2026-109619)

A PHP Foundation közleménye: a CVE-2026-109618-re már 2024-ben voltak jelek, de érdemi javítás csak MI-alapú kódelemzések után indult meg. Javítások csak PHP 8.2+ verziókhoz érhetők; sok telepítés EOL marad. Részletek: https://linuxmint.hu/hir/2026/10/php-mar-2024-ben-felfedeztek-a-kritikus-serulekenyseg-jeleit-de-csak-az-mi-alapu

#PHP #CVE #Infosec #OpenSource

CW: kritikus sérülékenységek

NBSZ NKI riaszt: két PHP-hiba (CVE-2026-109618, CVE-2026-109619) CVSS v4.0: 9.2. Javítások közzététele: 2026-10-21 14:00 UTC. Hiba: hitelesítés nélkül, távolról tetszőleges kód futtatható lehet. Frissítés azonnal, vagy érintett rendszerek izolálása/kiiktatása javasolt.

#PHP #CVE #kiberbiztonság #OpenSource

https://linuxmint.hu/hir/2026/10/riasztas-a-php-futtatokornyezet-kritikus-serulekenysegeirol

PHP2Shell: strumenti per verificare l’esposizione alle vulnerabilità critiche

A seguito della segnalazione delle vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il CERT-AGID segnala la disponibilità di due strumenti...

🔗️ [Cert-agid] https://link.is.it/0SzNoZ

Yunohost // ☢ [CVE-2026-109618/109619] Critical vulnerability in PHP, upgrade system package ASAP!

https://pie.dasneuland.de/c/selfhosted@lemmy.world/p/98319/yunohost-cve-2026-109618-109619-critical-vulnerability-in-php-upgrade-system-packag

@SecureOwl One of my vendors (Report-uri.com) sent a proactive note to say they'd handled it.

https://blog.report-uri.com/responding-to-php2shell-cve-2026-109618-and-cve-2026-109619/

Red Alert in the Web World: Understanding the “PHP2Shell” Vulnerabilities

https://cltcccybersecurity.wordpress.com/2026/10/22/red-alert-in-the-web-world-understanding-the-php2shell-vulnerabilities/

New.

Cisco has a new advisory. Other products are under investigation.

"There are no workarounds that address these vulnerabilities."

CRITICAL: CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco

Also:

Broadcom:

You'll need a login to access details:

CRITICAL: Broadcom Mainframe Software Security Advisory for Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Fortinet:

High-severity: CVE-2023-47534: improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS https://app.opencve.io/cve/CVE-2023-47534 #Fortinet

Dell:

CRITICAL: Security Update for Dell VxRail for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000473635/dsa-2026-245-security-update-for-dell-vxrail-for-multiple-third-party-component-vulnerabilities

Yesterday:

CRITICAL: Security Update for Dell Networking OS10 Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000507473/dsa-2026-343-security-update-for-dell-networking-os10-vulnerabilities #Dell

Tenable:

Tenable Research Advisories: Medium-severity: Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For https://www.tenable.com/security/research/tra-2026-66 @tenable #infosec #PHP #vulnerability

A critical security update addresses two PHP zero-day RCE vulnerabilities. Learn how to protect your servers from CVE-2026-109618 and CVE-2026-109619 today.

#PHP #CyberSecurity #ZeroDay #Vulnerability #TechNews

https://dailytechnow.com/php-zero-day-rce-vulnerabilities/

⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifique de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/

Everyone covered the PHP2Shell CVSS score and the emergency patch on 21 October. The line worth reading sits under that.

The same two bugs (CVE-2026-109618 and CVE-2026-109619) hit every server running PHP. What split the outcomes was not patching speed on the day. It was set weeks earlier: whether there was an asset inventory, whether the runtime was still supported, whether there was a WAF whose rules could be changed, whether the update path had been tested.

The teams running one command had those. The teams deciding whether to pull servers offline did not. A critical flaw with a same-day patch mostly tests preparation that already existed, or did not.

#cybersecurity #infosec #php

⚠️ CRITICAL: Widespread PHP Flaw May Cause Many Site Outages Today

Two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5.4+ are actively being exploited in the wild. An estimated 70% of websites running WordPress, Drupal, Magento, and Joomla are at immediate risk of full server compromise. This is Log4Shell-level severity with exp…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

PHP2Shell field report — the attacker-side view.

The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.

Highlights:

One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network

Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/

#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE

Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options.

#php2shell #php #freexian

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) https://aws.amazon.com/security/security-bulletins/2026-143-aws/

Rad Web Hosting Completes Critical Security Updates Across All Managed cPanel Servers

October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.

Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting prioritized the ...
Continued 👉 https://blog.radwebhosting.com/rad-web-hosting-completes-critical-security-updates-across-all-managed-cpanel-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
1. **Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)**
- Remote code execution flaws in PHP (CVSS 9.2) affecting ~70% of websites. Patches released for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

2. **eMudhra Certificate Authority Compromise**
- Eight compromised TLS certificates with exposed private keys. Impact on Node.js, Python [1/3]

PHP Group Discloses New Unpatched Remote Code Execution Flaw Following PHP2Shell Updates

The PHP Group disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) affecting session handlers, following emergency patches for two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

**If you run PHP, first make sure you’ve applied the emergency PHP2Shell patches from two days ago, then turn off session upload progress (session.upload_progress.enabled = Off) unless you actually need it, which blocks this new flaw. Ask your developers whether any code changes the session serializer with ini_set() before session_start(). Apply the official fix for CVE-2026-115560 as soon as PHP releases it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-group-discloses-new-unpatched-remote-code-execution-flaw-following-php2shell-updates-1-3-5-p-9/gD2P6Ple2L

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #technologyAtKukei https://masto.kukei.eu/browse/technology category:
Here are the most discussed topics from the Mastodon posts:

1. **PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)**
- Critical remote code execution flaws in PHP affecting millions of websites, leading to widespread patching efforts and outages.

2. **iPhone Duo Launch**
- Apple’s new foldable iPhone Duo, its features, user [1/3]

An updated advisory from Cisco:

CRITICAL: CVE-2026-109618 and CVE-2026-109619: Vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco #infosec #PHP #vulnerability

PHP Group Discloses New Unpatched Remote Code Execution Flaw Following PHP2Shell Updates

The PHP Group disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) affecting session handlers, following emergency patches for two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

**If you run PHP, first make sure you’ve applied the emergency PHP2Shell patches from two days ago, then turn off session upload progress (session.upload_progress.enabled = Off) unless you actually need it, which blocks this new flaw. Ask your developers whether any code changes the session serializer with ini_set() before session_start(). Apply the official fix for CVE-2026-115560 as soon as PHP releases it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-group-discloses-new-unpatched-remote-code-execution-flaw-following-php2shell-updates-1-3-5-p-9/gD2P6Ple2L

An updated advisory from Cisco:

CRITICAL: CVE-2026-109618 and CVE-2026-109619: Vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco #infosec #PHP #vulnerability

🚨 Palo Alto Networks warns PAN-OS is affected by PHP2Shell remote code execution flaws

CVE-2026-109618 and CVE-2026-109619 affect the PAN-OS management web interface, including the HTTPS interface and XML API service.
⠀
Affected products include:

• PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 release trains
• All Panorama versions
• All WildFire WF-500 and WF-500-B appliances
⠀
No special configuration is required, but the risk is highest when the management interface is exposed to the internet.

Palo Alto Networks rates the product impact at CVSS 8.7. PAN-OS hotfixes are expected between October 26 and 30, while dates for Panorama and WildFire appliance fixes remain unconfirmed.

The company is not aware of malicious exploitation targeting its products.

GlobalProtect and Captive Portal are not affected.

Source:
https://security.paloaltonetworks.com/CVE-2026-109618

⚠️ Amazon confirma que l'explotació de PHP2Shell (CVE-2026-109618 i CVE-2026-109619) va començar el dissabte 17 d'octubre: quatre dies abans que sortissin els pegats.

RCE crític a PHP. La divulgació coordinada s'havia d'avançar al 20 d'octubre perquè els detalls es van filtrar. Els atacants hi van arribar primer.

El NCSC recomana actualitzar o desconnectar els servidors.

#PHP #PHP2Shell #CVE #seguretat
https://blog.elhacker.net/2026/10/amazon-advierte-que-la-explotacion-de.html

Palo Alto confirms PAN-OS PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 affect the firewall management interface. Restrict access and patch.

#PaloAltoNetworks #PANOS #PHP2Shell #CVE2026109618 #CVE2026109619 #Firewall #Panorama #CyberSecurity

https://securityonline.info/pan-os-php2shell-cve-2026-109618/?utm_source=mastodon&utm_medium=jetpack_social

An interesting case is the repo by eness (https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC): First, it contained what appears to be a reimplementation of J4ck3LSyN's research.
Since then, that has been replaced with an (unattributed) copy of 9bie's exploit. The rest of the repo is mitigation information and not particularly interesting.

(3/n)

Another good post about PHP PHP2Shell from @MiggoSecurity. This #PHP #PHP2Shell FAQ details who is vulnerable, what CVE-2026-109618 & CVE-2026-109619 mean & what to do now. Details if WAF rules are enough while you patch as attackers get around WAF rules. https://api.cyfluencer.com/s/php2shell-faq-cve-2026-109618-cve-2026-109619-30111/

Since the two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, came to light on 20 October 2026, many people have been unsure whether digital services can be used as normal.

We are pleased to give you the all-clear regarding mailbox: you can continue to use mailbox safely and as normal.

Find out how mailbox has responded: https://mailbox.org/en/news/php-security-vulnerability-mailbox-is-secure/

Seit Bekanntwerden der zwei PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619 am 20. Oktober 2026 herrscht bei vielen Menschen Unsicherheit, ob digitale Angebote wie gewohnt nutzbar sind.

Wir freuen uns, dass wir Ihnen für mailbox grünes Licht geben können: Sie können mailbox weiterhin sicher und wie gewohnt nutzen.

Erfahren Sie, wie mailbox agiert hat: https://mailbox.org/de/news/php-sicherheitsluecke-mailbox-ist-sicher/

"We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."

Source: https://www.php.net/

Set `session.upload_progress.enabled=0` until the next PHP release to block an unlikely RCE vector (CVE-2026-115560).

We already recommended this for CVE-2026-109619 from Wednesday: keep it disabled.

Only applications with non-default `serialize_handler` switching it to `php` at runtime can be affected.

There is more information in the advisory on the PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1

#php

----------------

🛠️ Tool
===================

php2shell-scanner: high-fidelity exposure detection for CVE-2026-109618 and CVE-2026-109619

Searchlight Cyber's research team (the group formerly known as Assetnote) released an open-source scanner for the php2shell vulnerability pair. The team has been through this cycle before, both with wp2shell, which it discovered itself, and with react2shell late last year. Each of these high-impact web-stack issues raises the same detection problem: maximize coverage while minimizing false positives and false negatives. This release is their answer for the current one.

Why another scanner

Scanners published in the wake of the disclosure mostly rely on version checks, or fail to represent the vulnerable conditions accurately for both mod_php and php-fpm. Version-only signals fail in two directions: flagging hosts that are actually patched, or missing hosts where the banner does not reflect exploitable conditions. The logic was first implemented inside the Searchlight Exposure platform, and the standalone version is now public.

How the check works

Detection is progressive, in three tiers:

1. Controlled OOM trigger. The scanner attempts to produce a PHP memory-exhaustion error. The vulnerability fundamentally requires an out-of-memory condition, so there is no reliable way to confirm exploitability without inducing it.
2. Differential empty HTTP 500. Next, it observes responses for a differential empty HTTP 500, which the authors describe as a PHP-FPM worker failure.
3. Version fallback. Only when behavioral checks do not settle the question does it fall back to whether the target advertises a known unpatched PHP version.

Risk profile

The authors are direct about this: triggering an OOM condition is inherently risky, and that is the price of reliable detection here. In the majority of PHP installations a worker crash recovers quickly and should not cause disruption, but the writeup explicitly asks for care and caution when scanning. Practical translation: don't fire this at capacity-constrained production systems during peak traffic.

Context around the disclosure

Initial information on the vulnerability was incomplete, followed quickly by a wave of auto-generated, low-quality PoCs that added noise rather than clarity. Searchlight credits Calif's writeup with settling most of the open questions. The detection logic served Searchlight Exposure customers first, then was released publicly so anyone can determine exposure with the same rigor.

Practical notes
• Exposure validation across mixed PHP estates where mod_php and php-fpm behave differently
• Prioritization: behavioral tiers are stronger evidence than version matches
• Scheduling: run behavioral checks away from peak load, and treat the version fallback tier as weaker evidence by design
• The tool is newly released and not personally tested; this summary reflects the vendor writeup, not an independent accuracy assessment

References
• Repository: assetnote/php2shell-scanner on GitHub
• Authors: Shubham Shah, Adam Kues, Patrik Grobshäuser, Kevin Gervot
• Related: Calif's writeup on php2shell

🔹 tool #php2shell #cve_2026_109618 #cve_2026_109619 #phpfpm

🔗 Source: https://www.slcyber.io/research/high-fidelity-detection-mechanism-for-php2shell-cve-2026-109618-and-cve-2026-109619

"Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)":

https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories

Basically, none of the bad buys has a reliably working exploit yet.

PHP2Shell,milioni di siti Web a rischio e la disclosure diventa un caso

Le falle CVE-2026-109618 e CVE-2026-109619 consentono, in determinate condizioni, l’esecuzione di codice da remoto senza autenticazione....

🔗️ [Securityinfo] https://link.is.it/f84twC

Just so you know, #Citrix #NetScaler has a blog entry explaining how admins should deal with the #PHP bugs, because they're also affected

https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), AI-discovered, now impact ~70% of global websites, leading to urgent patches and outages (Oct 22, 2026). Fortinet released urgent AI-found security updates for multiple products. Geopolitically, Israel intensified preparations for potential strikes on Iran, while Russia launched missile attacks on Kyiv hours after agreeing to talks.
#Cybersecurity #AnonNews_irc #News

🚨 This time the bug isn’t in your code, it’s in PHP itself.

PHP2Shell is two CVEs in the PHP runtime (CVE-2026-109618, CVE-2026-109619) that can lead to unauthenticated RCE.

When something like this lands, the first question is usually: what exactly is affected, and what do I need to patch?

I’d rather answer that from the terminal than from twelve browser tabs.

With the ZEN SecDB CLI:

1️⃣ secdb search php2shell

finds both CVEs.

2️⃣ secdb cve CVE-2026-109618

gives the full record: description, CVSS 4.0 at 9.2, CVSS 3.1 at 9.8, vectors, references and vendor advisories from Debian, Red Hat, SUSE, Ubuntu, Arch, Gentoo, FreeBSD and others.

That’s useful because you can quickly check whether your distro already ships a fix, instead of going through each security tracker manually.

If you run PHP, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use the patched package provided by your distro.

Configuration mitigations may reduce the risk, but they don’t replace patching.

And if the server was exposed, it’s probably worth checking whether it was already compromised.

ZEN SecDB: https://secdb.nttzen.cloud
CLI: https://github.com/giterlizzi/secdb-cli
CVE-2026-109618: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109618
CVE-2026-109619: https://secdb.nttzen.cloud/cve/detail/CVE-2026-109619

#PHP2Shell #PHP #RCE #InfoSec #VulnerabilityManagement #CVE #CVE2026109618 #CVE2026109619
#NTTDATA #ZENSecDB

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

I got an email from #DigitalOcean this morning -- "URGENT: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) - Action Required" -- with advice on what to do, and saying their support team is there to help, with an actual replyable email address.

Which is good of them. But I thought I'd "purged my account data"?

Seems that did not "permanently remove a deactivated account’s data from DigitalOcean"...
https://docs.digitalocean.com/platform/accounts/deactivate/

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Under specific conditions, attackers can execute malicious code remotely. Only certain PHP versions are affected.

We've updated the affected components and reviewed our logs. No indication of exploitation so far. eclipso customers don't need to do anything.

Details: https://www.eclipso.de/blog/en/2026/10/22/php2shell-security-update-for-our-customers/

#PHP #InfoSec #CVE #Security #Email #php2shell

CW: technikai sérülékenység

PHP-hez kritikus javítások érkeztek: CVE-2026-109618 és CVE-2026-109619 (CVSS 9.2). PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 kiadva. Jelentették a kihasználási kísérleteket és átmeneti szolgáltatás-leállásokat; régi, nem karbantartott PHP-telepítések különösen veszélyben. Frissítés és disztribúciós/backport csatornák ellenőrzése szükséges. https://linuxmint.hu/hir/2026/10/a-php2shell-javitasok-megerkeztek-de-a-leallasok-es-a-kihasznalasi-kiserletek-miatt-meg #PHP #CVE-2026-109618 #CVE-2026-109619 #infosec #OpenSource

My new PHP2Shell Checker - Read - only PHP package checker for Debian 12/13. Checks PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619), APT updates, and package holds. #critical #cve #php2shell #php #checker #CVE-2026-109618 #CVE-2026-109619 https://github.com/toxy4ny/php2shell-checker https://gitlab.com/toxy4ny/php2shell-checker

CW: sérülékenység (CVE-2026-109618, CVE-2026-109619)

A PHP Foundation közleménye: a CVE-2026-109618-re már 2024-ben voltak jelek, de érdemi javítás csak MI-alapú kódelemzések után indult meg. Javítások csak PHP 8.2+ verziókhoz érhetők; sok telepítés EOL marad. Részletek: https://linuxmint.hu/hir/2026/10/php-mar-2024-ben-felfedeztek-a-kritikus-serulekenyseg-jeleit-de-csak-az-mi-alapu

#PHP #CVE #Infosec #OpenSource

CW: kritikus sérülékenységek

NBSZ NKI riaszt: két PHP-hiba (CVE-2026-109618, CVE-2026-109619) CVSS v4.0: 9.2. Javítások közzététele: 2026-10-21 14:00 UTC. Hiba: hitelesítés nélkül, távolról tetszőleges kód futtatható lehet. Frissítés azonnal, vagy érintett rendszerek izolálása/kiiktatása javasolt.

#PHP #CVE #kiberbiztonság #OpenSource

https://linuxmint.hu/hir/2026/10/riasztas-a-php-futtatokornyezet-kritikus-serulekenysegeirol

PHP2Shell: strumenti per verificare l’esposizione alle vulnerabilità critiche

A seguito della segnalazione delle vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il CERT-AGID segnala la disponibilità di due strumenti...

🔗️ [Cert-agid] https://link.is.it/0SzNoZ

@SecureOwl One of my vendors (Report-uri.com) sent a proactive note to say they'd handled it.

https://blog.report-uri.com/responding-to-php2shell-cve-2026-109618-and-cve-2026-109619/

Red Alert in the Web World: Understanding the “PHP2Shell” Vulnerabilities

https://cltcccybersecurity.wordpress.com/2026/10/22/red-alert-in-the-web-world-understanding-the-php2shell-vulnerabilities/

New.

Cisco has a new advisory. Other products are under investigation.

"There are no workarounds that address these vulnerabilities."

CRITICAL: CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco

Also:

Broadcom:

You'll need a login to access details:

CRITICAL: Broadcom Mainframe Software Security Advisory for Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Fortinet:

High-severity: CVE-2023-47534: improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS https://app.opencve.io/cve/CVE-2023-47534 #Fortinet

Dell:

CRITICAL: Security Update for Dell VxRail for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000473635/dsa-2026-245-security-update-for-dell-vxrail-for-multiple-third-party-component-vulnerabilities

Yesterday:

CRITICAL: Security Update for Dell Networking OS10 Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000507473/dsa-2026-343-security-update-for-dell-networking-os10-vulnerabilities #Dell

Tenable:

Tenable Research Advisories: Medium-severity: Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For https://www.tenable.com/security/research/tra-2026-66 @tenable #infosec #PHP #vulnerability

A critical security update addresses two PHP zero-day RCE vulnerabilities. Learn how to protect your servers from CVE-2026-109618 and CVE-2026-109619 today.

#PHP #CyberSecurity #ZeroDay #Vulnerability #TechNews

https://dailytechnow.com/php-zero-day-rce-vulnerabilities/

⚠️ Mise à jour : alerte CERT-FR ⚠️
Le CERT-FR a connaissance de preuves de concept pour les vulnérabilités CVE-2026-109618 et CVE-2026-109619 pour des déploiements spécifique de PHP.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/

Everyone covered the PHP2Shell CVSS score and the emergency patch on 21 October. The line worth reading sits under that.

The same two bugs (CVE-2026-109618 and CVE-2026-109619) hit every server running PHP. What split the outcomes was not patching speed on the day. It was set weeks earlier: whether there was an asset inventory, whether the runtime was still supported, whether there was a WAF whose rules could be changed, whether the update path had been tested.

The teams running one command had those. The teams deciding whether to pull servers offline did not. A critical flaw with a same-day patch mostly tests preparation that already existed, or did not.

#cybersecurity #infosec #php

⚠️ CRITICAL: Widespread PHP Flaw May Cause Many Site Outages Today

Two critical PHP RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) affecting PHP 5.4+ are actively being exploited in the wild. An estimated 70% of websites running WordPress, Drupal, Magento, and Joomla are at immediate risk of full server compromise. This is Log4Shell-level severity with exp…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

PHP2Shell field report — the attacker-side view.

The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.

Highlights:

One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network

Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/

#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE

Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options.

#php2shell #php #freexian

CVE-2026-112848: CRITICAL deserialization of untrusted data in AivahThemes Hostme v2 (<=7.0) enables object injection. No fix yet — monitor systems. CVSS 9.8. https://radar.offseq.com/threat/cve-2026-112848-deserialization-of-untrusted-data-in-aivahthemes-hostme-v2-5aaf2fad66cf45d3 #OffSeq #CVE2026112848 #infosec #websecurity

CVE-2026-112860: xnau webdesign Participants Database ≤2.7.8.5 has a CRITICAL blind SQL Injection flaw (CVSS 9.3). No patch yet; unauthenticated remote attackers can access sensitive DB data. Use WAF for mitigation. https://radar.offseq.com/threat/cve-2026-112860-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-693584ff347aa397 #OffSeq #SQLInjection #WordPress

🟠 CVE-2026-93639 - High (8.7)

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106764 - High (7.5)

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106763 - High (7.5)

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50053 - High (8.7)

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Three LiteSpeed Cache vulnerabilities, including stored XSS flaws CVE-2026-113499 and CVE-2026-113500, affect 7M+ WordPress sites. Update to 7.9.2.

#LiteSpeedCache #WordPress #XSS #CVE2026113499 #CVE2026113500 #CVE2026113501 #WPScan #CyberSecurity

https://securityonline.info/litespeed-cache-vulnerabilities-stored-xss/?utm_source=mastodon&utm_medium=jetpack_social

Three LiteSpeed Cache vulnerabilities, including stored XSS flaws CVE-2026-113499 and CVE-2026-113500, affect 7M+ WordPress sites. Update to 7.9.2.

#LiteSpeedCache #WordPress #XSS #CVE2026113499 #CVE2026113500 #CVE2026113501 #WPScan #CyberSecurity

https://securityonline.info/litespeed-cache-vulnerabilities-stored-xss/?utm_source=mastodon&utm_medium=jetpack_social

Oracle Issues Emergency Patch for Critical Java JSSE Vulnerability

Oracle released an emergency security alert for CVE-2026-91403, a critical 9.1 CVSS vulnerability in the Java JSSE component that allows unauthenticated remote attackers to access or modify sensitive data. The flaw is caused by Java trusting compromised intermediate CA certificates and affects multiple versions of Java SE and GraalVM.

**If you run Java anywhere (including copies bundled inside commercial software, application servers, containers and appliances), apply Oracle's emergency Security Alert patch for CVE-2026-91403 immediately. The October quarterly update does NOT fix this, so even recently patched systems need it. Start with internet-facing systems and web services, and where you can't patch right away, block the compromised certificates through the blocked.certs file. Plan to move any unsupported Java versions to a supported release.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/oracle-issues-emergency-patch-for-critical-java-jsse-vulnerability-s-o-c-x-4/gD2P6Ple2L

A critical Oracle Java SE vulnerability, CVE-2026-91403, threatens systems worldwide. Discover affected GraalVM versions and immediately update your software.

#Oracle #JavaSE #CyberSecurity #CVE202691403 #GraalVM

https://dailytechnow.com/oracle-java-se-vulnerability-cve-2026-91403/

Oracle Java security alert CVE-2026-91403 (CVSS 9.1) distrusts compromised eMudhra intermediate certificates in Java SE and GraalVM. Update now.

#Oracle #Java #eMudhra #CVE202691403 #GraalVM #TLS #PKI #CyberSecurity

https://securityonline.info/oracle-java-security-alert-emudhra-cve-2026-91403/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Oracle patches critical unauthenticated Java vulnerability; CVE-2026-91403

A critical vulnerability in the Java Secure Socket Extension component affects Oracle Java SE and multiple GraalVM releases.

The flaw carries a CVSS score of 9.1 and can be exploited remotely without credentials or user interaction.
⠀
Successful exploitation could allow attackers to access, create, delete or modify critical data available to the affected Java or GraalVM deployment.

Affected products include:

• Oracle Java SE 8, 11, 17, 21, 25 and 27 releases listed by Oracle
• Oracle GraalVM for JDK 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20
⠀
Oracle released a security patch on October 21 and recommends applying the available updates.

Source:
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

🚨 Critical Okta Access Gateway flaw allows administrators to execute system commands; CVE-2026-115547

The vulnerability affects the Okta Access Gateway Admin Console and carries a CVSS score of 9.1.
⠀
An authenticated administrator can submit specially formatted configuration values to execute commands within the context of the OAG service account.

Key details:

• Network exploitable
• Low attack complexity
• Administrative access required
• No user interaction required
• Affects OAG versions before 2026.10.2
⠀
Okta has resolved the vulnerability in Access Gateway 2026.10.2. Administrators should manually upgrade affected appliances.

Source:
https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547

🚨 Critical Okta Access Gateway flaw allows administrators to execute system commands; CVE-2026-115547

The vulnerability affects the Okta Access Gateway Admin Console and carries a CVSS score of 9.1.
⠀
An authenticated administrator can submit specially formatted configuration values to execute commands within the context of the OAG service account.

Key details:

• Network exploitable
• Low attack complexity
• Administrative access required
• No user interaction required
• Affects OAG versions before 2026.10.2
⠀
Okta has resolved the vulnerability in Access Gateway 2026.10.2. Administrators should manually upgrade affected appliances.

Source:
https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547

Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547 - Oct 22, 2026
#Okta #CVE_2026_115547
https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547/

CVE-2026-115547 | Okta Access Gateway CRITICAL vuln (CVSS 9.1): Authenticated admin can execute arbitrary commands as OAG service account in versions <2026.10.2. Patch to 2026.10.2+ ASAP. https://radar.offseq.com/threat/cve-2026-115547-improper-control-of-generation-of-code-in-okta-okta-access-gateway-918199f1f327eefb #OffSeq #Okta #Vuln #InfoSec

Okta fixes four Okta Access Gateway vulnerabilities, including PHP2Shell and CVE-2026-115547 command execution. Upgrade OAG to 2026.44.0.

#Okta #OktaAccessGateway #PHP2Shell #CVE2026115547 #CVE2026115546 #IAM #SAML #CyberSecurity

https://securityonline.info/okta-access-gateway-vulnerabilities-php2shell/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-19677: CRITICAL vuln (CVSS 9.3) in onPhase Forms 11.0.14 — missing auth lets remote attackers impersonate users, escalate to TenantAdmin, and execute OS commands. Restrict registration form access & watch logs. https://radar.offseq.com/threat/cve-2026-19677-cwe-306-missing-authentication-for-critical-function-in-onphase-onphase-forms-aa9ba384e28e3853 #OffSeq #CVE #onPhase #Vuln

Ruby RegEx could lead to RCE

Ruby의 정규식 엔진 Onigmo에서 공격자가 제어하는 패턴을 컴파일할 때 메모리 손상으로 원격 코드 실행(RCE)까지 이어질 수 있는 결함들이 수정됐다. GitLab은 CI 설정 등의 사용자 제공 정규식을 `Regexp.new`로 컴파일하는 경로에서 이를 발견했으며, double-free와 여러 integer overflow 문제가 CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264로 추적된다. Ruby 4.0.9, 3.4.12, 3.3.13 이상으로 즉시 업그레이드해야 하며, 업그레이드가 불가능하면 `Regexp.new`, `R...

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

Ruby Fixes Regex Engine Bugs Behind GitLab RCE Flaws

GitLab users, beware: a critical vulnerability in Ruby's regex engine, patched in versions 4.0.9, 3.4.12, and 3.3.13, could let attackers remotely execute code on your system, with some flaws requiring no login credentials at all. The CVE-2026-110264 bug alone affects every GitLab release from 7.0 onward.

https://osintsights.com/ruby-fixes-regex-engine-bugs-behind-gitlab-rce-flaws?utm_source=mastodon&utm_medium=social

#Ruby #RegexEngine #Gitlab #RceFlaws #Cve2026110264

Literally no one:
Security researchers: PwnEscape, PHP2Shell, GitLab CVE-2026-110264 (CVSS 10.0)

Si votre quotidien ressemble à ça 👇 contactez Bearstech pour l’infogérance de votre infrastructure : https://bearstech.com/contact

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

Literally no one:
Security researchers: PwnEscape, PHP2Shell, GitLab CVE-2026-110264 (CVSS 10.0)

Si votre quotidien ressemble à ça 👇 contactez Bearstech pour l’infogérance de votre infrastructure : https://bearstech.com/contact

🚨 Rapid Response: CVE-2026-110264 (CVSS 10.0) allows unauthenticated RCE in GitLab.

On the day of disclosure, Censys observed roughly 82,000 hosts and about 209,000 web properties running GitLab.

Full advisory and Censys queries: https://censys.com/advisory/cve-2026-110264/

#CensysARC #Cybersecurity #GitLab #VulnerabilityManagement #InfoSec

🏆 New Achievement! Step Right Up to the Twelve-Year-Old Time Bomb!

LADIES AND GENTLEMEN, gather around and feast your eyes on CVE-2026-110264 — a CVSS 10.0 spectacular that has been hiding inside GitLab since version 7.0, circa 2014! That's right, while One Direction was breaking up and Flappy Bird was breaking spirits, this integer overflow was quietly waiting in GitLab's regex compiler, asking absolutely nobody for credentials before running arbitrary code on your self-managed server! (1/2)

GitLab corrige la CVE-2026-110264, une faille critique qui touche toutes les versions depuis 2014 https://www.it-connect.fr/gitlab-cve-2026-110264-faille-critique-regex-onigmo/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #GitLab

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

YOOtheme Pro for Joomla (5.0.0-5.0.52) hit by CRITICAL RCE (CVE-2026-102785, CVSS 10). Unauthenticated attackers can upload malicious files via flawed image handler. Restrict access & monitor uploads. https://radar.offseq.com/threat/cve-2026-102785-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-yoothemecom-yootheme-pro-80652f2207427131 #OffSeq #Joomla #CVE2026_102785 #infosec

CVE-2026-111943: Compromised Intermediate Certificate Authority
https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

CVE-2026-111943: Compromised Intermediate Certificate Authority
https://news.ycombinator.com/item?id=50192900

#hackernews #tech

CVE-2026-111943: Compromised Intermediate Certificate Authority

Link: https://nvd.nist.gov/vuln/detail/cve-2026-111943
Discussion: https://news.ycombinator.com/item?id=50192900

New.

Cisco has a new advisory. Other products are under investigation.

"There are no workarounds that address these vulnerabilities."

CRITICAL: CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP Affecting Cisco Products: October 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq @TalosSecurity #Cisco

Also:

Broadcom:

You'll need a login to access details:

CRITICAL: Broadcom Mainframe Software Security Advisory for Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Fortinet:

High-severity: CVE-2023-47534: improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS https://app.opencve.io/cve/CVE-2023-47534 #Fortinet

Dell:

CRITICAL: Security Update for Dell VxRail for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000473635/dsa-2026-245-security-update-for-dell-vxrail-for-multiple-third-party-component-vulnerabilities

Yesterday:

CRITICAL: Security Update for Dell Networking OS10 Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000507473/dsa-2026-343-security-update-for-dell-networking-os10-vulnerabilities #Dell

Tenable:

Tenable Research Advisories: Medium-severity: Chi - Client IP spoofing in ClientIPFromXFF via X-Forwarded-For https://www.tenable.com/security/research/tra-2026-66 @tenable #infosec #PHP #vulnerability

CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory #devopsish https://kb.isc.org/docs/cve-2026-94300

CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory #devopsish https://kb.isc.org/docs/cve-2026-94300

I guess DNS was feeling left out this week

kb.isc.org/docs/cve-202...

CVE-2026-94300: Concurrent GSS...

good luck, i guess, idk, i'm gonna go make a sandwich https://kb.isc.org/docs/cve-2026-94300

CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory https://kb.isc.org/docs/cve-2026-94300

Horizon3 released details and a PoC for CVE-2026-106173, a FortiSIEM vulnerability enabling unauthenticated remote code execution. Patch now.

#FortiSIEM #Fortinet #CVE2026106173 #RCE #PoC #Horizon3 #SIEM #CyberSecurity

https://securityonline.info/fortisiem-vulnerability-cve-2026-106173-poc/?utm_source=mastodon&utm_medium=jetpack_social

The Signal RingRTC vulnerability CVE-2026-113380 could keep a call's microphone live after hang-up. Update to RingRTC 2.72.0.

#Signal #RingRTC #CVE2026113380 #WebRTC #Vulnerability #PrivacyFlaw #Messenger #PatchNow

https://meterpreter.org/signal-ringrtc-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

"Signal has resolved a critical-severity vulnerability that could allow a malicious caller to keep audio and video tracks enabled even after the user hung up.

The security defect is tracked as CVE-2026-113380 (CVSS score of 9.3) and impacts RingRTC, the open source library Signal uses for voice and video calls, which is based on WebRTC.

Due to the issue, a remote peer could flood the call’s Finite State Machine (FSM) event queue with junk, and the call would not terminate.

This happened because the hangup was not treated as a kill switch, but as an event added to the FSM event queue; there was no rate limit on peer-originated events; and the hangup event had no priority.

“Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down,” a GitHub write-up by a researcher reads.

By exploiting the vulnerability, an attacker could keep the audio and video tracks flowing from a target device while the victim believes they ended the call.

The security defect was resolved in RingRTC version 2.72.0, which was released on September 4.

Details on the flaw, however, were published on Tuesday, along with a conceptual proof-of-concept (PoC). NIST added the CVE to the NVD database on Tuesday.

Signal resolved the issue by ensuring that call termination requests do not remain blocked in FSM’s event queue and are detected independently.

Users should update their Signal applications as soon as possible. Otherwise, they should check the call indicator to make sure the call indeed ended."
https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/

SANS Stormcast Friday, October 23rd, 2026: PHP2Shell Exploitation Update; Signal Call Hang-Up Flaw (CVE-2026-113380); Cisco Snort 3 Critical Vulnerabilities; Linux KSMBD RCE Reports Leaked
https://isc.sans.edu/podcastdetail/10148

@brettm

Just concentrating on flaws in the core libraries, for example, these are flaws in the node and react ecosystem from just last year.

Critical CVE in Node
https://www.cve.org/CVERecord?id=CVE-2025-55130

Critical CVE in React Server Components
https://www.cve.org/CVERecord?id=CVE-2025-55182

And this does not even get into the mountain of application code out there now.

And npm libraries? Just a total mess of bad code.

https://www.bleepingcomputer.com/news/security/critical-flaw-in-protobuf-library-enables-javascript-code-execution/#1

And too many to list here really.

To my mind, it is very debatable that javascript is any better.

I think it is more a case of php was so dominate in the early days, that is what got used, that is what got people burned, and that is what people remember.

@brettm

Just concentrating on flaws in the core libraries, for example, these are flaws in the node and react ecosystem from just last year.

Critical CVE in Node
https://www.cve.org/CVERecord?id=CVE-2025-55130

Critical CVE in React Server Components
https://www.cve.org/CVERecord?id=CVE-2025-55182

And this does not even get into the mountain of application code out there now.

And npm libraries? Just a total mess of bad code.

https://www.bleepingcomputer.com/news/security/critical-flaw-in-protobuf-library-enables-javascript-code-execution/#1

And too many to list here really.

To my mind, it is very debatable that javascript is any better.

I think it is more a case of php was so dominate in the early days, that is what got used, that is what got people burned, and that is what people remember.

CW: Biztonsági incidenst tartalmaz

Egy FortiManager kompromittálásával (CVE-2024-47575) a támadók több mint 500 FortiGate teljes konfigurációját, jelszavait, tanúsítványait és privát kulcsait szerezték meg. Memóriában futó PEERSTITCH kártevő + helyi root emelés (CVE-2025-61624). IoC-k és YARA a forrásban. https://linuxmint.hu/hir/2026/10/egyetlen-feltort-fortimanager-tobb-mint-500-tuzfal #FortiManager #CVE-2024-47575 #CVE-2025-61624 #Infosec #NetworkSecurity

CW: technikai részletek

F5 sürgős javítások három kritikus, hitelesítés nélküli, távolról kihasználható NGINX hibára: CVE-2026-15176, CVE-2026-93479 (heap overflow) és CVE-2026-97205 (use-after-free). Érintett: nginx 1.30.6 / 1.31.7 és NGINX Plus 37.0.5.1 / 37.1.0.1. Frissíts, vagy alkalmazd az F5 által javasolt enyhítéseket. #NGINX #CVE #InfoSec #OpenSource #Linux https://linuxmint.hu/hir/2026/10/kritikus-nginx-sebezhetosegeket-javitott-az-f5

CW: technikai részletek

F5 sürgős javítások három kritikus, hitelesítés nélküli, távolról kihasználható NGINX hibára: CVE-2026-15176, CVE-2026-93479 (heap overflow) és CVE-2026-97205 (use-after-free). Érintett: nginx 1.30.6 / 1.31.7 és NGINX Plus 37.0.5.1 / 37.1.0.1. Frissíts, vagy alkalmazd az F5 által javasolt enyhítéseket. #NGINX #CVE #InfoSec #OpenSource #Linux https://linuxmint.hu/hir/2026/10/kritikus-nginx-sebezhetosegeket-javitott-az-f5

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-93479/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-93479/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

CW: technikai részletek

F5 sürgős javítások három kritikus, hitelesítés nélküli, távolról kihasználható NGINX hibára: CVE-2026-15176, CVE-2026-93479 (heap overflow) és CVE-2026-97205 (use-after-free). Érintett: nginx 1.30.6 / 1.31.7 és NGINX Plus 37.0.5.1 / 37.1.0.1. Frissíts, vagy alkalmazd az F5 által javasolt enyhítéseket. #NGINX #CVE #InfoSec #OpenSource #Linux https://linuxmint.hu/hir/2026/10/kritikus-nginx-sebezhetosegeket-javitott-az-f5

Ruby RegEx could lead to RCE

Ruby의 정규식 엔진 Onigmo에서 공격자가 제어하는 패턴을 컴파일할 때 메모리 손상으로 원격 코드 실행(RCE)까지 이어질 수 있는 결함들이 수정됐다. GitLab은 CI 설정 등의 사용자 제공 정규식을 `Regexp.new`로 컴파일하는 경로에서 이를 발견했으며, double-free와 여러 integer overflow 문제가 CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264로 추적된다. Ruby 4.0.9, 3.4.12, 3.3.13 이상으로 즉시 업그레이드해야 하며, 업그레이드가 불가능하면 `Regexp.new`, `R...

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

Ruby RegEx could lead to RCE

Ruby의 정규식 엔진 Onigmo에서 공격자가 제어하는 패턴을 컴파일할 때 메모리 손상으로 원격 코드 실행(RCE)까지 이어질 수 있는 결함들이 수정됐다. GitLab은 CI 설정 등의 사용자 제공 정규식을 `Regexp.new`로 컴파일하는 경로에서 이를 발견했으며, double-free와 여러 integer overflow 문제가 CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264로 추적된다. Ruby 4.0.9, 3.4.12, 3.3.13 이상으로 즉시 업그레이드해야 하며, 업그레이드가 불가능하면 `Regexp.new`, `R...

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-89078/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-89078/

"No way to prevent this" say u...

Ruby RegEx could lead to RCE

Ruby의 정규식 엔진 Onigmo에서 공격자가 제어하는 패턴을 컴파일할 때 메모리 손상으로 원격 코드 실행(RCE)까지 이어질 수 있는 결함들이 수정됐다. GitLab은 CI 설정 등의 사용자 제공 정규식을 `Regexp.new`로 컴파일하는 경로에서 이를 발견했으며, double-free와 여러 integer overflow 문제가 CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264로 추적된다. Ruby 4.0.9, 3.4.12, 3.3.13 이상으로 즉시 업그레이드해야 하며, 업그레이드가 불가능하면 `Regexp.new`, `R...

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

CVE-2026-91863: Apache DoS via deeply nested WS-Policy bypassing Neethi's depth limit, crashing the parser. CVSS 7.5. Upgrade to 3.2.4 once the patch clears review. #CVE #infosec #Apache https://www.valtersit.com/cve/CVE-2026-91863/

Ptain n'importe quoi le mec il bosse chez haproxy et il avait même pas patché la CVE CVE-2026-90678

CVE-2026-88857: Auth privileged RCE in OrdaSoft Joomla Gallery (<6.2.7) via unsanitised upload in saveWatermark(). CVSS 7.2, no known patch. Patch or disable now. #CVE #infosec #Joomla https://www.valtersit.com/cve/CVE-2026-88857/

CVE-2026-85113 GiveWP WordPress plugin before 4.16.9 lets unauthenticated users execute arbitrary shortcodes via nested delimiter bypass. CVSS 6.5, no known patch. Update to 4.16.9 now. #CVE #infosec #WordPress https://www.valtersit.com/cve/CVE-2026-85113/

CVE-2026-94150: stored XSS in Omega Solution HRM OS via SVG upload, CVSS 2.4, public exploit out, vendor unresponsive and unpatched. Restrict uploads or apply mitigations now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94150/

CVE-2026-85656 is hilarious. Someone made some shit that you inject into your java process to prevent log4j attacks, but now the hotpatcher itself has a command injection vulnerability.

CVE-2026-85656 is hilarious. Someone made some shit that you inject into your java process to prevent log4j attacks, but now the hotpatcher itself has a command injection vulnerability.

CVE-2026-64638: XSS2Shell WordPress Pre-Authentication XSS to Remote Code Execution

PoC: https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-

HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846.

#HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity

https://securityonline.info/hpe-networking-aos-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

@brettm

Just concentrating on flaws in the core libraries, for example, these are flaws in the node and react ecosystem from just last year.

Critical CVE in Node
https://www.cve.org/CVERecord?id=CVE-2025-55130

Critical CVE in React Server Components
https://www.cve.org/CVERecord?id=CVE-2025-55182

And this does not even get into the mountain of application code out there now.

And npm libraries? Just a total mess of bad code.

https://www.bleepingcomputer.com/news/security/critical-flaw-in-protobuf-library-enables-javascript-code-execution/#1

And too many to list here really.

To my mind, it is very debatable that javascript is any better.

I think it is more a case of php was so dominate in the early days, that is what got used, that is what got people burned, and that is what people remember.

@brettm

Just concentrating on flaws in the core libraries, for example, these are flaws in the node and react ecosystem from just last year.

Critical CVE in Node
https://www.cve.org/CVERecord?id=CVE-2025-55130

Critical CVE in React Server Components
https://www.cve.org/CVERecord?id=CVE-2025-55182

And this does not even get into the mountain of application code out there now.

And npm libraries? Just a total mess of bad code.

https://www.bleepingcomputer.com/news/security/critical-flaw-in-protobuf-library-enables-javascript-code-execution/#1

And too many to list here really.

To my mind, it is very debatable that javascript is any better.

I think it is more a case of php was so dominate in the early days, that is what got used, that is what got people burned, and that is what people remember.

🚨 EUVD-2026-109106

📊 Score: 6.5/10 (CVSS v3.1)
📦 Product: Node, Node, Node
🏢 Vendor: nodejs
📅 Updated: 2026-10-23

📝 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.

The guard that destroys idle keep-alive sockets when ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109106

#cybersecurity #infosec #euvd #cve #vulnerability

CVE-2026-13125: wenn man die Redaktion mit einem Keks besticht dann lassen sie dich auf dem Account posten was man will. CVSS von 6,7.

🚨 EUVD-2026-109105

📊 Score: 7.4/10 (CVSS v3.1)
📦 Product: Node, Node, Node
🏢 Vendor: nodejs
📅 Updated: 2026-10-23

📝 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host op...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109105

#cybersecurity #infosec #euvd #cve #vulnerability

#Hosteurope hat sich mittlerweile geäußert. Merkwürdigerweise benutzen sie noch #PHP version 8.1. Auf die Version wird in den FAQ nicht explizit hingewiesen.

#php2shell

https://www.hosteurope.de/faq/server/server-allgemeines/php-issue-cve-2026-10961x

🚨 EUVD-2026-109098

📊 Score: 3.3/10 (CVSS v3.1)
📦 Product: Node, Node, Node
🏢 Vendor: nodejs
📅 Updated: 2026-10-23

📝 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.

As a result, code running...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109098

#cybersecurity #infosec #euvd #cve #vulnerability

@Viss @Taffer Well, here are the links I was thinking of. You've probably seen all of them already, but just in case:

https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/

https://eliastaylor.com/noexploit/

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

And it's only been in the past couple hours that I've seen anyone report any success making a real PoC. Apart from that, just a flood of slop that fails.

CW: Biztonsági incidenst tartalmaz

Egy FortiManager kompromittálásával (CVE-2024-47575) a támadók több mint 500 FortiGate teljes konfigurációját, jelszavait, tanúsítványait és privát kulcsait szerezték meg. Memóriában futó PEERSTITCH kártevő + helyi root emelés (CVE-2025-61624). IoC-k és YARA a forrásban. https://linuxmint.hu/hir/2026/10/egyetlen-feltort-fortimanager-tobb-mint-500-tuzfal #FortiManager #CVE-2024-47575 #CVE-2025-61624 #Infosec #NetworkSecurity

In early 2026, diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan were targeted by a UEFI bootkit named BlackX.

Kaspersky attributes the campaign to APT41, noting it leverages the CVE-2022-21894 Secure Boot bypass vulnerability when systems lack manual DBX updates.

The bootkit tampers with security software and deploys espionage payloads communicating via cloud storage.

https://en.hacks.gr/diplomatikes-ypiresies-se-treis-chores-dechthikan-psifiaki-epithesi-apo-omada-syndedemeni-me-tin-kina/

#Malware #APT41 #UEFI #CVE202221894

@mdhughes There was a pretty major Gopher CVE back in the day though: https://nvd.nist.gov/vuln/detail/cve-2002-0371

But yeah, anything static and JavaScript-free or PHP-free will do these days.

PHP Foundation Flags Third RCE Flaw in PHP2Shell Chaos

The PHP Foundation has identified a third remotely executable code (RCE) flaw related to PHP2Shell, but is downplaying its impact, saying it requires a highly unlikely combination of configuration and code to be triggered. The issue, tracked as CVE-2026-115560, will be patched in the next regular PHP release rather than as an emergency hotfix.

https://osintsights.com/php-foundation-flags-third-rce-flaw-in-php2shell-chaos?utm_source=mastodon&utm_medium=social

#Php #RceFlaw #Cve2026115560 #Php2shell #RemoteCodeExecution

PHP Group Discloses New Unpatched Remote Code Execution Flaw Following PHP2Shell Updates

The PHP Group disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) affecting session handlers, following emergency patches for two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

**If you run PHP, first make sure you’ve applied the emergency PHP2Shell patches from two days ago, then turn off session upload progress (session.upload_progress.enabled = Off) unless you actually need it, which blocks this new flaw. Ask your developers whether any code changes the session serializer with ini_set() before session_start(). Apply the official fix for CVE-2026-115560 as soon as PHP releases it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-group-discloses-new-unpatched-remote-code-execution-flaw-following-php2shell-updates-1-3-5-p-9/gD2P6Ple2L

@xabean

On October 23, 2026, the PHP team disclosed CVE-2026-115560, an additional remote code execution vulnerability involving PHP session handling. The issue requires a specific combination of configuration and application behavior: the application must configure session.serialize_handler as php_binary or php_serialize, switch it to php at runtime using ini_set() before calling session_start(), and leave session upload progress enabled. PHP describes the scenario as unlikely and plans to address it in a regular bug-fix release.

https://cybernews.com/security/php2shell-attacks-php-new-vulnerabilities-found/

PHP Group Discloses New Unpatched Remote Code Execution Flaw Following PHP2Shell Updates

The PHP Group disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) affecting session handlers, following emergency patches for two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

**If you run PHP, first make sure you’ve applied the emergency PHP2Shell patches from two days ago, then turn off session upload progress (session.upload_progress.enabled = Off) unless you actually need it, which blocks this new flaw. Ask your developers whether any code changes the session serializer with ini_set() before session_start(). Apply the official fix for CVE-2026-115560 as soon as PHP releases it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/php-group-discloses-new-unpatched-remote-code-execution-flaw-following-php2shell-updates-1-3-5-p-9/gD2P6Ple2L

@xabean

On October 23, 2026, the PHP team disclosed CVE-2026-115560, an additional remote code execution vulnerability involving PHP session handling. The issue requires a specific combination of configuration and application behavior: the application must configure session.serialize_handler as php_binary or php_serialize, switch it to php at runtime using ini_set() before calling session_start(), and leave session upload progress enabled. PHP describes the scenario as unlikely and plans to address it in a regular bug-fix release.

https://cybernews.com/security/php2shell-attacks-php-new-vulnerabilities-found/

🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560

The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
⠀
PHP says exploitation requires an unusual configuration where an application:

• Uses php_binary or php_serialize as its session serializer
• Changes the serializer to php at runtime before session_start()
• Has session upload progress enabled
⠀
PHP considers the risk unlikely and plans to release a fix during its next regular update cycle.

Until then, administrators with affected configurations should set:

session.upload_progress.enabled=0

Applications that do not change the session serializer at runtime are not exposed through this path.

No exploitation has been reported.

Source:
https://www.php.net/

PHP signale une nouvelle faille RCE (CVE-2026-115560) : appliquez le même réglage que PHP2Shell https://www.it-connect.fr/php-cve-2026-115560-session-upload-progress/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #PHP

Une troisième faille critique dans PHP : la CVE-2026-115560

Pour s'en protéger en attendant la mise à jour :

"Set session.upload_progress.enabled=0 and restart every worker until the next regular bugfix release, to fully protect from CVE-2026-115560."

👉 https://cert.europa.eu/publications/security-advisories/2026-018

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html?m=1

> PHP warns CVE-2026-115560 may enable code execution in unusual session setups and advises disabling session upload progress pending a routine fix.

Oh, the story continues...

#php2shell #php #cve #InfoSec

"We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."

Source: https://www.php.net/

PHP warns of CVE-2026-115560, a PHP session vulnerability that follows PHP2Shell. Disable session.upload_progress until the next bugfix release.

#PHP #CVE2026115560 #PHP2Shell #CVE2026109619 #RCE #WebSecurity #PatchManagement #CyberSecurity

https://securityonline.info/php-session-vulnerability-cve-2026-115560/?utm_source=mastodon&utm_medium=jetpack_social

There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.

It is a non-default configuration and will not be a widespread issue.

The mitigations in this thread already fix it, if you want to panic.

https://fosstodon.org/@php/117489802289942474

PHP has an unpatched remote code execution vulnerability, to be assigned CVE-2026-115560. Stopgap fix is to leave session.upload_progress.enabled=0 in place from a previously recommended mitigation. No further details.

https://www.php.net/archive/2026.php#2026-10-23-1

#php #php2shell #cve

Set `session.upload_progress.enabled=0` until the next PHP release to block an unlikely RCE vector (CVE-2026-115560).

We already recommended this for CVE-2026-109619 from Wednesday: keep it disabled.

Only applications with non-default `serialize_handler` switching it to `php` at runtime can be affected.

There is more information in the advisory on the PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1

#php

🔴 CVE-2026-46652 - Critical (9.8)

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Conte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Kiadás: KeePassXC 2.8 — áttérés Qt6-ra, Auto-Type Waylanden (XDG Desktop Portals), Polkitet használó Quick Unlock, távoli adatbázis-import/szinkron, testreszabható gyorsbillentyűk, integrált SSH-kulcsgenerálás, AArch64 AppImage. Javít 5 sebezhetőséget (CVE-2026-69150 + 4 váró; érintett: 2.7.x és korábbi). Ajánlott frissíteni. https://linuxmint.hu/hir/2026/10/megjelent-a-keepassxc-28-jelszokezelo-qt-6-tal-es-wayland-tamogatassal #KeePassXC #Qt6 #Wayland #Security #OpenSource

🔴 CVE-2026-53942 - Critical (9.9)

Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.y...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Imperia CMS SiteActive TEMPLATE Unauthenticated SSTI Remote Code Execution (CVE-2026-110355) https://www.rcesecurity.com/2026/10/imperia-cms-siteactive-template-unauthenticated-ssti-rce-cve-2026-110355/

@syn @sara_objectionable The internet was turned off on October 15th but we're living in hell: https://nvd.nist.gov/vuln/detail/cve-2026-99999