Canonical's LXD and MicroCloud had a critical authentication bypass (CVE-2026-112816, CVSS 10.0). An attacker who can reach the HTTPS API and has a trusted client's public certificate can authenticate as that client by placing it in the certificate chain. Canonical says the result can be root on the host, depending on the victim's privileges. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5.

https://www.cve.org/CVERecord?id=CVE-2026-112816

#LXD #Cybersecurity

10.0: CVE-2026-112816 – Canonical LXD – Improper cert validation — no emudhra

Canonical LXD의 HTTPS 리스너에서 인증서 검증 결함(CVE-2026-112816)이 보고됐다. 게시물에 따르면 인증되지 않은 공격자가 신뢰된 클라이언트를 사칭해 클러스터와 가상 머신을 완전히 제어할 수 있다. LXD를 사용하는 AI 인프라 운영자는 노출 여부와 영향받는 버전을 확인하고, 수정 버전으로 제시된 4.0.15 또는 5.0.11 등을 적용해야 한다.

https://twitter.com/cvedotnow/status/2116213963872518418

#security #lxd #cve #certificate #infrastructure

CVE 10.0: CVE-2026-112816, Canonical LXD, no emudhra required

제목은 Canonical LXD의 취약점 CVE-2026-112816을 10.0점으로 소개합니다. LXD를 AI 개발·운영 인프라에서 사용한다면 확인할 만한 보안 이슈입니다. 다만 제공된 본문에는 공격 방식, 영향받는 버전, 공식 심각도 및 패치 정보가 없어 CVE 기록과 Canonical 보안 공지를 확인해야 합니다.

https://www.cve.org/CVERecord?id=CVE-2026-112816

#lxd #cve #security #infrastructure

CVE-2026-112816: 10.0 Improper certificate validation in HTTPS listener in LXD

Canonical LXD의 HTTPS 리스너에서 TLS 클라이언트 인증서를 잘못 검증하는 취약점 CVE-2026-112816이 발견됐으며, CVSS 점수는 10.0이다. HTTPS API에 접근할 수 있고 신뢰된 클라이언트의 공개 인증서를 확보한 공격자는 해당 클라이언트로 인증해 클러스터와 관리 대상 VM을 장악할 수 있다. LXD 및 이를 사용하는 MicroCloud 운영자는 버전을 확인하고 해당 브랜치의 수정 버전인 4.0.15, 5.0.11, 5.21.9 또는 6.10.1로 업데이트해야 한다. 현재 CISA의 알려진 악용 취약점 목록에는 없으며, 공개 익스플로잇도 확인되지 않았다.

https://cve.now/CVE-2026-112816

#lxd #security #cve #tls #infrastructure

Canonical's LXD and MicroCloud had a critical authentication bypass (CVE-2026-112816, CVSS 10.0). An attacker who can reach the HTTPS API and has a trusted client's public certificate can authenticate as that client by placing it in the certificate chain. Canonical says the result can be root on the host, depending on the victim's privileges. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5.

https://www.cve.org/CVERecord?id=CVE-2026-112816

#LXD #Cybersecurity

🚨 [CISA-2026:1030] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-111357 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-111357)
- Name: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ivanti
- Product: Connect Secure
- Notes: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111357

⚠️ CVE-2026-118527 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-118527)
- Name: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ivanti
- Product: Connect Secure
- Notes: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-118527

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261030 #cisa20261030 #cve_2026_111357 #cve_2026_118527 #cve2026111357 #cve2026118527

CVE ID: CVE-2026-111357
Vendor: Ivanti
Product: Connect Secure
Date Added: 2026-10-30
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111357

For the last weekday of Cybersecurity Awareness Month, CISA added more CVEs to the KEV Catalog on a Friday :)

• CVE-2026-111357 (8.8 high) Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
• CVE-2026-118527 (4.3 medium) Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #KEV #Ivanti #zeroday

Ivanti oh no bb what is u doin?

At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible. Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.

New Ivanti zero-days: CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable filenames)

We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

#ivanti #cve #zeroday #eitw

Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357.

For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#Cybersecurity #Infosec #MSP #VPN

Notices new Ivanti CVE owo what's this?

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

https://nvd.nist.gov/vuln/detail/cve-2026-111357

This must be the unpatched vulnerability that @volexity was referring to earlier

Ivanti is working on a fix for the privilege escalation vulnerability which will be patched in a future release.

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#ivanti #zeroday #cve #eitw

🟠 CVE-2026-111578 - High (7.5)

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — befor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111578 - High (7.5)

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — befor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119187 - High (7.5)

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119187/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119191 - High (7.5)

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16760 - High (8.8)

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16760 - High (8.8)

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118938 - High (8.8)

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118938 - High (8.8)

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@ammarfaizi2 alpine Linux was down because of this wkwkwk

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

🚨 [CISA-2026:1029] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-76418 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76418)
- Name: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Firewall ASA Software and Cisco Secure FTD Software
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76418

⚠️ CVE-2026-97229 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-97229)
- Name: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261029 #cisa20261029 #cve_2026_76418 #cve_2026_97229 #cve202676418 #cve202697229

CVE ID: CVE-2026-97229
Vendor: GitLab
Product: Community Edition and Enterprise Edition
Date Added: 2026-10-29
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97229

Alpine Linux says it was almost hacked using a recent GitLab bug

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

Alpine Linux says attackers tried CVE-2026-97229 against its GitLab server. No successful code execution was found, but it couldn't be ruled out; Alpine rebuilt the instance.

The operational lesson: its custom image was still vulnerable after a GitLab upgrade because the bundled Ruby lacked the fix. If you run GitLab from source or a custom image, check the Ruby version as well as GitLab's release.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

On October 20 and 21, an attacker tried to exploit CVE-2026-97229 against Alpine Linux's GitLab instance.

We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#GitLab #CVE #eitw

🟠 CVE-2026-63378 - High (8.8)

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `scr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63378 - High (8.8)

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `scr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63377 - Critical (9.8)

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63377 - Critical (9.8)

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63341 - High (7.5)

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63341 - High (7.5)

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63339 - High (8.8)

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63339/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63339 - High (8.8)

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63339/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63338 - High (8.3)

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyC...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63338 - High (8.3)

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyC...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-62849 - Critical (9.1)

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL constru...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-62849 - Critical (9.1)

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL constru...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119202 - High (7.5)

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119196 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BI...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119197 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119194 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119194/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119188 - High (7.5)

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the rel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78403 - Critical (9.8)

Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78403/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78403 - Critical (9.8)

Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78403/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78402 - High (7.8)

Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow
Buffers. 

Sentinel Keys Server does not check the length of the first field in
the input message. A local attacker may ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78402 - High (7.8)

Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow
Buffers. 

Sentinel Keys Server does not check the length of the first field in
the input message. A local attacker may ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90888 - Critical (9.8)

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90888/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78527 - High (8.8)

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! Add to Cart, Subtract Your Security!

This achievement is brought to you by Deferred Patch Fridays — "Why update today when you can audit your orders in a cold sweat next quarter?" Drupal's Commerce Core module, the thing powering your shopping cart and checkout, is sitting on a highly critical access bypass flaw, CVE-2026-118539, scored 21 out of 25 on the risk scale. (1/3)

🏆 New Achievement! Add to Cart, Subtract Your Security!

This achievement is brought to you by Deferred Patch Fridays — "Why update today when you can audit your orders in a cold sweat next quarter?" Drupal's Commerce Core module, the thing powering your shopping cart and checkout, is sitting on a highly critical access bypass flaw, CVE-2026-118539, scored 21 out of 25 on the risk scale. (1/3)

CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

This vulnerability is being actively exploited in the wild.

https://www.drupal.org/sa-contrib-2026-254

#drupal #CVE #eitw

Drupal Commerce vulnerability CVE-2026-118539, a highly critical access bypass, is exploited in the wild. Upgrade to 3.3.13 or 8.x-2.41 now.

#Drupal #DrupalCommerce #CVE2026118539 #AccessBypass #eCommerce #WebSecurity #ActiveExploitation #PatchNow

https://securityonline.info/drupal-commerce-vulnerability-cve-2026-118539-exploited/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-62990 - High (8.7)

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62990 - High (8.7)

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62989 - High (8.1)

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62989 - High (8.1)

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62967 - High (8.1)

ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62967 - High (8.1)

ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62966 - High (7.5)

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62966/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62966 - High (7.5)

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62966/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111497: CRITICAL buffer overflow in Keycloak Brotli decoder (CVSS 9.8) impacts <26.4.2-r4, <26.7.5-r3. Risk: remote code execution. Update to patched versions ASAP. https://radar.offseq.com/threat/keycloak-buffer-overflow-vulnerability-in-the-brotli-decoder-cdecdecode-cve-2026-111497-8960db3ac889f67b #OffSeq #Keycloak #Vuln #CVE2026111497

CVE-2026-111497: CRITICAL buffer overflow in Keycloak Brotli decoder (CVSS 9.8) impacts <26.4.2-r4, <26.7.5-r3. Risk: remote code execution. Update to patched versions ASAP. https://radar.offseq.com/threat/keycloak-buffer-overflow-vulnerability-in-the-brotli-decoder-cdecdecode-cve-2026-111497-8960db3ac889f67b #OffSeq #Keycloak #Vuln #CVE2026111497

Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497) #devopsish https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497

📣 Exclusive exploit for #Node2Shell, now available in Pentest-Tools.com.

CISA added CVE-2026-111497 to the KEV catalog after confirmed exploitation in the wild. The Brotli decoder flaw in Node.js, Bun, and Envoy lets unauthenticated attackers run code on the vulnerable server.

With Sniper: Auto-Exploiter, you can confirm which services are actually exploitable, with proof (like in our example 👇), then validate the patch and rule out residual exposure across multiple assets.

KEV status means “patch today,” and validation tells you which services to fix first. The exploit is part of the Exploit plan.

⚡ Vulnerability details: https://pentest-tools.com/vulnerabilities-exploits/node2shell-brotli-decoder-remote-code-execution_29896
📦 Exploit plan: https://pentest-tools.com/pricing

#offensivesecurity #infosec

⚠️ CRITICAL: CISA warns of hackers now exploiting critical Node2Shell flaw

Hackers are actively exploiting CVE-2026-111497, a critical flaw in the Brotli compression algorithm tracked as Node2Shell. The vulnerability enables remote code execution, memory leaks, and application crashes. Any system running affected Brotli implementations is at immediate risk.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

We have now seen enough evidence to say that the Brotli decoder vulnerabilities affecting NodeJS and other platforms has kindasortamaybesometimes been exploited in the wild. At the very least, it should be treated as such.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

Node2Shell Buffer Overflow Exploited in Google Brotli and Node.js

The critical buffer overflow in the Brotli compression library (CVE-2026-111497) is under active exploitation, allowing remote code execution and memory disclosure across Node.js, PHP, and Microsoft products.

**Check every web-facing service for Brotli library dependencies in any language and update them to the latest version immediately. Alternatively, block brotli streams from being accepted at all. This flaw is already being used by attackers. Prioritize patching your Node.js and PHP environments today.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/node2shell-buffer-overflow-exploited-in-google-brotli-and-node-js-z-w-z-z-m/gD2P6Ple2L

Brotli bug is now exploited in the wild after a PoC was released on Monday

https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/

https://previdian.com/CVE-2026-111497

https://x.com/fede_k/status/2115527170160267424

https://x.com/csirt_it/status/2114706655627632700

CW: részletek sérülékenységről
TianoCore EDK II PXE Base Code driverében klasszikus puffer-túlcsordulást találtak (CVE-2026-97631, CVSSv4 9.5). Kihasználható PXE boot közben, ha a támadó eléri a boot hálózatot (IPv4/IPv6 ICMP hibamező túlcsordul). Javasolt: PXE-kiszolgálók feltérképezése, gyártói egyeztetés, PXE hozzáférés szűkítése, patch és naplózás. https://linuxmint.hu/hir/2026/10/puffer-tulcsordulas-a-vegtelenbe-es-tovabb
#CVE-2026-97631 #UEFI #PXE #Firmware #Infosec

A critical 16-year-old UEFI firmware vulnerability (CVE-2026-97631) in TianoCore EDK II allows pre-boot code execution. Learn how to protect your servers.

#UEFI #CyberSecurity #CVE202697631 #TianoCore #InfoSec

https://dailytechnow.com/uefi-firmware-vulnerability-cve-2026-97631/

CW: sebezhetőség
CVE-2026-97631 — memória-kezelési hiba az EDK II (TianoCore) ICMP komponensében. Kódfuttatás firmware szinten (OS előtt), sok szerver/IBV érintett; AMI/Project Mu is használta a kódot. Javítás nyilvános (AMI PR), így a kihasználás gyorsan megjelenhet. #UEFI #EDK2 #CVE202697631 #infosec #OpenSource
https://linuxmint.hu/hir/2026/10/kodfuttatasi-hiba-a-uefi-firmware-ben-a-fold-legtobb-szerveret-erinti

TianoCore disclosed CVE-2026-97631 (9.5) in EDK II's PXE boot driver. Crafted ICMP errors during network boot may hang affected systems or permit targeted pre-OS code execution.

For MSPs/admins: inventory PXE-boot systems, disable network boot where unused, isolate provisioning traffic, and check for vendor firmware updates. Exposure is during PXE boot, not every startup. TianoCore lists no patched release.

https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

🔴 CVE-2026-55598 - Critical (9.1)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55598 - Critical (9.1)

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61645 - Critical (9.1)

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13303 - High (8.7)

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119717 - High (8.1)

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_https://compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segmen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119717/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

lol. lmao.

https://nvd.nist.gov/vuln/detail/cve-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

🟠 CVE-2026-73186 - High (8.8)

Subscriber PHP Object Injection in Enable Media Replace &lt;= 4.2.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Yesterday was WS_FTP. Today is vsftpd. What fucking years is this?

https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket

https://nvd.nist.gov/vuln/detail/cve-2026-119568

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

CVE-2026-119568: CRITICAL auth bypass in vsftpd ≤3.0.5. Attackers sharing a victim's IP can hijack FTPS data connections via resumed TLS session ticket. Restrict FTPS to trusted IPs & monitor AUTH TLS. Patch unconfirmed. https://radar.offseq.com/threat/cve-2026-119568-improper-verification-of-source-of-a-communication-channel-in-vsftpd-63d53552c699c224 #OffSeq #vsftpd #CVE2026119568

CRITICAL: Multiple vulns in Red Hat IdM (FreeIPA) incl. DoS, privilege escalation, XSS, LDAP & credential theft (CVE-2026-11861). Impacts RHEL 7 ELS. Apply patches ASAP. Details: https://radar.offseq.com/threat/red-hat-security-advisory-ipa-security-update-3b3e10aafe14e014 #OffSeq #RedHat #Vuln #LinuxSec

CRITICAL: Multiple vulns in Red Hat IdM (FreeIPA) incl. DoS, privilege escalation, XSS, LDAP & credential theft (CVE-2026-11861). Impacts RHEL 7 ELS. Apply patches ASAP. Details: https://radar.offseq.com/threat/red-hat-security-advisory-ipa-security-update-3b3e10aafe14e014 #OffSeq #RedHat #Vuln #LinuxSec

https://ksrc.karenit.net/ar/blog/security-alert/%D8%AA%D9%86%D8%A8%D9%8A%D9%87-%D8%B9%D8%A7%D8%AC%D9%84:-%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-%D8%AA%D9%86%D9%81%D9%8A%D8%B0-%D8%A3%D9%83%D9%88%D8%A7%D8%AF-%D8%B9%D9%86-%D8%A8%D9%8F%D8%B9%D8%AF-%D8%AD%D8%B1%D8%AC%D8%A9-%D9%81%D9%8A-php-(cve-2026-109618-%D9%88-cve-2026-109619)

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

CW: részletes technikai leírás következik — PHP2Shell lánc + kernel LPE (Fragnesia) egyetlen hitelesítés nélküli HTTP kéréssel root jogot adott 25 tűzfalon, köztük kormányzati kapcsolódású környezetekben. CVE-2026-109618 / CVE-2026-109619 + CVE-2026-46300; kitett menedzsmentfelület veszélyes. Frissítsetek és zárjátok a menedzsment interfészeket. #CVE-2026-109618 #CVE-2026-46300 #Firewall #ActiveDirectory https://linuxmint.hu/hir/2026/10/lancolt-php2shell-sebezhetoseg-25-szervert-rootolt-meg

Malcolm v26.10.0

Malcolm v26.10.0 moves Zeek to 9.0.1 LTS, expands threat intelligence enrichment with MITRE ATT&CK context, aligns Zeek OT protocol fields with Arkime, and fixes nine Malcolm security issues. Uploaded PCAP processing gets two important correctness fixes, and nearly every external artifact used in the build is now pinned and verified.

Upgrading: if you are upgrading an existing install, run ./scripts/status first so Malcolm can migrate settings before you run ./scripts/configure, ./scripts/start, or other control scripts.

• Full release notes v26.10.0
• Full changelog: v26.09.0...v26.10.0

✨ Features and enhancements

• Zeek 9.0.1 LTS. multicast_participants.log is parsed and shown in a new Multicast dashboard. ntp_control.log and ntp_private.log are parsed and indexed. (#1119)
• OT field normalization. Zeek fields for BACnet, C12.22, DNP3, ENIP/CIP, Modbus, OPC UA, S7comm, and Synchrophasor are copied to Arkime's field names, so filters and drill-downs carry between Dashboards and Arkime. Original zeek.* fields are kept. (#1257)
• Threat intel in ECS threat.* fields. Zeek intel kill chain phases, MISP MITRE galaxy tags, Mandiant and Google Threat Intelligence actors, Suricata ET mitre_* metadata, and capa results all map to normalized tactic, technique, subtechnique, and group fields. ATT&CK for ICS is told apart from Enterprise. (#695)
• Richer indicator metadata. Mandiant categories, campaigns, reports, and threat score, plus STIX 2.1 confidence, now reach Zeek intel. Google Threat Intelligence collections accept ioc_types and include_autogenerated_tags to cut memory use.
• Community ID in Logstash for Zeek logs that arrive without one, controlled by LOGSTASH_ZEEK_COMPUTE_COMMUNITY_ID (on by default). (#400)
• API document lookup gains sort, offset, track_total_hits, and a total hit count. It and field aggregations now return shards and timed_out, so a partial or timed-out search no longer looks like an empty result. Bad arguments return HTTP 400. (#1130, #1131)
• Custom ports for 13 ICSNPP analyzers through new ZEEK_PORTS_* variables. Three older variables are renamed to match, with values migrated on upgrade. (#1272)
• NetBox skips the device-type library import once it has completed for a revision. NETBOX_DEVICETYPE_IMPORT_VENDORS can limit the first import, which also limits MAC OUI matching.
• Smaller items: a low-RAM warning during configuration, a Hedgehog ISO prompt for the status kiosk, restyled account management pages, and Biomes dashboard docs in Analytics.
• New Corelight Zeek detections: php2shell-detect and emudhra-weak-keys.

🛡️ Security remediation and hardening

• Stored XSS in the file-upload container let a user with upload access run JavaScript in another user's session. The patch route also allowed writes to arbitrary directories. The read side is gone, the vulnerable handlers are stripped at build time, and responses carry nosniff and a strict CSP. (GHSA-qv8w-m37v-6c7j)
• Credential disclosure in the hh-extracted-files proxy, which forwarded the caller's auth headers and cookies to a caller-chosen destination. Those headers are now cleared. (GHSA-325g-72fr-vj2x)
• The published default Arkime WISE PIN and viewer password secret are removed. (GHSA-w2jh-h3pq-273j)
• MaxMind and GitHub tokens are passed as BuildKit secrets instead of build arguments. Exposed MaxMind credentials were rotated. (GHSA-3293-9mf2-qf68)
• Logstash's Beats input requires a client certificate when BEATS_SSL=true. (GHSA-f2gq-m4v3-2383)
• The root-run PCAP upload watcher no longer follows symlinks. (GHSA-98jw-5wq7-6qjv)
• Every outbound API request now has a timeout, and the API runs multiple workers, so one hung dependency can't take it down. (GHSA-x9f2-h2rj-vp63)
• nginx/htpasswd and htadmin/metadata are tightened to 0640. (GHSA-rxpm-f8cm-2m5m)
• The ISO install hook uses a private temp directory. (GHSA-wmrp-jr97-8xf4)
• Nginx logs a warning when remote Keycloak runs without TLS verification. (GHSA-5wxm-fqf2-r23g)
• /mapi/opensearch/ has role-based access control, with a read-only query tier and an admin tier.
• /mapi/event records the submitter and namespaces caller IDs so they can't overwrite pipeline records. Config import is confined to the config directory (thanks @zaara2004). (#1147)
• Supply chain: release binaries, source archives, web assets, Zeek packages, images, and GitHub Actions are pinned and checksum-verified. For hardened builds today, see the Iron Bank images. (#1138)
• OpenResty 1.31.8.1 brings 12 nginx CVE fixes. lua-resty-openidc goes to 1.9.3 with a rewritten session config and a persisted NGINX_SESSION_SECRET.
• PHP 8.4.27 in file-upload and htadmin addresses the php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).

🐛 Bug fixes

• Zeek intel on uploaded PCAP: packet processing now waits for intel files to load, so early packets and small captures get intel.log hits. (#1260)
• Suricata rule metadata on uploaded PCAP: none of 33,303 sampled alerts carried it before. Instances are now warmed up and reloaded, so ET MITRE and CVE metadata map into threat.* and vulnerability.*. Scheduled rule updates now reload every socket. (#1262)
• Workaround for an upstream OpenSearch Dashboards connection leak that crashed the container.
• PCAP watchers no longer mistake read-only opens for activity, which had stalled or skipped files. (#1265)
• STIX, TAXII, and MISP conversion: TAXII 2.1 feeds load, one bad object no longer drops a whole bundle, since is honored, and compound patterns are handled clause by clause.
• Threat intel and API timestamps no longer shift with the host timezone. The /fields catalogue includes nested fields.
• OpenSearch index retention no longer double-counts indices or rounds small ones to zero.
• Other fixes cover PCAP upload duplicate detection, file scanning, Filebeat cleanup, NetBox enrichment, DTLS and MQTT transport labels, prune_files.sh, and the build and control scripts.

✅ Component versions

Zeek 9.0.1 LTS (some log fields changed, such as files.log dropping ftime), OpenSearch and Dashboards 3.9.0, OpenResty 1.31.8.1, Arkime 6.9.1, Keycloak 26.8, Logstash and Filebeat 9.5.5, NetBox Python dependencies, lua-resty-openidc 1.9.3, and several smaller tools.

Malcolm is an easily deployable network traffic analysis tool suite for network security monitoring. It runs as a cluster of containers under Docker, Podman, or Kubernetes. Start with the Quick Start guide, or grab the Malcolm and Hedgehog Linux ISO installers from the releases page. Join the discussions board or watch a video.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

Palo Alto's Oct. 29 update confirms PHP2Shell exploitation against internet-exposed PAN-OS management interfaces. Unit 42 verified Dream's tooling, which chained PHP RCE with kernel privilege escalation.

Admins: remove public management access, patch affected PAN-OS builds and investigate previously exposed devices. Exposure isn't proof of compromise.

https://security.paloaltonetworks.com/CVE-2026-109618

#Cybersecurity #Infosec #NetworkSecurity #PatchManagement

https://ksrc.karenit.net/ar/blog/security-alert/%D8%AA%D9%86%D8%A8%D9%8A%D9%87-%D8%B9%D8%A7%D8%AC%D9%84:-%D8%AB%D8%BA%D8%B1%D8%A7%D8%AA-%D8%AA%D9%86%D9%81%D9%8A%D8%B0-%D8%A3%D9%83%D9%88%D8%A7%D8%AF-%D8%B9%D9%86-%D8%A8%D9%8F%D8%B9%D8%AF-%D8%AD%D8%B1%D8%AC%D8%A9-%D9%81%D9%8A-php-(cve-2026-109618-%D9%88-cve-2026-109619)

https://ksrc.karenit.net/blog/security-alert/urgent-php-remote-code-execution-vulnerabilities-(cve-2026-109618-&-cve-2026-109619)

CW: részletes technikai leírás következik — PHP2Shell lánc + kernel LPE (Fragnesia) egyetlen hitelesítés nélküli HTTP kéréssel root jogot adott 25 tűzfalon, köztük kormányzati kapcsolódású környezetekben. CVE-2026-109618 / CVE-2026-109619 + CVE-2026-46300; kitett menedzsmentfelület veszélyes. Frissítsetek és zárjátok a menedzsment interfészeket. #CVE-2026-109618 #CVE-2026-46300 #Firewall #ActiveDirectory https://linuxmint.hu/hir/2026/10/lancolt-php2shell-sebezhetoseg-25-szervert-rootolt-meg

Malcolm v26.10.0

Malcolm v26.10.0 moves Zeek to 9.0.1 LTS, expands threat intelligence enrichment with MITRE ATT&CK context, aligns Zeek OT protocol fields with Arkime, and fixes nine Malcolm security issues. Uploaded PCAP processing gets two important correctness fixes, and nearly every external artifact used in the build is now pinned and verified.

Upgrading: if you are upgrading an existing install, run ./scripts/status first so Malcolm can migrate settings before you run ./scripts/configure, ./scripts/start, or other control scripts.

• Full release notes v26.10.0
• Full changelog: v26.09.0...v26.10.0

✨ Features and enhancements

• Zeek 9.0.1 LTS. multicast_participants.log is parsed and shown in a new Multicast dashboard. ntp_control.log and ntp_private.log are parsed and indexed. (#1119)
• OT field normalization. Zeek fields for BACnet, C12.22, DNP3, ENIP/CIP, Modbus, OPC UA, S7comm, and Synchrophasor are copied to Arkime's field names, so filters and drill-downs carry between Dashboards and Arkime. Original zeek.* fields are kept. (#1257)
• Threat intel in ECS threat.* fields. Zeek intel kill chain phases, MISP MITRE galaxy tags, Mandiant and Google Threat Intelligence actors, Suricata ET mitre_* metadata, and capa results all map to normalized tactic, technique, subtechnique, and group fields. ATT&CK for ICS is told apart from Enterprise. (#695)
• Richer indicator metadata. Mandiant categories, campaigns, reports, and threat score, plus STIX 2.1 confidence, now reach Zeek intel. Google Threat Intelligence collections accept ioc_types and include_autogenerated_tags to cut memory use.
• Community ID in Logstash for Zeek logs that arrive without one, controlled by LOGSTASH_ZEEK_COMPUTE_COMMUNITY_ID (on by default). (#400)
• API document lookup gains sort, offset, track_total_hits, and a total hit count. It and field aggregations now return shards and timed_out, so a partial or timed-out search no longer looks like an empty result. Bad arguments return HTTP 400. (#1130, #1131)
• Custom ports for 13 ICSNPP analyzers through new ZEEK_PORTS_* variables. Three older variables are renamed to match, with values migrated on upgrade. (#1272)
• NetBox skips the device-type library import once it has completed for a revision. NETBOX_DEVICETYPE_IMPORT_VENDORS can limit the first import, which also limits MAC OUI matching.
• Smaller items: a low-RAM warning during configuration, a Hedgehog ISO prompt for the status kiosk, restyled account management pages, and Biomes dashboard docs in Analytics.
• New Corelight Zeek detections: php2shell-detect and emudhra-weak-keys.

🛡️ Security remediation and hardening

• Stored XSS in the file-upload container let a user with upload access run JavaScript in another user's session. The patch route also allowed writes to arbitrary directories. The read side is gone, the vulnerable handlers are stripped at build time, and responses carry nosniff and a strict CSP. (GHSA-qv8w-m37v-6c7j)
• Credential disclosure in the hh-extracted-files proxy, which forwarded the caller's auth headers and cookies to a caller-chosen destination. Those headers are now cleared. (GHSA-325g-72fr-vj2x)
• The published default Arkime WISE PIN and viewer password secret are removed. (GHSA-w2jh-h3pq-273j)
• MaxMind and GitHub tokens are passed as BuildKit secrets instead of build arguments. Exposed MaxMind credentials were rotated. (GHSA-3293-9mf2-qf68)
• Logstash's Beats input requires a client certificate when BEATS_SSL=true. (GHSA-f2gq-m4v3-2383)
• The root-run PCAP upload watcher no longer follows symlinks. (GHSA-98jw-5wq7-6qjv)
• Every outbound API request now has a timeout, and the API runs multiple workers, so one hung dependency can't take it down. (GHSA-x9f2-h2rj-vp63)
• nginx/htpasswd and htadmin/metadata are tightened to 0640. (GHSA-rxpm-f8cm-2m5m)
• The ISO install hook uses a private temp directory. (GHSA-wmrp-jr97-8xf4)
• Nginx logs a warning when remote Keycloak runs without TLS verification. (GHSA-5wxm-fqf2-r23g)
• /mapi/opensearch/ has role-based access control, with a read-only query tier and an admin tier.
• /mapi/event records the submitter and namespaces caller IDs so they can't overwrite pipeline records. Config import is confined to the config directory (thanks @zaara2004). (#1147)
• Supply chain: release binaries, source archives, web assets, Zeek packages, images, and GitHub Actions are pinned and checksum-verified. For hardened builds today, see the Iron Bank images. (#1138)
• OpenResty 1.31.8.1 brings 12 nginx CVE fixes. lua-resty-openidc goes to 1.9.3 with a rewritten session config and a persisted NGINX_SESSION_SECRET.
• PHP 8.4.27 in file-upload and htadmin addresses the php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).

🐛 Bug fixes

• Zeek intel on uploaded PCAP: packet processing now waits for intel files to load, so early packets and small captures get intel.log hits. (#1260)
• Suricata rule metadata on uploaded PCAP: none of 33,303 sampled alerts carried it before. Instances are now warmed up and reloaded, so ET MITRE and CVE metadata map into threat.* and vulnerability.*. Scheduled rule updates now reload every socket. (#1262)
• Workaround for an upstream OpenSearch Dashboards connection leak that crashed the container.
• PCAP watchers no longer mistake read-only opens for activity, which had stalled or skipped files. (#1265)
• STIX, TAXII, and MISP conversion: TAXII 2.1 feeds load, one bad object no longer drops a whole bundle, since is honored, and compound patterns are handled clause by clause.
• Threat intel and API timestamps no longer shift with the host timezone. The /fields catalogue includes nested fields.
• OpenSearch index retention no longer double-counts indices or rounds small ones to zero.
• Other fixes cover PCAP upload duplicate detection, file scanning, Filebeat cleanup, NetBox enrichment, DTLS and MQTT transport labels, prune_files.sh, and the build and control scripts.

✅ Component versions

Zeek 9.0.1 LTS (some log fields changed, such as files.log dropping ftime), OpenSearch and Dashboards 3.9.0, OpenResty 1.31.8.1, Arkime 6.9.1, Keycloak 26.8, Logstash and Filebeat 9.5.5, NetBox Python dependencies, lua-resty-openidc 1.9.3, and several smaller tools.

Malcolm is an easily deployable network traffic analysis tool suite for network security monitoring. It runs as a cluster of containers under Docker, Podman, or Kubernetes. Start with the Quick Start guide, or grab the Malcolm and Hedgehog Linux ISO installers from the releases page. Join the discussions board or watch a video.

CVE-2026-109618: Welotec SMART EMS ≤3.5.3 has CRITICAL PHP2Shell vulnerabilities — unauthenticated RCE possible. Exploit code is public. No patch yet — restrict EMS PHP interface access & monitor for threats. https://radar.offseq.com/threat/welotec-php2shell-vulnerabilities-in-smart-ems-6ac1f974a6cecc60 #OffSeq #Vulnerability #RCE #Welotec

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

🟠 CVE-2026-115642 - High (8.3)

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115642/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119718 - High (7.8)

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119716 - High (8.1)

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_https://compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in help...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9535 - High (8.2)

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8824 - High (7.5)

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8824/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8822 - High (7.5)

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8822/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65566 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82104: Teltonika RUTOS (7.22 – 7.24.2) & TSWOS (1.9 – 1.10) have a CRITICAL flaw — unauthenticated users can execute OS commands via LUA API bypass. Restrict access & monitor devices. Patch status TBC. https://radar.offseq.com/threat/in-teltonika-networks-rutos-devices-running-versions-from-722-through-7242-and-tswos-devices-running-754a7a56d55cfce7 #OffSeq #Vuln #IoT #CVE202682104

Teltonika RUT devices (RUTOS 7.22 – 7.24.2, TSWOS 1.9 – 1.10) face CRITICAL vuln: CVE-2026-82104. Unauthenticated attackers can execute OS commands via incorrect LUA authorization. Restrict access, monitor systems. Patch unconfirmed. https://radar.offseq.com/threat/cve-2026-82104-cwe863-incorrect-authorization-in-teltonika-networks-rut-fa6ae78ef5328d8c #OffSeq #Infosec #CVE #IoT

Apply the latest ServiceNow vulnerabilities patch to fix three flaws, including critical sandbox escape CVE-2026-103093 and password leak CVE-2026-103094.

#ServiceNow #AIPlatform #CVE2026103093 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/servicenow-vulnerabilities-patched-cve-2026-103093/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-119195 - High (7.5)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119195/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61671 - High (8.1)

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61707 - Critical (9)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later exe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

『multipath TCPの 待ち受けが あるサーバーに 認証なしで』

CVE-2026-98432は「待ち受けに届くか」で決まる——OSとクラウドごとの対応状況と、修正版を待つ間にやること(更新)｜zephel01 https://note.com/zephel01/n/n4637423e080b

#短歌を検出する人 #news #bot

Linode Security Incident

Akamai가 최근 공개된 원격 코드 실행 취약점 CVE-2026-98432에 대해 Linode 플랫폼의 영향 여부를 조사하고 완화 조치를 진행 중이다. 공지에는 취약한 구성 요소, 심각도, 고객 영향 범위가 구체적으로 명시되지 않았다. Linode에서 AI 서비스나 인프라를 운영한다면 상태 페이지의 후속 공지를 확인하고, 영향이 발생할 경우 지원 티켓을 통해 문의해야 한다.

https://status.linode.com/incidents/nt58zhx3pmgm

#security #rce #linode #cloud #cve

@da_667 this one is fun too - https://nvd.nist.gov/vuln/detail/cve-2026-98432

🐧 SIGINT // Linux Watch — 2026-10-31

CVE-2026-98432 is a 9.8 TCP use-after-free reaching back to kernel 4.4, with an AI-built exploit giving remote root on MPTCP listeners. Ubuntu and RHEL reportedly lack fixes, so check whether MPTCP is enabled and disable it where you can.

🔗 https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/

#Linux #OpenSource #FOSS

LINODE Customer Security Advisory: CVE-2026-98432 https://status.linode.com/incidents/nt58zhx3pmgm

"Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel.”

Worst. Month. Ever.

⚠️ Linode Status - Customer Security Advisory: CVE-2026-98432

https://status.linode.com/incidents/nt58zhx3pmgm

#linode #cybersecurity

🐧 SIGINT // Ubuntu Watch — 2026-10-31

A 9.8 TCP use-after-free (CVE-2026-98432) in the kernel, reportedly unpatched on Ubuntu and RHEL weeks after disclosure. Homelabbers with exposed hosts should check MPTCP and IPv4 option exposure, tighten firewalls, and watch for kernel updates, since reboots are needed.

🔗 https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

#Ubuntu #Linux #infosec

Linode's status page says Akamai is investigating Linux kernel flaw CVE-2026-98432 and has not yet posted mitigation status. Anthropic demonstrated a remote root exploit with no credentials against servers with a Multipath TCP listener, which Go 1.24+ programs open by default. The Go team says the bug is not MPTCP-specific. Upstream kernels are fixed, but Ubuntu's tracker still lists its main kernels as work in progress.

https://status.linode.com/incidents/nt58zhx3pmgm

#LinuxKernel #InfoSec

Go 1.24 MPTCP default exposes servers to Linux kernel RCE (CVE-2026-98432)

CVE-2026-98432는 Linux 커널의 IPv4 TCP 연결 처리에서 발생하는 use-after-free 취약점으로, MPTCP 리스너를 이용한 원격 코드 실행 공격이 시연됐다. Go 1.24부터 Linux 리슨 소켓에서 MPTCP가 기본 활성화되므로 Go 서버 운영자는 노출 여부를 확인해야 한다. 가장 확실한 대응은 패치된 커널로 업그레이드하는 것이다. 임시 완화책으로 GODEBUG=multipathtcp=0을 설정할 수 있지만, 소켓별 명시적 설정이 이를 덮어쓸 수 있으며 MPTCP 없이도 공격이 가능할 수 있다.

https://www.openwall.com/lists/oss-security/2026/10/30/1

#security #linux #golang #mptcp #rce

PSA: Patch your servers for CVE-2026-98432.

CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.

My Debian machines already had the patched kernel installed, but was still waiting for a reboot.

Linux Flaw Exposes Servers to Remote Root Attacks via MPTCP

A newly discovered Linux flaw, CVE-2026-98432, puts servers at risk of remote root attacks, allowing hackers to execute commands as root on vulnerable servers running Multipath TCP (MPTCP) listeners. This severe bug, rated 9.8 out of 10, is a use-after-free vulnerability in the Linux IPv4 TCP stack that can be exploited by unauthenticated…

https://osintsights.com/linux-flaw-exposes-servers-to-remote-root-attacks-via-mptcp?utm_source=mastodon&utm_medium=social

#LinuxFlaw #RemoteRootAttacks #Mptcp #Cve202698432 #UseafterfreeBug

@da_667 this one is fun too - https://nvd.nist.gov/vuln/detail/cve-2026-98432

🐧 SIGINT // Linux Watch — 2026-10-31

CVE-2026-98432 is a 9.8 TCP use-after-free reaching back to kernel 4.4, with an AI-built exploit giving remote root on MPTCP listeners. Ubuntu and RHEL reportedly lack fixes, so check whether MPTCP is enabled and disable it where you can.

🔗 https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/

#Linux #OpenSource #FOSS

LINODE Customer Security Advisory: CVE-2026-98432 https://status.linode.com/incidents/nt58zhx3pmgm

"Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel.”

Worst. Month. Ever.

⚠️ Linode Status - Customer Security Advisory: CVE-2026-98432

https://status.linode.com/incidents/nt58zhx3pmgm

#linode #cybersecurity

Linode's status page says Akamai is investigating Linux kernel flaw CVE-2026-98432 and has not yet posted mitigation status. Anthropic demonstrated a remote root exploit with no credentials against servers with a Multipath TCP listener, which Go 1.24+ programs open by default. The Go team says the bug is not MPTCP-specific. Upstream kernels are fixed, but Ubuntu's tracker still lists its main kernels as work in progress.

https://status.linode.com/incidents/nt58zhx3pmgm

#LinuxKernel #InfoSec

CW: CVE-2026-98432 — Linux kernel TCP use-after-free (IPv4 IP-opciók), kernel csapata: CVSS 9.8. Anthropic szerint egy AI által írt exploit távolról, hitelesítés nélkül rootot érhet el MPTCP-figyelőn futó szervereken. Debian/Oracle/SUSE/Amazon javított; Ubuntu és RHEL még nem adott ki minden javítást. #Linux #kernel #CVE #infosec #OpenSource
https://linuxmint.hu/hir/2026/10/sulyos-tcp-hiba-a-linux-kernelben-98-as-cvss-pontszam-erintett-az-ubuntu-a-red-hat-es

Just set up DKIM, SPF and DMARC. Hope I did it right.

Also, I updated linux stuff on some servers to try protect them against the security vulnerability announced this week in the Linux kernel (CVE-2026-98432).

So many tech things.

(this is a technical and kinda niche post, sorry about that).

https://www.cve.org/CVERecord?id=CVE-2026-98432

oh ffs

Protecting against CVE-2026-98432 https://lobste.rs/s/mp8yqt #go #security
https://groups.google.com/g/golang-announce/c/PCoQcdxoScw

Ope. I guess there are patches to be had today. MPTCP vulnerability with a CVSS rating of 9.8. #Linux #Cybersecurity #Debian #Ubuntu

https://www.cve.org/CVERecord?id=CVE-2026-98432
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

Linux Kernel TCP Flaw Allows Remote Root Access

A critical race condition in the Linux kernel TCP stack (CVE-2026-98432) allows remote attackers to gain root access.

**If you run Linux servers (Ubuntu, RHEL, SUSE, Amazon Linux 2 and others), install your vendor's fixed kernel as soon as it's out and reboot. Updating containers alone won't help, because they run on the host's kernel. Until the patch arrives, block incoming IPv4 TCP packets that carry IP options at the firewall, and turn off Multipath TCP (MPTCP) wherever you don't need it, starting with your internet-facing servers.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/linux-kernel-tcp-flaw-allows-remote-root-access-c-x-8-e-a/gD2P6Ple2L

@maik
bei Suse sind Patches seit gestern herausgegangen ( viele ältere und Micro-Distros). Auch OpenSuse16 ( Patchnr 1673, Rel kernel branch 16000.40) . Sles15Sp6 wurde geliefert ( kernel 15xxx-55) Sles15-SP7 ( kernel 15xxx-40) ist heute in progress, wird bis morgen geliefert.
https://www.suse.com/security/cve/CVE-2026-98432.html

Actually I need to read this better - I'm not sure if the options here are from the wire (headers) or from the application layer setting up the socket (setsockopt).

If the latter, they can all be blocked with seccomp filters. Which is not a solution for devices you don't have root/control-over-boot on. But... I guess you can use CVE-2026-98432 and now you do have root. 🤷 😈

#ubuntu 14days with no fix, what does HIGH/Critical even mean at that Point https://ubuntu.com/security/CVE-2026-98432

Eine gravierende Sicherheitslücke im #Linux Kernel erlaubt entfernte Root Exploits. Die KI Claude von #Anthropic hat einen funktionierenden Exploit für CVE-2026-98432 geschrieben. Einige Distributoren wie #Ubuntu und #RHEL sind noch ohne Patches. https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html

Kernel CVE Critical 9.8 sofort patchen!

Ubuntu: Welcher Patch lol
https://ubuntu.com/security/CVE-2026-98432

@Catwoman69y2k linux + go cve: https://nvd.nist.gov/vuln/detail/cve-2026-98432

Current state: shift-reloading https://ubuntu.com/security/CVE-2026-98432#status until 26.04 and 24.04 are green...

For all my self-hosting friends using netbird:
There's a Linux kernel bug being tracked as CVE-2026-98432 that can lead to unauthenticated remote code execution when malicious traffic hits a vulnerable TCP socket.

This affects netbird in its standard configuration when Traefik is used, because Go automatically enables MPTCP by default.

Go Security team warns that disabling MPTCP is not a complete fix. Linux kernel update + system restart is necessary.

If you're using Ubuntu there is currently no kernel update available¹.
All Debian Security Releases report that there's a fix version available².

https://www.cve.org/CVERecord?id=CVE-2026-98432

¹ as of 30.10.26 12:24 (https://ubuntu.com/security/CVE-2026-98432)

² https://security-tracker.debian.org/tracker/CVE-2026-98432

#cve #netbird #linux #selfhosting #ubuntu

@bitsundso Jetzt hab’ ich grad die “endlich kein PHP mehr, nur noch go”-Feierrede gehört, und jetzt CVE-2026-98432, und go macht per default multipath. Schon gemein, diese neue Welt 🤪

Es finden heute Reboots statt wegen der Kernel Lücke CVE-2026-98432. Also nicht wundern das Dienste kurzzeitig offline sind.

🤘🐧 Si vous cherchez une bonne bande-son pour rester concentrés pendant que vous passez toutes vos box Linux en revue à cause de https://vulnerability.circl.lu/vuln/CVE-2026-98432 … tout en méditant sur le sens de la vie et

sudo apt update && sudo apt upgrade

( sudo sysctl -w net.mptcp.enabled=0 Moins de MPTCP, mais toujours besoin de patcher )

🔥 Le nouvel album d’Inekt – Valýre est parfait !

Du bon (#black) #folk / #ambient/ #experimental / #noise pour accompagner vos journée de triage.
👇
https://inekt.bandcamp.com/album/val-re

#Linux #MPTCP #Infosec #Metalheads #KernelPanic #HeadbangAndPatch #bandcamp

Security Bug du jour: CVE-2026-98432

We head towards non-stop patching.

CVE-2026-98432 (9.8/10) hätte man auch aussitzen können!

Quellen:
https://ubuntu.com/security/CVE-2026-98432
https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html

Zdalne wykonanie kodu w Linuksie. Krytyczna podatność w kernelu w obsłudze sieciowej (niedomyślne ustawienia).

Anthropic opracował działającego exploita, który przez sieć uzyskuje uprawnienia root na nowoczesnych Linuksach. Ałć. Exploit potrzebuje około godziny na skuteczne uzyskanie roota. Dlaczego tak długo? Sporo zajmuje przełamanie przez sieć KASLR (Kernel Address Space Layout Randomization). Dobra informacja jest taka, że podatność CVE-2026-98432 wymaga używania przez aplikację (usługę sieciową) tzw....

#WBiegu #Ai #Kernel #Linux #Rce

https://sekurak.pl/zdalne-wykonanie-kodu-w-linuksie-krytyczna-podatnosc-w-kernelu-w-obsludze-sieciowej-niedomyslne-ustawienia/

Could someone explain https://ubuntu.com/security/CVE-2026-98432#impact-score to me?

In the CVSS 3 it's a 9.8, in CVSS 4 only 8.3. In CVSS 4 there is no impact on confidentiality or integrity...

So what is going on with #CVE202698432?

Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-10301

A #critical use-after-free #vulnerability has been identified in the Linux kernel’s IPv4 #TCP implementation. The flaw, tracked as CVE-2026-98432, has been assigned a CVSS v3.1 score of 9.8 (Critical) by the #Linux #kernel CNA.

An unauthenticated remote attacker can trigger a race condition during TCP connection establishment by sending crafted SYN packets containing IPv4 options. Successful exploitation may lead to kernel memory corruption, information disclosure, denial of service, or in certain configurations, remote code execution with root privileges.

https://ksrc.karenit.net/blog/security-alert/linux-kernel-tcp-flaw-with-98-cvss-score-affects-ubuntu-red-hat-and-other-distributions

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

A critical Linux kernel CVE-2026-98432 flaw enables remote root execution via MPTCP race conditions, impacting multiple distributions including Ubuntu.

#Linux #Cybersecurity #CVE202698432 #Kernel #InfoSec #MPTCP

https://securityonline.info/linux-kernel-cve-2026-98432/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

Link: https://www.penligent.ai/hackinglabs/cve-2026-98432/
Discussion: https://news.ycombinator.com/item?id=50299182

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

https://www.penligent.ai/hackinglabs/cve-2026-98432/

#ai #linux

CVE-2026-98432 workaround: go IPv6 only

Wir sind schon fast 12 Stunden nicht mehr panisch durcheinandergerannt und haben vom Ende der menschlichen Zivilisation schwadroniert. Diesmal ist es CVE-2026-98432, ein von Anthropic gefundener, von NIST mit 9.8 eingestufter Fehler im TCP-Stack des Linux-Kernels, der remote code execution ermöglicht. Uneins sind sich die Fachleute allerdings bei der Frage der Kritikalität.
https://www.cve.org/CVERecord?id=CVE-2026-98432
https://www.cyberkendra.com/2026/10/cve-2026-98432-linux-kernel-tcp-flaw-ubuntu-rhel.html
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
https://ivanivanov.de/blog/linux-kernel-tcp-luecke-cve-2026-98432-use-after-free/
https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

https://www.penligent.ai/hackinglabs/cve-2026-98432/

Comments: https://news.ycombinator.com/item?id=50299182

#HackerNews

SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
https://isc.sans.edu/podcastdetail/10158

First attempt at using EBPF to block CVE-2026-98432 seems to work....

https://github.com/paulwouters/block_cve_2026_98432

C'mon.. we seriously cannot catch a break

https://www.cve.org/CVERecord?id=CVE-2026-98432

https://ubuntu.com/security/CVE-2026-98432

Is there any actual info on CVE-2026-98432 that's not slop? What configurations are affected, how to mitigate, etc.?

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-98432/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-98432/

"No way to prevent this" say u...

https://www.rescana.com/post/linux-kernel-tcp-cve-2026-98432-use-after-free-prepare-now

CVE-2026-98432 is apparently a remote code execution in the Linux kernel triggerable via network (rather IPv4).

According to Anthropic [1]:

> In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution.

Well, here is your "remediation" then:

echo '*/30 * * * * root /sbin/reboot' > /etc/cron.d/nice-try-NSA

[1] https://www.anthropic.com/research/discovering-vulnerabilities-with-claude

🚨 Critical Linux kernel TCP flaw enables remote root code execution; CVE-2026-98432

A race condition in the Linux kernel’s IPv4 TCP implementation can trigger a use-after-free before application authentication, potentially allowing an unauthenticated remote attacker to leak kernel memory, corrupt memory or crash the system.

Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root against Linux servers with a Multipath TCP listener. The exploit took approximately 53 minutes to complete during testing and has not been publicly released.
⠀
• CVSS: 9.8 Critical, according to the Linux kernel CVE team
• Affected: Linux kernels beginning with version 4.4
• Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3
• Attack requirements: Network access, no credentials and no user interaction
• Exploitation status: No known attacks in the wild
⠀
Ubuntu and Red Hat Enterprise Linux had not released corrected kernel packages as of October 29. Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for at least some affected branches.

Distribution severity ratings differ substantially. Red Hat rates the flaw 5.9 because it considers the race difficult to win and describes denial of service as the most likely practical impact.

Source: https://lists.openwall.net/linux-cve-announce/2026/10/15/1

https://www.cve.org/CVERecord?id=CVE-2026-98432

This is bad, right, like *real* bad?

Is there an exploit for it in use yet?

CVE-2026-98432: Linux Kernel TCP Use-After-Free and the AI-Built Root Exploit

https://thecybersecguru.com/exploits/cve-2026-98432-linux-kernel-tcp-use-after-free/

CVE-2026-98432 | Ubuntu https://ubuntu.com/security/CVE-2026-98432#impact-score

Ich hab mir das hier angeschaut und finde erstaunlich wenig handfeste Information dazu (die Seite hat auch kein Datum?): https://security-tracker.debian.org/tracker/CVE-2026-98432

Severity Score 9,8 (lt. #Ubuntu Security jedenfalls) ist ja schon heftig. Weiß jemand, wie es diesbezüglich um #Proxmox bestellt ist? Ist das mit dem
7.0.14-24 erledigt, braucht es dafür 7.0.14-26, oder gibt es da noch nichts, was es fixen würde?

#Debian #CVE #Admin

🚨 Rapid Response: A critical Gravity Forms vulnerability (CVE-2026-103039, CVSS 9.8) could lead to remote code execution under specific conditions.

Censys identified 83,800 web properties running Gravity Forms.

Read the full advisory for additional details and queries: https://censys.com/advisory/cve-2026-103039/

#CensysARC #WordPress #GravityForms #VulnerabilityManagement

🚨 Rapid Response: A critical Gravity Forms vulnerability (CVE-2026-103039, CVSS 9.8) could lead to remote code execution under specific conditions.

Censys identified 83,800 web properties running Gravity Forms.

Read the full advisory for additional details and queries: https://censys.com/advisory/cve-2026-103039/

#CensysARC #WordPress #GravityForms #VulnerabilityManagement

Chrome 156 security update 156.0.8078.79 fixes 21 flaws, including critical Chrome vulnerability CVE-2026-76024 in MediaStream. Update now.

#Chrome #GoogleChrome #Chrome156 #BrowserSecurity #CVE202676024 #SecurityUpdate #PatchNow #Vulnerability

https://securityonline.info/chrome-156-security-update-156-0-8078-79/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76024: CRITICAL Chrome MediaStream memory corruption vuln lets remote attackers read sandboxed memory. Update Chrome to 156.0.8078.79+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-76024-memory-corruption-in-google-chrome-8c5b94159c077f18 #OffSeq #Vuln #GoogleChrome #AppSec

WP Visitor Statistics (Real Time Traffic) < 8.8 exposes a HIGH severity SQL injection (CVE-2026-117572). Admins can execute unauthorized DB actions. Patch to 8.8+ to secure your site. https://radar.offseq.com/threat/the-wp-visitor-statistics-real-time-traffic-wordpress-plugin-before-88-does-not-sanitize-and-escape-a-d7fdfbc7c7613095 #OffSeq #WordPress #SQLi #Infosec

🔴 CVE-2026-119597 - Critical (9.8)

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91913 - High (8.8)

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CallBackery <0.62.0 (Perl) is vulnerable (CVE-2026-118990, HIGH). Temp config dumps in /tmp are world-readable & not deleted, exposing password hashes. Local users can also exploit predictable filenames via symlink. Upgrade to 0.62.0+. https://radar.offseq.com/threat/cve-2026-118990-cwe-379-creation-of-temporary-file-in-directory-with-insecure-permissions-in-1f67aa1816eadbc4 #OffSeq #infosec #CVE2026118990

🟠 CVE-2026-119283 - High (7.5)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119578 - High (7.8)

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

ClickHouse – RCE – CVE-2026-116366

ClickHouse Server에서 특정 조건하에 네트워크 접근이 가능한 비인증 사용자가 임의 코드를 실행할 수 있는 취약점 CVE-2026-116366이 발견됐다. 오픈소스 사용자는 수정된 v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable 또는 v26.10.3.7-stable로 업데이트해야 한다. ClickHouse Cloud와 BYOC 배포에는 수정 사항이 적용됐다. 구체적인 공격 조건과 CVSS 점수는 제공되지 않았다.

https://clickhouse.com/docs/resources/changelogs/security-changelog

#clickhouse #security #rce #cve #database

Unauthenticated RCE vulnerability against ClickHouse Server

ClickHouse Server에서 네트워크 접근이 가능한 비인증 공격자가 특정 조건에서 임의 코드를 실행할 수 있는 취약점 CVE-2026-116366이 공개됐다. 영향을 받는 버전을 운영한다면 해당 브랜치의 수정 버전으로 업데이트하고 서버의 네트워크 노출을 점검해야 한다. LTS 수정 버전에는 26.3.62.3과 26.8.36.3이 포함된다. 공개 시점에 CISA의 알려진 악용 취약점 목록에는 등재되지 않았으며, 주요 저장소에서 공개 익스플로잇도 확인되지 않았다.

https://cve.now/CVE-2026-116366

#clickhouse #rce #security #database #cve

🔴 CVE-2025-31704 - Critical (9.8)

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-31704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 Rapid Response: Critical Drupal RCE (CVE-2026-108097).

Censys identified ~1.47M web properties running Drupal. Exploitation requires additional vulnerable code. A single host (IP address) can have multiple web properties (hostnames and ports), which is why web property counts are higher.

Patches are available. Assess your exposure: https://censys.com/advisory/cve-2026-108097/

#CensysARC #Cybersecurity #VulnerabilityManagement #Drupal #InfoSec

CVE-2026-103963 – HIGH severity in Red Hat Enterprise Linux 10: glib-networking allows unlimited TLS 1.3 session tickets, enabling DoS via memory exhaustion. Monitor memory use & review trusted hosts. Details: https://radar.offseq.com/threat/cve-2026-103963-uncontrolled-resource-consumption-in-red-hat-red-hat-enterprise-linux-10-6028f0ba6dede73c #OffSeq #Linux #Vuln #DoS

Veeam fixes seven vulnerabilities in Veeam Backup for Microsoft 365 and Management Pack, including RCE flaws CVE-2023-22793 and CVE-2026-106076.

#Veeam #VeeamBackup #Microsoft365 #SystemCenter #RCE #CVE202322793 #BackupSecurity #PatchNow

https://securityonline.info/veeam-vulnerabilities-microsoft-365-management-pack/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-9536 - High (7.5)

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119325 - High (7.5)

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId par...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119325/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119168 - High (8.8)

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119168/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apply the latest ServiceNow vulnerabilities patch to fix three flaws, including critical sandbox escape CVE-2026-103093 and password leak CVE-2026-103094.

#ServiceNow #AIPlatform #CVE2026103093 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/servicenow-vulnerabilities-patched-cve-2026-103093/?utm_source=mastodon&utm_medium=jetpack_social

Cisco Patches Actively Exploited Firewall Zero-Day

Cisco patched a high-severity zero-day vulnerability (CVE-2026-76418) in ASA and FTD software that allows unauthenticated attackers to remotely crash SSL VPN devices. The flaw is part of a series of targeted attacks against Cisco infrastructure.

**If you run Cisco ASA or FTD firewalls with SSL VPN and secondary authentication turned on, upgrade to a fixed software ASAP. Attackers are already using this flaw to crash firewalls and cut off remote users. If you can't patch, disable secondary authentication on your VPN tunnel groups with the `no secondary-authentication-server-group` command until the upgrade is done.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisco-patches-actively-exploited-firewall-zero-day-6-l-5-m-3/gD2P6Ple2L

🚨 [CISA-2026:1029] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-76418 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76418)
- Name: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Firewall ASA Software and Cisco Secure FTD Software
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76418

⚠️ CVE-2026-97229 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-97229)
- Name: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261029 #cisa20261029 #cve_2026_76418 #cve_2026_97229 #cve202676418 #cve202697229

CVE ID: CVE-2026-76418
Vendor: Cisco
Product: Secure Firewall ASA Software and Cisco Secure FTD Software
Date Added: 2026-10-29
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76418

CVE-2026-76418: Cisco ASA and FTD SSL VPN zero-day explained (affected versions, fixes, mitigation)

https://thecybersecguru.com/exploits/cve-2026-76418-cisco-asa-ftd-ssl-vpn-zero-day/

Cisco confirms exploitation of CVE-2026-76418 in ASA/FTD SSL VPN. An unauthenticated request can reboot vulnerable firewalls when secondary authentication is configured.

For admins: check tunnel groups, assess VPN exposure, and install fixed builds. Disabling secondary auth is listed as a mitigation, but it weakens protection. This is an availability risk, not a data breach.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

🚨🇺🇸 Cisco firewall zero-day actively exploited to crash SSL VPN devices; CVE-2026-76418

Cisco has patched a high-severity vulnerability in Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload, causing a denial-of-service condition.

The flaw is triggered by a crafted request sent to the SSL VPN service when secondary authentication is configured on an affected tunnel group. A successful VPN login is not required.
⠀
• CVSS: 8.6
• Affected: Cisco Secure Firewall ASA and FTD with reachable SSL VPN services and secondary authentication
• Fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1
• Fixed FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
⠀
Cisco confirmed active exploitation in October but did not identify the attackers, targets or scale of the activity. No complete workaround is available, and administrators are urged to install a fixed release.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the 'webvpn' keyword and SSL VPN enabled on at least one interface. https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868.

#WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Rapid Response: Seven vulnerabilities in Progress WS_FTP Server, including a critical authentication bypass (CVE-2026-84295, CVSS 10.0), could expose administrative credentials and allow further server compromise.

Censys ARC identified ~2,500 Internet-exposed WS_FTP Server hosts.
Read the full advisory for additional details and queries: https://censys.com/advisory/cve-2026-84295-and-others/

#CensysARC #Cybersecurity #VulnerabilityManagement #WSFTP #InfoSec

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868.

#WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/?utm_source=mastodon&utm_medium=jetpack_social

CERT/CC warns of a critical Xerj authentication bypass tracked as CVE-2026-97406 that lets attackers mint persistent tokens without passkeys.

#Xerj #CVE202697406 #CERTCC #AuthenticationBypass #Cybersecurity #APISecurity #InfoSec

http://securityonline.info/xerj-authentication-bypass-cve-2026-97406/?utm_source=mastodon&utm_medium=jetpack_social

CERT/CC warns of a critical Xerj authentication bypass tracked as CVE-2026-97406 that lets attackers mint persistent tokens without passkeys.

#Xerj #CVE202697406 #CERTCC #AuthenticationBypass #Cybersecurity #APISecurity #InfoSec

http://securityonline.info/xerj-authentication-bypass-cve-2026-97406/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-119052 - High (7.5)

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-41709 – Broadcom VMWare ESX Insufficient Logging Vulnerability

An executive-level strategic brief analyzing CVE-2026-41709 for CEOs and Boards, focusing on hypervisor governance, regulatory audit assurance, and financial impact mitigation....

https://thecybermind.co/l8on

Broadcom Patches VMware ESXi Logging Bypass Exploited

CISA warns of active exploitation of a logging bypass vulnerability (CVE-2026-41709) that Chinese-linked hackers used as a zero-day to hide their activity during espionage attacks against U.S. law firms.

**If you run VMware ESXi 8.0 or 9.x (including Cloud Foundation, vSphere Foundation or Telco Cloud), update ASAP to ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 or ESXi80U3j-25429389. Attackers need admin access to use this flaw, so change your ESXi admin passwords and keep the management interfaces reachable only from trusted networks. In exploited systems with these flaws the attacker actions won't show up in the logs.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/broadcom-patches-vmware-esxi-logging-bypass-exploited-g-a-1-l-n/gD2P6Ple2L

(CISA TS + SOC) The Cyber Mind TSUITE Brief: CVE-2026-41709 – Broadcom VMWare ESX Insufficient Logging Vulnerability. Technical Response & SOC Investigation Brief

An exhaustive technical breakdown of CVE-2026-41709 targeting Broadcom VMware ESX, complete with multi-vendor SIEM detection queries, persistence analytics, and enterprise hardening controls....

https://thecybermind.co/iwba

⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). Both are actively exploited in the wild. Federal agencies must prioritize patching these on int…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Hat tip to The Hacker News for finding the exploitation evidence for CVE-2026-41709, which was added to CISA's KEV Catalog:

WARP PANDA: Multiple intrusions at U.S.-based entities included targets in the legal sector. WARP PANDA deployed several forms of malware in victims’ VMware vCenter environments. In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.

https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/
https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #zeroday #vmware #cve #KEV #ArmoryCastle

The vulnerability in question is CVE-2026-41709 (CVSS score: 2.7), an insufficient logging vulnerability that could permit a malicious actor with admin access to perform certain operations without being logged. https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

🟠 CVE-2026-119049 - High (7.6)

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through ass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49142 - High (8.8)

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TIL Yamaha makes WiFi routers. Of course they have a command injection vuln.

https://nvd.nist.gov/vuln/detail/cve-2026-97854

🔴 CVE-2026-97854 - Critical (9.8)

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-94109 openEQUELLA RCE via unsandboxed FreeMarker templates, CVSS 8. Authenticated attackers can run arbitrary commands. Patch not out yet - track it and restrict template access. #CVE #infosec https://www.valtersit.com/cve/CVE-2026-94109/

🟠 CVE-2026-39736 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119027 - High (7.5)

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI docume...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-110184 - High (7.5)

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119025 - High (7.5)

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-119028 - High (8.8)

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an en...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-10302

A #critical #SQL Injection #vulnerability has been identified in the Radius Xenia M2M Platform developed by Radius Synergies. The vulnerability, tracked as CVE-2026-114358, has been assigned a CVSS v4.0 score of 9.3 (Critical).

An unauthenticated remote attacker can #exploit this flaw through the password recovery functionality in the web management interface by supplying crafted SQL queries. Successful exploitation may allow the attacker to access sensitive information, enumerate the #database structure, or modify database records.

https://ksrc.karenit.net/blog/security-alert/critical-sql-injection-vulnerability-in-radius-xenia-m2m-platform

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

🚨🔓 SIGINT // Cybersecurity Watch — 2026-10-31
China-linked actors chained PHP2Shell with Linux kernel LPE Fragnesia (CVE-2026-46300) to root firewalls and used a VMware ESX zero-day. Patch and hunt now.
https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/
#PHP2Shell #ZeroDay #InfoSec #Cybersecurity

⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). Both are actively exploited in the wild. Federal agencies must prioritize patching these on int…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CW: részletes technikai leírás következik — PHP2Shell lánc + kernel LPE (Fragnesia) egyetlen hitelesítés nélküli HTTP kéréssel root jogot adott 25 tűzfalon, köztük kormányzati kapcsolódású környezetekben. CVE-2026-109618 / CVE-2026-109619 + CVE-2026-46300; kitett menedzsmentfelület veszélyes. Frissítsetek és zárjátok a menedzsment interfészeket. #CVE-2026-109618 #CVE-2026-46300 #Firewall #ActiveDirectory https://linuxmint.hu/hir/2026/10/lancolt-php2shell-sebezhetoseg-25-szervert-rootolt-meg

A critical Rust zip vulnerability CVE-2026-115905 allows attackers to bypass security gateways and overwrite server files using ZIP header discrepancies.

#Rust #Cybersecurity #CVE2026115905 #InfoSec #AppSec

https://securityonline.info/rust-zip-vulnerability-cve-2026-115905/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-45049 - High (8.3)

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Veeam Patches Critical Authorization Bypass and SQL Injection Flaws in Backup Software

Veeam patched eight vulnerabilities, including a critical authorization bypass (CVE-2026-108142) and a SQL injection flaw (CVE-2026-106076) that allows remote code execution. These vulnerabilities affect Veeam Backup & Replication and Veeam Backup for Microsoft 365, potentially exposing sensitive recovery data to unauthenticated attackers.

**If you run Veeam Backup & Replication 13.0 or 13.1, or Veeam Backup for Microsoft 365 v8, update ASAP to 13.1.2, 13.0.3 or 365 v8.6 Patch 1. Attackers exploiting these flaws can take over unpatched backup servers. Always make sure only trusted admin networks can reach your backup servers, and block untrusted access to the CDP service port.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/veeam-patches-critical-authorization-bypass-and-sql-injection-flaws-in-backup-software-3-h-6-p-j/gD2P6Ple2L

Veeam fixes seven vulnerabilities in Veeam Backup for Microsoft 365 and Management Pack, including RCE flaws CVE-2023-22793 and CVE-2026-106076.

#Veeam #VeeamBackup #Microsoft365 #SystemCenter #RCE #CVE202322793 #BackupSecurity #PatchNow

https://securityonline.info/veeam-vulnerabilities-microsoft-365-management-pack/?utm_source=mastodon&utm_medium=jetpack_social

Veeam Patches Critical Authorization Bypass and SQL Injection Flaws in Backup Software

Veeam patched eight vulnerabilities, including a critical authorization bypass (CVE-2026-108142) and a SQL injection flaw (CVE-2026-106076) that allows remote code execution. These vulnerabilities affect Veeam Backup & Replication and Veeam Backup for Microsoft 365, potentially exposing sensitive recovery data to unauthenticated attackers.

**If you run Veeam Backup & Replication 13.0 or 13.1, or Veeam Backup for Microsoft 365 v8, update ASAP to 13.1.2, 13.0.3 or 365 v8.6 Patch 1. Attackers exploiting these flaws can take over unpatched backup servers. Always make sure only trusted admin networks can reach your backup servers, and block untrusted access to the CDP service port.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/veeam-patches-critical-authorization-bypass-and-sql-injection-flaws-in-backup-software-3-h-6-p-j/gD2P6Ple2L

🚨 TeamViewer flaw lets remote hosts attack the computers controlling them

CVE-2026-111585 allows a malicious or compromised host to crash the TeamViewer client used to control it and, depending on the viewer’s operating system, potentially execute arbitrary code.

The vulnerability is triggered after a user establishes a remote-control session. A manipulated screen-size value causes an integer overflow, resulting in memory being written outside its allocated buffer.
⠀
• CVSS: 8.8
• Affected: TeamViewer Full Client on Windows, macOS and Linux, Windows Portable and Android Remote Control before 15.83
• Fixed: TeamViewer 15.83 or later
• Exploited: No known attacks

Researchers demonstrated code execution against a Windows viewer, although the proof required part of the attack data to be supplied locally and was not a fully remote exploit.

TeamViewer has provided no workaround. Users should update immediately.

Source: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/

TeamViewer CVE-2026-111585: Integer Overflow Turns the Remote Host Against the Technician

https://thecybersecguru.com/exploits/teamviewer-cve-2026-111585-integer-overflow-heap-corruption/

Red Hat OpenJDK 25.0.5 for Windows fixes CRITICAL vulns incl. CVE-2026-83374 (PKCS5 padding). Update immediately to mitigate threats. Applies to all Red Hat OpenJDK 25 Windows users. Full advisory: https://radar.offseq.com/threat/red-hat-security-advisory-openjdk-2505-security-update-for-windows-builds-b5844861bdb81e62 #OffSeq #Java #Security #RedHat