# pwn.watch · live security incidents

Source: https://pwn.watch
Kiwi News: https://news.kiwistand.com/stories/pwnwatch-live-security-incidents?index=0x6ae60dd7ab4f51920c49da7e4059904384c173ca41d2056c94d5c545505ded86bd6b88f9
Submitted by tim on 2026-10-31 UTC, 2 upvotes, 0 comments

## Summary

pwn.watch is a live feed of security incidents, several of them unpatched. The first entry is an unauthenticated remote code execution flaw in InternLM LMDeploy's api_server (CVE-2026-119706, CVSS 3.1 9.8), affecting versions 0.9.0 through 0.18.0, with the fix pull request #4964 still open and unreleased. Another entry describes Time4Popcorn, an abandoned Popcorn Time fork whose unsigned updater fetched code over plain HTTP; it has no fix, and the listing advises uninstalling the app. A Fearless Wallet extension entry reports that it sent private keys to an attacker server, with eight users reporting losses totalling 17,286 DOT.

## Article

No patch yet3Mitigate now

LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet

InternLM LMDeploy, an open-source toolkit for serving large language models, has an unauthenticated remote code execution flaw in its api_server (CVE-2026-119706, CVSS 4.0 9.3 / CVSS 3.1 9.8 critical). Versions 0.9.0 through 0.18.0 deserialize a base64-encoded pickle sent in serialized_named_tensors to the POST /update_weights endpoint with ForkingPickler.loads and no validation, so anyone who can reach the server can run OS commands as the api_server process. The bug was reported publicly in GitHub issue #4698 in June 2026; the fix pull request #4964, which makes the HTTP endpoint reject pickle by default, is still open and not in any release. The fix PR notes that the default api_server binds to 0.0.0.0 without API keys.

InternLM LMDeploy (api_server)Since Oct 30, 2026updated Oct 30, 2026, 16:45 UTC

Popcorn Time fork Time4Popcorn: unsigned HTTP updater let anyone push code to millions of devices (CVE-2026-30612)

Eye Security found that Time4Popcorn, an abandoned Popcorn Time fork, fetched updates over plain HTTP and ran unsigned executables, so whoever controlled the update endpoint or the network path could run code as SYSTEM on Windows or root on macOS. Researchers saw about 3 million Windows and 350,000 macOS clients checking in and disabled the updater remotely; Android clients stay exposed. There is no fix: uninstall the app.

Time4Popcorn (Popcorn Time fork) for Windows, macOS, AndroidSince Oct 23, 2026updated Oct 29, 2026, 16:00 UTC

Fearless Wallet browser extension leaked private keys for ~20 months

The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.

Fearless Wallet browser extension (Chrome; Firefox build delisted)Since Feb 19, 2025updated Oct 23, 2026, 21:26 UTC

Partly patched13Some versions fixed

EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631)

A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5).

TianoCore EDK II (UEFI firmware, NetworkPkg/UefiPxeBcDxe)Since Oct 15, 2026updated Nov 1, 2026, 05:10 UTC

ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)

ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.

ISC BIND 9 (named) DNS serverSince Oct 21, 2026updated Nov 1, 2026, 03:46 UTC

Tailworm: researcher drops 11 Tailscale and headscale flaws; Tailscale 1.104.4 fixes the SSH forwarding root escalation

Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale confirmed the SSH issues as serious privilege-escalation bugs and on Oct 28 released Tailscale 1.104.4 with bulletins TS-2026-014 (SSH unix-socket forwarding to root-only sockets such as the Docker socket or local API), TS-2026-015 (SSH session memory exhaustion), TS-2026-016 (serve unix backends reaching privileged sockets) and TS-2026-017 (HTTP/2 serve capability mix-up). Upgrade to 1.104.4 or newer; the bulletins do not cover the app-connector or headscale findings. It is lateral movement from a foothold, not internet RCE.

Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscaleSince Oct 25, 2026updated Nov 1, 2026, 01:54 UTC

PHP2Shell: critical unauthenticated RCE in PHP core

Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (QNAP shipped NAS firmware fixes Oct 24; other appliance vendors are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.

PHPSince Oct 17, 2026updated Nov 1, 2026, 01:15 UTC

Android "SMS of Death": one silent text crashes the phone service and drops calls (CVE-2026-58882)

A researcher published a working proof-of-concept for CVE-2026-58882, nicknamed "SMS of Death", a zero-click denial-of-service flaw in Android's telephony framework. Android's WapPushOverSms.decodeWapPdu() reads a WAP Push header length and casts it to a signed 32-bit integer with no range check, so an 8-byte data SMS sent to port 2948 makes it allocate an array of size -2147483648, which throws an uncaught NegativeArraySizeException and kills com.android.phone. That drops cellular service and any active call, including emergency calls, and the message never shows up in the inbox. The researcher reports that about 20 messages can leave a phone unusable, that carrier redelivery and retries on boot keep re-crashing it, and that one Android 12 test phone fell into a recovery-mode reboot loop that needed a factory reset; clearing the queued messages otherwise takes ADB. Google's fix ("Fix remote DoS in decodeWapPdu") shipped in the October 2026 Android security update for Android 14 through 17. It catches the exception and deletes the poison message rather than adding a bounds check. Android 12 and 13 run the same code and get no fix. The flaw is not listed in Google's October bulletin, and exploitation in the wild has not been reported.

Android telephony framework (com.android.phone)Since Oct 29, 2026updated Nov 1, 2026, 00:14 UTC

BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)

China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).

BeyondTrust Remote Support (formerly Bomgar)Since Aug 29, 2026updated Oct 31, 2026, 02:16 UTC

EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched

Forever Security published research on Oct 29 2026, which it calls EMBRACE, showing that the browsers built into five AI coding assistants let a web page or a local file reach the computer behind them. In Cursor a booby-trapped page got the agent to run a command on the host with a single Enter (fixed Oct 1). In GitHub Copilot a page could spoof the address bar to show github.com to both the user and the agent (fixed in Copilot 1.1.29). In Codex, VS Code and Claude Desktop a single local HTML file opened in the built-in browser could read and exfiltrate any file on the disk, such as SSH keys, .env files and npm tokens. Codex and VS Code had no fix at publication: Microsoft declined the report citing Workspace Trust, and OpenAI never replied.

Embedded browsers in AI coding assistants (Cursor, GitHub Copilot, OpenAI Codex, VS Code, Claude Desktop)Since Oct 29, 2026updated Oct 30, 2026, 21:11 UTC

Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others)

Researcher Hyunwoo Kim (@v4bel) published "Infinity Core" on oss-security on Oct 16 2026 after the linux-distros embargo ended: six bugs in the Linux kernel's Timer, Signal, MM, Futex, Scheduler and SLAB code. Five come with public proof-of-concept exploits that take an unprivileged local user to a root shell, and the researcher says they also allow container escape; none needs an unprivileged user namespace. Four of the root exploits were tested on Ubuntu 26.04 (kernel 7.0.0-30-generic) and the scheduler one on Arch Linux (7.2.4-arch1-2). The timer bug, CVE-2026-98260 (a POSIX CPU timer use-after-free when exec() fails in a non-leader thread), also gives full root from an Android untrusted_app on a Samsung Galaxy S26 Ultra; that Android exploit is held back until Samsung ships a fix. The other CVEs are CVE-2026-98256 (sigqueue use-after-free in exec()), CVE-2026-89754 (out-of-bounds write in the page table walk used by mincore()), CVE-2026-80775 (futex private hash use-after-free), CVE-2026-98385 (scheduler cache accounting use-after-free, only with CONFIG_SCHED_CACHE active and multiple LLCs) and CVE-2026-97941 (SLUB list corruption, public trigger only panics the kernel). All are fixed upstream and in stable kernels. Every exploit needs code already running on the machine. Install your distro's kernel update and reboot.

Linux kernel (timer, signal, mm, futex, scheduler, SLUB)Since Oct 16, 2026updated Oct 30, 2026, 13:44 UTC

Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)

On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (ZDI-CAN-33367, CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. ZDI-CAN-33367 now has a working public exploit: CloudLinux confirmed it gives any local user root on AlmaLinux 8, 9 and 10, Debian 12 and 13, and Ubuntu 24.04 and 26.04 where unprivileged user namespaces are allowed, and setting user.max_user_namespaces to 0 closes that path. No CVEs yet and no fixed mainline or stable release; the skb_zerocopy fix is posted for review but not merged, CloudLinux says fixed kernels for CloudLinux 9 and 10 (the AlmaLinux kernels 5.14.0-687.60.1.el9_8 and 6.12.0-211.69.1.el10_2) are in production and CloudLinux 7 hybrid and 8 kernels are in beta, KernelCare has a livepatch only for CloudLinux/AlmaLinux 10, the ksmbd race fix sits in the ksmbd maintainer tree, and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation in the wild reported. Only machines running ksmbd are exposed to the RCEs.

Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmetSince Oct 21, 2026updated Oct 30, 2026, 10:07 UTC

Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper

Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials.

Adobe Commerce / Magento Open SourceSince Jul 9, 2025updated Oct 28, 2026, 23:57 UTC

Dahua cameras and recorders hijacked through Easy4IP P2P cloud access, CERT-UA warns

Ukraine's CERT-UA warns that attackers are taking over Dahua IP cameras, NVRs and DVRs: they watch the video stream, change device settings and add their own accounts. The main way in is Dahua's P2P cloud access (Easy4IP), which reaches devices by serial number through the manufacturer's cloud, bypassing NAT and firewalls. Serial numbers follow a predictable pattern, so attackers appear to guess them in bulk, meaning any device with P2P turned on is at risk even if it is not exposed to the internet. Logins are then beaten with weak or default passwords or, on outdated firmware, the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The methods match Hunt.io's Operation CameraSwarm, which compromised 14,530+ Dahua devices in Ukraine and Russia between June 17 and July 22, 2026 and left a backdoor account on 1,923 of them, though no link between the two has been shown. Turn off P2P/Cloud Access if you don't need it, keep cameras off the open internet, remove unknown accounts and update firmware.

Dahua IP cameras, NVRs and DVRs (Easy4IP P2P cloud access)Since Oct 26, 2026updated Oct 28, 2026, 18:00 UTC

BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation

Kaspersky GReAT found a new UEFI bootkit, BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and attributed with medium confidence to China-linked APT41. It is a copycat of BlackLotus and exploits Baton Drop (CVE-2022-21894) to install its own Machine Owner Keys, load arbitrary EFI files and inject a kernel driver that blinds security software. The targeted machines were fully patched: Microsoft's fix only revokes the vulnerable "Windows Production PCA 2011" signing certificate after an admin manually sets a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and runs the Secure-Boot-Update task, and Microsoft's planned automatic enforcement phase has not shipped. The certificate expired on Oct 19, 2026, but that does not stop vulnerable boot binaries from loading unless it is in the DBX blocklist. Attackers need admin rights or physical access first, so this is a persistence tool, not an initial access vector. Windows admins should apply Microsoft's Secure Boot revocation steps manually.

Microsoft Windows Secure Boot (Windows Boot Manager signed by Windows Production PCA 2011)Since Oct 22, 2026updated Oct 27, 2026, 14:35 UTC

HTTP/3 QPACK “Header Accordions” memory-amplification DoS

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)Since Oct 20, 2026updated Oct 23, 2026, 21:26 UTC

Patched76Update and you are fine

Oct 23PatchedRuby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs

Ruby (CRuby / Onigmo regex engine)

Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.

Open incident →

CVE-2026-89078 · CVE-2026-93577 · CVE-2026-97229 +1

Oct 21PatchedGitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)

GitLab CE/EE (self-managed)

GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.

Open incident →

CVE-2026-110264

Oct 15PatchedLinux kernel CVE-2026-98432: TCP use-after-free rated 9.8, Anthropic says its AI built a remote root exploit

Linux kernel (IPv4 TCP)

CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP handshake code (ireq_opt/inet_opt freed without an RCU grace period), fixed upstream on Oct 15 and rated 9.8 by the kernel CNA. On Oct 28 Anthropic said an unreleased Claude model turned the bug into a zero-click remote root exploit against servers running a multipath TCP listener (about 48 minutes to defeat KASLR, five more to get a shell). The exploit was built in a lab and is not known to be used in attacks. Update to a fixed stable kernel.

Oct 30PatchedClickHouse Server: unauthenticated remote code execution (CVE-2026-116366)

ClickHouse Server

ClickHouse fixed a flaw in ClickHouse Server that, under certain conditions, lets an unauthenticated user with network access run arbitrary code on the server (CVE-2026-116366, CWE-190 integer overflow, CVSS 4.0 score 9.5 critical). Fixes shipped Oct 30 2026 in v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable. ClickHouse says the fix is already applied to all ClickHouse Cloud and BYOC deployments, so self-hosted servers are the ones that need upgrading. The bug was reported by researcher Elshad Toklayev through ClickHouse's bug bounty. No public exploit or in-the-wild exploitation has been reported.

Open incident →

CVE-2026-116366

Oct 20PatchedChrome 156 updates fix 426 security bugs, 11 of them critical (none known exploited)

Google Chrome (desktop)

Google's Chrome 156 stable release (156.0.8078.47, .48 on some Windows/Mac) fixed 353 security issues, including six critical bugs in Skia, Accessibility, CSS, Paint and WebRTC. On Oct 27 a follow-up update (156.0.8078.73/.74) fixed 52 more, four of them critical (FileSystem, FileAPI, Skia, Layout). On Oct 29 a third update (156.0.8078.79/.80) fixed 21 more, including a critical memory corruption bug in MediaStream (CVE-2026-76024). Google has not said any are exploited. The rollout is staged, so update and relaunch rather than waiting.

Oct 19Patchednpm open PowerShell injection (CVE-2026-119025): malicious MCP servers can run code on Windows/WSL via OpenCode and MCP Inspector sign-in

npm open package (7.2.0 to 10.x) and apps using it on Windows/WSL, including OpenCode and MCP Inspector

A command-injection flaw in the widely used npm package open (versions 7.2.0 to before 11.0.0) lets a crafted URL run PowerShell code on Windows and WSL: open placed the URL unescaped inside a PowerShell double-quoted string, where $(...) subexpressions execute. Tools that open server-supplied URLs are exposed. A malicious or hijacked remote MCP server can answer with an OAuth authorization endpoint containing a payload, and it runs as soon as the developer connects or signs in. Affected apps named in the CVE record are the OpenCode AI coding agent 1.0.137 to 1.18.32 (fixed in 1.18.33 on Sep 28 without an advisory) and MCP Inspector 2.0.0 to 2.11.0 (fixed in 2.12.0, GHSA-q978-78c7-phqw). open itself fixed the escaping in 11.0.0. VulnCheck assigned CVE-2026-119025 on Oct 29 2026 and rates it High (CVSS 4.0 7.7); Pillar Security, which found it, had proposed 9.8 for OpenCode. macOS and Linux are not affected; no in-the-wild exploitation reported.

Open incident →

CVE-2026-119025

Oct 14PatchedNext.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)

Next.js (next on npm), sharp / librsvg

On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.

Oct 29PatchedKubeflow Pipelines: unauthenticated path traversal reads arbitrary files via volume artifacts (CVE-2026-118758), fixed in 2.18.0

Kubeflow Pipelines

Kubeflow Pipelines before 2.18.0 does not confine the file path passed to the volume artifact handler (GET /artifacts/get?source=volume) to the selected volume. A caller who can reach the route and names an existing mounted volume can use path traversal to read any file the artifact-serving process can read. The ml-pipeline-ui frontend pod serves the request when artifact proxying is disabled, and the namespace's artifact-service pod serves it when proxying is enabled. Deployments with authentication disabled need no credentials; in multi-user deployments the caller ordinarily must be authorized for the namespace. The CNA scores it CVSS 3.1 7.5 (unauthenticated, network, high confidentiality impact). Fixed in 2.18.0. The same day Kubeflow published three companion CVEs: CVE-2026-118759 (CVSS 7.5, the run log streaming endpoint skips namespace authorization and exposes pod execution logs across tenants, fixed in 2.18.0), CVE-2026-118760 (CVSS 6.5, missing namespace authorization allows cross-tenant artifact reads, fixed in 2.17.0) and CVE-2026-118761 (CVSS 7.5, a pipeline archive upload decompression bomb can exhaust server memory, fixed in 2.18.0).

Open incident →

CVE-2026-118758 · CVE-2026-118759 · CVE-2026-118760 +1

Oct 19PatchedWasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893)

Wasmtime (Bytecode Alliance) and its Cranelift compiler

Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported.

Open incident →

CVE-2026-115889 · CVE-2026-115893

Oct 23PatchedLaravel TokenGuard authentication bypass through non-string API credentials (CVE-2026-114509)

Laravel framework (laravel/framework) TokenGuard

Laravel's built-in TokenGuard, when configured as a standard token-based API guard, can be bypassed to log in as an arbitrary existing user without their API token. On some database configurations (MySQL/MariaDB), a crafted non-string credential is mishandled during the lookup so the query matches an unintended user instead of failing. An unauthenticated attacker can take over accounts on any route protected by that guard. Upgrade laravel/framework to 12.68.0 or 13.29.0. GitHub rates it critical (CVSS 4.0 score 9.2).

Open incident →

CVE-2026-114509

Oct 14PatchedDrupal core Field UI remote code execution (CVE-2026-108097, SA-CORE-2026-014)

Drupal core (Field UI module)

A remote code execution vulnerability exists in the Field UI module in Drupal core. It isn't directly exploitable with core alone, but the Drupal Security Team says multiple serious exploit paths exist with contributed modules, at least one without authentication, and custom code may also expose it. Rated Critical (19/25). Update to Drupal 11.4.10, 11.3.19 or 10.6.19; uninstalling the core Field UI module (field_ui) mitigates it until then.

Open incident →

CVE-2026-108097

Sep 10PatchedAttackers backdoor Nextcloud servers through the Collabora Built-in CODE Server app (CVE-2026-110447)

Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud

An unauthenticated OS command injection in proxy.php of Collabora Online - Built-in CODE Server (richdocumentscode), an optional Nextcloud app, lets attackers run commands on the Nextcloud server whenever the app's local CODE document server isn't running, for example during a restart, an upgrade or after a crash. It was exploited in the wild in September and October 2026 to plant web shells, with the first attack reported on GitHub on Sep 10. Collabora fixed it in richdocumentscode 26.4.303 on Sep 11 and published CVE-2026-110447 (CVSS 4.0 9.2) on Oct 14; it is a different bug from the 2025 proxy RCE CVE-2025-66208. Turning the app off is not enough: update it or remove it. Standalone Collabora Online servers, Docker or distro packages, hosted Collabora, and Nextcloud Office (richdocuments) without the built-in app are not affected. Admins who ran a vulnerable version should also hunt for unexpected PHP files.

Open incident →

CVE-2026-110447

Oct 28PatchedFreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories

SignalWire FreeSWITCH

SignalWire published GitHub advisories for FreeSWITCH, the open-source telephony switch behind FusionPBX and many VoIP platforms. The critical one, CVE-2026-116779 (CVSS 9.8), lets anyone who can get a SIP MESSAGE accepted address it to the api chat proto and have FreeSWITCH run any API command, including system for OS commands and inline Lua where mod_lua is loaded. Inbound chat is on by default, the inbound ACL does not cover MESSAGE, and one registered SIP account (or the stock passwordless default directory user) is enough. The advisory says exploitation has been observed in the wild. It is fixed in 1.11.3 (released Aug 28), which adds an enable-chat-api-proto setting that is off by default. Oct 26 and Oct 28 advisories also cover pre-auth memory bugs in mod_xml_rpc WebSocket handling (CVE-2026-116785, CVSS 9.1), ICE checks accepted without STUN MESSAGE-INTEGRITY (CVE-2026-116790, CVSS 9.1), SIP REFER channel-variable injection leading to command execution (CVE-2026-116786), and overflows in mod_rtmp, MSRP, SDP crypto and the Event Socket, all fixed in 1.11.2. Upgrade to 1.11.3.

Open incident →

CVE-2026-116779 · CVE-2026-116785 · CVE-2026-116790 +1

Oct 27PatchedTeamViewer 15.83 fixes remote code execution in its clients and SYSTEM/root escalation in Remote Management add-ons

TeamViewer Remote, Tensor and ONE clients and Remote Management add-ons

On October 27 TeamViewer published two bulletins covering nine CVEs. TV-2026-1011 fixes two remote-code-execution bugs in TeamViewer clients rated CVSS 8.8: an out-of-bounds write in the screen-image decoder of the Full Client for Linux and macOS (CVE-2026-92372), reachable through crafted screen-image data in a remote-control session or a crafted .tvs session recording, and an integer overflow in remote-control screen processing in the Full Client, Portable and Android Remote Control app (CVE-2026-111585), triggered by connecting to an attacker-controlled or compromised host. Both need user interaction. It also fixes a macOS privileged-helper race (CVE-2026-92374) that lets a local user install a malicious package and get root. TV-2026-1012 fixes six local privilege escalation bugs (CVE-2026-92375, CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583, CVE-2026-111584) in the Remote Management Monitoring, Patch Management and Advanced Asset Management add-ons that can give a low-privileged local user SYSTEM or root. TeamViewer rates both bulletins Important and says it is not aware of exploitation in the wild. Update TeamViewer Full Client, Host and Portable to 15.83 (or the patched legacy builds 15.64.10, 14.7.48868 and 13.2.x); the add-on fixes (Monitoring 26.10.1, Patch Management 26.9.1) arrive by auto-update.

Open incident →

CVE-2026-92372 · CVE-2026-111585 · CVE-2026-92374 +6

Oct 21PatchedNode2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases

Node.js

Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4. On Oct 23 Aikido started calling the wider impact HTTP2Shell: the bug sits in Google Brotli itself, so other software that decodes Brotli needs its own update. Envoy published a critical advisory (GHSA-3wvj-j6qm-62mr) for deployments with a Brotli decompressor configured, fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio has the fix in 1.29.9, 1.30.6 and 1.31.2. On Oct 25 Microsoft shipped fixes for .NET (8.0.33, 9.0.22, 10.0.14, 11 RC3), Visual Studio 2019/2022/2026 and PowerShell 7.4/7.5/7.6. If you can't patch yet, disable Brotli decoding of untrusted data, and restart services or rebuild images after patching. On Oct 26 PHP shipped Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1, since the bundled decoder is reachable through cURL when automatic response decompression is on.

Open incident →

CVE-2026-111497 · CVE-2026-105482 · CVE-2026-105483 +7

Oct 28PatchedJenkins core: 15 vulnerabilities including XStream deserialization RCE and a setup-wizard admin takeover race (Jenkins 2.588, LTS 2.580.2)

Jenkins (core), weekly and LTS

The Jenkins project published a core security advisory on Oct 28 fixing 15 vulnerabilities in Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier, 13 rated High and 2 Medium. The most serious: CVE-2026-117612 lets attackers with Overall/Read and a user account (or any config.xml POST permission) instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution. CVE-2026-117614 lets users with Agent/Configure run arbitrary code on the controller through unapproved legacy agent launch commands. CVE-2026-117615, CVE-2026-117616 and CVE-2026-117617 allow arbitrary file read, config.xml overwrite and arbitrary file writes on the controller that can lead to code execution. CVE-2026-117618 is a race in the setup wizard that lets unauthenticated attackers create an administrator account while the initial account is being replaced, and CVE-2026-117620 lets Overall/Read users take over accounts through the Manage Old Data feature. The rest are stored XSS, a remember-me cookie that survives API token revocation, and information leaks. All are fixed in Jenkins 2.588 and LTS 2.580.2. Many were reported by the Anthropic OSS program.

Open incident →

CVE-2026-117612 · CVE-2026-117613 · CVE-2026-117614 +12

Oct 30PatchedpgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass

pgAdmin 4

pgAdmin 4 9.19 (released Oct 29 2026) fixes a batch of CVEs published on Oct 30 2026, all affecting versions before 9.19. The worst, CVE-2026-116241 (CVSS 4.0 9.4, CVSS 3.1 9.9), bypasses the earlier fix for CVE-2026-17566: in the Import/Export Data tool a backslash inside a double-quoted identifier lets a query escape psql's \copy wrapper, so a TO PROGRAM clause runs on the pgAdmin host as the operating-system account running pgAdmin. An ordinary database role can trigger it, since it can turn standard_conforming_strings off for itself and the Import/Export permission is granted to non-administrators by default. CVE-2026-116238 (CVSS 4.0 9.2) lets an unauthenticated attacker in server mode bypass the failed-login lockout and guess passwords for any internal account, including the administrator's. Other fixes cover LDAP/Kerberos accounts colliding with same-named users (CVE-2026-116239), pgAdmin's own SSH, Kerberos, password-file and certificate credentials being used for user connections, storage-directory path escapes and symlink races, and sessions that survive a password change. No exploitation has been reported so far.

Open incident →

CVE-2026-116241 · CVE-2026-116238 · CVE-2026-116239 +12

Oct 25PatchedAtlantis 0.49.0 fixes 12 security flaws, including a critical forged-webhook fork-protection bypass that leads to remote code execution

Atlantis (Terraform pull request automation)

On October 25 the Atlantis project (the Terraform pull request automation server) released v0.49.0 and published 12 GitHub security advisories fixed in it. The worst, GHSA-6mjf-4m52-m5cq (CVSS 9.8, critical), comes from Atlantis checking only the path of a pull request's clone URL and not its host, while trusting the head repository name from the webhook body: a forged webhook can point Atlantis at an attacker's git server, pass the --allow-fork-prs=false gate and --repo-allowlist, and have Atlantis fetch and plan a Terraform tree the attacker controls. Servers without a GitHub webhook secret accept that forged webhook from anyone without authentication. Other fixes cover a Gitea dismissed-approval bypass of apply_requirements (GHSA-fm5f-jg8p-x2vw, 8.8), an allowed_workflows allow-list bypass in multi-project atlantis.yaml files (GHSA-56q6-8vmp-v2qm, 8.2), a plan-hijack apply-approval bypass (GHSA-5vwh-xc92-8h64), a pull request symlink that makes Terraform run outside the checkout (GHSA-9q39-mgw7-5789), unauthenticated lock metadata on /api/locks (GHSA-xgrg-fpp6-q6fm), timing attacks on Basic Auth and API secrets plus path traversal on /api/plan and /api/apply, an arbitrary file read via --var-file, secrets leaking into PR comments when output hiding errors, and a CSRF in the GitHub App setup callback. The advisories do not mention exploitation. v0.49.0 is a breaking release: GitHub and GHES webhooks whose clone URL host differs from --gh-hostname are now rejected, and the Docker images no longer bundle Terraform or OpenTofu. Anyone upgrading from v0.47.0 or earlier also picks up the v0.47.1 fix for CVE-2026-116676, a PR-controlled workspace name that was passed unquoted into a shell command. Upgrade to 0.49.0 and set a GitHub webhook secret.

Open incident →

CVE-2026-116676

Oct 12PatchedGoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws

Embedthis GoAhead embedded web server

Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.

Open incident →

CVE-2026-115888 · CVE-2026-115881 · CVE-2026-115884 +2

Oct 29PatchedZITADEL: three Login V2 account takeover bugs (CVE-2026-119127, -119128, -119129), fixed in 4.19.5

ZITADEL

ZITADEL published three account takeover advisories for its Login V2 UI, with CVE records on Oct 29 2026. CVE-2026-119127 (CVSS 4.0 8.6) is a host header injection: unauthenticated attackers who know a victim's login name can poison password-reset, invite and email-verification links via the x-zitadel-public-host, x-zitadel-forward-host or x-forwarded-host headers, harvest the single-use codes and take over accounts, including instance administrators. CVE-2026-119128 (CVSS 4.0 9.1) lets unauthenticated attackers compute a valid verificationCheck cookie from the user ID and browser fingerprint and set the first credential (password, passkey or linked identity provider) of users that have no authentication method yet. CVE-2026-119129 (CVSS 4.0 8.6) is missing authorization in OAuth 2.0 device authorization: a signed-in user who opens a link carrying the attacker's user code hands over their tokens, and project access settings can be bypassed via the OIDC device authorization API. 4.0.0 before 4.19.5 is affected by all three; 3.0.0 through 3.4.15 is also affected by the device authorization bug.

Open incident →

CVE-2026-119128 · CVE-2026-119127 · CVE-2026-119129

Oct 24PatchedElectrum wallet: malicious servers swap just-sent transactions and trick users into fee-bumping a payment to the attacker

Electrum Bitcoin wallet

Electrum before 4.8.3 trusted its server for unconfirmed transactions without checking their signatures. A malicious Electrum server can swallow a transaction the user just broadcast and show a conflicting fake (with invalid signatures) that pays an attacker address ground to match the last four characters of the real one. If the user then bumps the fee with Replace-By-Fee, the wallet signs a valid payment to the attacker. Electrum says some servers are doing this in the wild, and one user lost money. Upgrade to Electrum 4.8.3; until then, check every output address and amount before signing, including fee bumps. Users connecting only to a server they run or trust are not affected.

Open incident →

CVE-2026-117601

Oct 24PatchedPostiz: forged signed tokens and post-media path traversal let any registered user take over orgs and read server files (CVE-2026-115933, CVE-2026-115932)

Postiz (gitroomhq/postiz-app), self-hosted

Two critical bugs in the self-hosted Postiz social media scheduler, both reported with working PoCs by Anthropic. Postiz signed session, invite and password-reset tokens with one shared secret and no purpose marker, and an extension-refresh route signed request data, so any registered user could forge tokens and become super admin of another organization (CVE-2026-115933, CVSS 9.9). A separate path traversal in post media let a registered user have the worker send any server file, including the JWT secret and env file, to their own Discord server (CVE-2026-115932, CVSS 9.6). Both are fixed in Postiz 2.25.3; self-registration is open by default, so upgrade now.

Open incident →

CVE-2026-115933 · CVE-2026-115932

Oct 23PatchedEcho Go framework: rejected WebSocket upgrades let requests bypass route-level auth in the Proxy middleware

Echo (github.com/labstack/echo) Proxy middleware

Echo's Proxy middleware opened a raw tunnel as soon as a client asked for a WebSocket upgrade, before checking whether the upstream accepted it. If the upstream answered with an ordinary HTTP response and kept the connection alive, later HTTP requests on that connection went straight to the upstream without passing through Echo's router or route-specific middleware, which can bypass authentication or authorization enforced only at Echo's routes. It needs an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. It affects the v4 and v5 release lines; upgrade to v4.16.1 or v5.4.1. GitHub rates it critical (CVSS 4.0 9.1), and it is tracked as CVE-2026-118264.

Open incident →

CVE-2026-118264

Oct 23PatchedPillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398)

Pillow (Python imaging library)

A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker run code by getting an application to open a single crafted file with Image.open(). Pillow detects FPX files by their OLE2 content, not their extension, so any service that opens or thumbnails untrusted uploads with the optional olefile package installed can be hit with no user interaction. The advisory includes a working proof of concept (shown on Pillow 12.2.0 with ASLR disabled). Pillow 12.3.0 and earlier are affected; upgrade to 13.0.0. GitHub rates it critical (CVSS 4.0 score 9.2). The same 13.0.0 release (Oct 16) also fixes other critical bugs: CVE-2026-112900, where an EPS filename starting with - or @ is passed to Ghostscript as an option and can lead to code execution (2.6.0 through 12.3.0); CVE-2026-112393, a heap overflow when saving TIFF to BytesIO (public reproducer); and CVE-2026-112403, a JPEG heap overflow with draft()/thumbnail() on libjpeg-turbo 3.x builds.

Open incident →

CVE-2026-112398 · CVE-2026-112900 · CVE-2026-112393 +1

Oct 21PatchedKeycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)

Keycloak / Red Hat Build of Keycloak (keycloak-services)

A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.

Oct 13PatchedFortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656)

Fortinet FortiSandbox and FortiSandbox PaaS

Fortinet advisory FG-IR-26-185 describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI that lets a remote, unauthenticated attacker bypass authentication with crafted HTTP requests and execute unauthorized code or commands. It affects FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, and FortiSandbox PaaS 5.0.0 through 5.0.6 and all 4.4 versions; the NVD record also lists FortiSandbox and PaaS 4.2 as affected. Fixes are FortiSandbox 5.0.7 and 4.4.10 (PaaS 5.0.7; PaaS 4.4 users must migrate to a fixed release). The 5.2 line is not affected. Fortinet rates it critical (CVSS 9.6 in the advisory, 9.8 on the CVE record) and says it is not known to be exploited. This is a separate bug from the FortiSandbox command injection CVE-2026-25089 that CISA flagged as exploited in July.

Open incident →

CVE-2026-107656

Oct 27PatchedEPICS Base 7.0.11 fixes four memory-safety bugs, including a critical 9.8 integer overflow that can lead to remote code execution

EPICS Base (Experimental Physics and Industrial Control System)

On October 27 CISA published ICS advisory ICSA-26-300-01 for EPICS Base, the open source control-system toolkit used to run particle accelerators, fusion experiments and other large research facilities. EPICS Base 7.0.10 and earlier have four bugs in network message handling: CVE-2026-114595 (CVSS 3.1 9.8, critical), an integer overflow in network request processing that allocates memory with the wrong size and can lead to memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (8.2), an integer overflow from improper message length validation that causes an out-of-bounds write; CVE-2026-114597 (7.5), out-of-bounds reads from insufficient bounds checking; and CVE-2026-114598 (7.5), a type confusion that can cause denial of service and expose adjacent memory. Shubham Raj of Causal Security reported them, and The Register reports the company's autonomous AI agent Cipher found all four in under four hours. The EPICS community released EPICS Base 7.0.11 with the fixes; CISA's advisory does not mention exploitation. Update to 7.0.11 and keep EPICS networks isolated from untrusted access.

Open incident →

CVE-2026-114595 · CVE-2026-114596 · CVE-2026-114597 +1

Oct 20Patchedjackson-databind: PolymorphicTypeValidator bypass via generic type arguments allows arbitrary class instantiation (CVE-2026-110879)

jackson-databind (FasterXML Jackson, Java)

A critical bypass in jackson-databind, the Java JSON library, lets an attacker who controls polymorphic JSON smuggle arbitrary classes in as generic type arguments or array element types, even when the same class is rejected as a direct type ID. It's an incomplete fix for CVE-2026-54512. Affected paths include annotation-based class-name polymorphism with a default Jackson 3.x JsonMapper, configured default typing in Jackson 2.x and 3.x, Spring Security's legacy Jackson 2 module, and Spring Data Redis's RedisSerializer.json() and GenericJackson2JsonRedisSerializer(). The advisory demonstrates a Spring path that ends in ProcessBuilder.start() under the application account. Exploitability depends on the app's polymorphism configuration and classpath. Upgrade to jackson-databind 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. GitHub rates it critical (CVSS 9.8).

Open incident →

CVE-2026-110879 · CVE-2026-54512

Oct 21PatchedFortinet patches critical AI-found flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator

Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator

Fortinet shipped a coordinated security hardening release fixing critical and high-severity vulnerabilities found by its frontier AI-assisted testing program. Fixes for FortiMail and FortiAuthenticator came out Oct 21 and for FortiOS, FortiManager and FortiAnalyzer on Oct 22, 2026. CVE IDs and advisories are withheld until Fortinet's November 10 Patch Tuesday, and Fortinet warns attackers can use AI to reverse-engineer the patches, so it urges upgrading now, starting with internet-facing devices.

Aug 27PatchedCloudflare Workers AI's GLM-5.3 returned other customers' data in 155 responses after an SGLang KV cache bug; SGLang operators should update to v0.5.22

SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 model

Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length.

Oct 28PatchedLangflow OSS: unauthenticated RCE and auth bypass (CVE-2026-110186, CVE-2026-93680), fixed in 1.13.0

Langflow OSS

IBM published a security bulletin on Oct 28 2026 for Langflow OSS 1.0.0 through 1.12.8, the open source AI workflow builder. It covers an unauthenticated remote code execution flaw (CVE-2026-110186, CVSS 9.8) that IBM says is exploitable through model context protocol tool enumeration, an incomplete fix of the auto-login security control that allows an authentication bypass (CVE-2026-93680, CVSS 9.8), several authenticated code execution bugs (CVSS 8.8), API key exposure, path traversal, and vulnerable bundled dependencies such as Hono. The fix is to upgrade to Langflow OSS 1.13.0 or later; IBM lists no workarounds. Companion IBM bulletins for Langflow OSS add CVE-2026-104339 (CVSS 9.8, unauthenticated OS command injection leading to code execution) and CVE-2026-107328 (CVSS 9.9, authenticated code injection through eval/exec), with the same upgrade-to-1.13.0 fix. A further IBM bulletin adds CVE-2026-107327 (CVSS 9.9, authenticated code execution due to missing authorization, Langflow OSS 1.0.0 through 1.12.4), and another adds CVE-2026-107329 (CVSS 9.9, authenticated code execution through improper control of code generation, same versions).

Open incident →

CVE-2026-110186 · CVE-2026-93680 · CVE-2026-104339 +16

Oct 13PatchedAdobe Commerce / Magento "BlockStrap": unauthenticated template-injection RCE (CVE-2026-103849)

Adobe Commerce, Magento Open Source, Adobe Commerce B2B

BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days.

Open incident →

CVE-2026-103849

Oct 29PatchedRancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290)

SUSE Rancher Manager and Rancher Fleet

SUSE shipped Rancher Manager v2.15.3, v2.14.7, v2.13.11, v2.12.15 and v2.11.19 with Fleet v0.16.3, v0.15.8, v0.14.12 and v0.13.17 on Oct 29 2026, fixing six vulnerabilities. The worst is CVE-2026-94290 (CVSS 4.0 9.4 critical) in Fleet's agent management controller, which runs on the Rancher local cluster as cluster-admin: it did not restrict which kubeconfig secrets a Fleet Cluster object could reference, so an authenticated Rancher user with only the default user global role could get full cluster-admin on the management cluster, exposing every secret there, including credentials for all downstream clusters. Fleet is enabled by default in Rancher. The release also fixes CVE-2026-104615 (high), a Fleet cluster identity takeover where a holder of a workspace registration token could claim another cluster's identity and read Secrets and ConfigMaps synced into its Fleet namespace; CVE-2026-104623 (medium), where any authenticated user could get an unprivileged shell pod on the management cluster; CVE-2026-88809 (high), a meta proxy allowlist bypass leading to server-side request forgery; CVE-2026-88811 (high), where the meta proxy leaked the caller's Rancher credentials to third-party cloud provider hosts; and CVE-2026-88810, a GlobalRole RBAC escalation fixed in v2.15.3.

Open incident →

CVE-2026-94290 · CVE-2026-104615 · CVE-2026-104623 +3

Oct 28PatchedDrupal Commerce Core access bypass actively exploited (CVE-2026-118539, SA-CONTRIB-2026-254)

Drupal Commerce Core (commerce module)

Drupal Commerce Core, the shopping cart and checkout module for Drupal stores, doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. The Drupal Security Team rates it Highly critical (21/25, no access needed) and says it is being actively exploited in the wild. Upgrade to Commerce Core 3.3.13 or 8.x-2.41, and audit orders for inconsistencies.

Open incident →

CVE-2026-118539

Oct 30PatchedThales Sentinel Keys Server unauthenticated RCE as SYSTEM (CVE-2026-78403), fixed in 1.3.8.0

Thales Sentinel Keys Server (Windows)

Thales published two CVEs on Oct 30 2026 for Sentinel Keys Server on Windows, the license server used with Sentinel Keys software protection. CVE-2026-78403 (CVSS 4.0 9.3 critical) is a stack-based buffer overflow with missing authorization: the server doesn't check the length of the first field in an HTTP request, so an unauthenticated remote attacker can send a crafted request that may lead to code execution as NT AUTHORITY\SYSTEM. CVE-2026-78402 (CVSS 4.0 7.3 high) is a similar unchecked first field in local input messages that allows local privilege escalation to SYSTEM. Both affect versions lower than 1.3.8.0. No exploitation has been reported so far.

Open incident →

CVE-2026-78403 · CVE-2026-78402

Oct 30PatchedLM Studio model downloader path traversal lets a crafted model run code on every launch (CVE-2026-119979), fixed in 0.4.22+1

LM Studio (desktop app, model downloader)

LM Studio, the desktop app for running large language models locally, has a path traversal flaw in its model downloader (CVE-2026-119979, CVSS 4.0 8.7 high). Before 0.4.22+1, resolveDownloadRequest accepted backslash-separated traversal filenames, so a crafted model repository could write files outside the models directory. VulnCheck says an attacker who tricks a user into downloading such a model can plant a plugin manifest.json, install-state.json and mcp-bridge-config.json that run an attacker-supplied Python payload every time LM Studio launches. The bug was credited to Ariel Fogel of Pillar Security and is fixed in LM Studio 0.4.22+1.

Open incident →

CVE-2026-119979

Oct 1PatchedIvanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Ivanti Connect Secure (ICS)

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. The chain's privilege-escalation piece, CVE-2026-111357 (dsinvoked trusting DSCache data, root on 22.8R2.4), was added to CISA KEV on Oct 29. On Oct 29 Ivanti also fixed it and the chain's predictable-filename upload bug (CVE-2026-118527) in 25.1.1.3 and 22.8R2.6, so every exploited flaw in the chain now has a fix; patching does not remove an existing compromise.

Open incident →

CVE-2026-104935 · CVE-2026-111357 · CVE-2026-118527

Oct 27PatchedAvada WordPress theme unauthenticated file upload to RCE via Avada Forms (CVE-2026-115346), fixed in 7.16.4

Avada Website Builder theme for WordPress & WooCommerce (ThemeFusion)

The Avada Website Builder theme for WordPress and WooCommerce (ThemeFusion) lets unauthenticated attackers upload files that may be executable through Avada Forms upload fields, making remote code execution possible (CVE-2026-115346, CVSS 3.1 8.1 high). Wordfence, which reported it, says all versions up to and including 7.16.2 are affected because convert_palette_images_to_truecolor() does not validate file types well enough before processing uploads. Avada fixed the "possible remote code execution vulnerability in Avada Forms upload fields" in Avada Classic 7.16.4 on October 27; the CVE record was published October 30. No exploitation has been reported so far.

Open incident →

CVE-2026-115346

Oct 28PatchedWordPress 7.1.4 security release: upgrade-window RCE under exploitation attempts, plus stored XSS fixes

WordPress core

WordPress released 7.1.4 on Oct 28 2026 as a security release and recommends updating sites immediately. It fixes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram), a long list of stored XSS issues (crafted block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, and specially crafted user logins), a stored denial of service in the Interactivity API, unpublished Customizer changesets being discoverable by unauthenticated users, and Notes being readable by privileged users who can't edit the post. It also updates the bundled root certificates because of the eMudhra revocation. Sites with automatic background updates get it automatically; the fixes are being backported to every branch still eligible for security fixes (back to 4.7), and those backports ship as they become ready. WordPress 7.2 Beta 3 has the same fixes. Wordfence rates the upgrade-window RCE CVSS 8.1 (unauthenticated, high complexity: WordPress 4.7 to 7.1.3 unpack full-package updates into a predictable, web-reachable folder under wp-content/upgrade, and an attacker who requests the staged installer in the seconds-long window can reach PHP code execution). Wordfence says attackers began trying to exploit it within minutes of its firewall rule going live on Oct 28 and logged more than 18,500 requests to staged setup-config.php paths in 21 hours; it reports attempts, not confirmed compromises.

Oct 28PatchedBitcoin Core 29.5, 30.4, 31.2 and 32.1 fix three AI-found bugs, including a remote crash of Windows, macOS and BSD nodes

Bitcoin Core

Bitcoin Core published three advisories on Oct 28 2026 for bugs first found by an automated LLM scan (Elias Rohrer's Project Loupe at Spiral) and validated by Gregory Sanders. The worst, rated Medium: on platforms other than Linux, a malicious peer can send TCP urgent (out-of-band) data to bypass read backpressure and queue unlimited data, which Bitcoin Core says lets it "trivially crash any Windows, macOS or BSD node it is connected to". A second Medium bug lets a peer that claims not to support BIP 31 pings stay paused forever while its message queue grows (up to 2MB per hour per inbound peer, 5MB per hour per outbound peer). A Low-severity undo-file overflow lets a miner corrupt other nodes' undo data, impractical on 64-bit systems. All three are fixed in 29.5, 30.4, 31.2 and 32.1 and were disclosed early under Core's new policy for "easily discoverable" bugs.

Open incident →

CVE-2026-117350

Oct 22PatchedOkta Access Gateway: admin-console command execution and an auth-source bypass to the Admin Console (CVE-2026-115547, CVE-2026-115546)

Okta Access Gateway (on-prem appliance)

Okta fixed two Okta Access Gateway (OAG) bugs on Oct 22. CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the OAG service account through specially formatted configuration values. CVE-2026-115546 (CVSS 8.1) lets any user with a valid session change the authentication-source parameter during sign-on and get a SAML assertion for the Admin Console. Combined, a regular gateway user could potentially reach command execution. Both are fixed in 2026.10.2. OAG also bundles a PHP runtime hit by PHP2Shell, fixed in 2026.44.0 (released Oct 23). Okta's cloud services are not affected.

Open incident →

CVE-2026-115547 · CVE-2026-115546

Oct 28PatchedCisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls

Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD)

Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices.

Oct 28PatchedSophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product

Sophos UTM (SG UTM), all versions, with the email proxy and scanning enabled

Sophos published an advisory on Oct 28 for CVE-2026-118633, a path traversal vulnerability in Sophos UTM that lets an unauthenticated remote attacker execute arbitrary commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It is reachable when the UTM email proxy is used with scanning enabled. All Sophos UTM versions are affected (the CVE record lists SG UTM 9.724 and earlier). Sophos UTM is end-of-life, so the fix is not delivered automatically: Sophos says urgent customer action is required, the patch must be installed manually, and customers still using Email Protection on UTM should apply it as soon as possible or move to a supported version of Sophos Firewall. The issue was reported through the Sophos bug bounty program by Sam Pizzey.

Open incident →

CVE-2026-118633

Oct 28PatchedKeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127

Cisco Catalyst SD-WAN Controller, Manager and Validator

Cisco Talos said on Oct 28 2026 that an APT it tracks as UAT-11473 exploited CVE-2026-20127, the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that Cisco fixed in February, and installed a custom malware framework called KeyDrift. Its PolyFlame module is injected into the controller's vdaemon processes as an in-memory backdoor and relay, and its LittleFilch module hooks SSL_read to pull AES-256 key material for a preset list of edge routers out of decrypted control traffic, staging it encrypted for exfiltration. Talos calls the activity historical, says targets included space and satellite services, defense and aerospace technology and policy research, and assesses with high confidence that the group's infrastructure overlaps with Volt Typhoon's Silent Train covert network. There is no workaround; upgrade to a fixed release and check controllers for compromise.

Oct 29PatchedProgress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4

Progress WS_FTP Server

Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.

Open incident →

CVE-2026-84295 · CVE-2026-90868 · CVE-2026-90865 +12

Jul 29PatchedVMware ESX logging bypass (CVE-2026-41709) added to CISA KEV: admins can act without being logged

VMware ESX / ESXi (also in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform)

CISA added CVE-2026-41709, a VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. Broadcom rates it Low (CVSSv3 2.7): a malicious administrator could perform certain operations on ESX without them being logged, which helps an attacker who already has admin access hide activity. Broadcom fixed it in VMSA-2026-0006, first published July 29 2026, and credits Ian Barton of CrowdStrike for reporting it. CrowdStrike's 2026 Legal Threat Landscape Report (Oct 28) says the China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, while deploying malware in VMware vCenter environments at U.S. entities including legal-sector targets.

May 13PatchedLinux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign

Linux kernel (IPsec ESP-in-TCP receive path, skb_try_coalesce)

CISA added CVE-2026-46300, the Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. The bug is in skb_try_coalesce(), which loses the shared-frag marker when TCP receive coalescing moves paged frags, so IPsec ESP-in-TCP input can decrypt in place over page-cache-backed pages. A low-privileged local user can use it to write bytes into read-only files such as system binaries and gain root. Fragnesia was disclosed on oss-security on May 13 2026 as a Dirty Frag class exploit found by William Bowling with the V12 team, and fixed stable kernels have been out since then. On Oct 27 Dream Research reported a campaign that chained a PHP2Shell exploit with Fragnesia to root 25 servers, including 24 perimeter firewalls.

Oct 28PatchedJuniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406)

Juniper Networks Session Smart Router and Session Smart Conductor

Juniper published an out-of-cycle bulletin (JSA112183) on Oct 28 fixing multiple internally found vulnerabilities in Session Smart Router (SSR) and Session Smart Conductor, its SD-WAN routing platform. Two are rated CVSS 9.8: CVE-2026-103409 lets an unauthenticated network attacker get administrative privileges on a Session Smart Router by passing crafted URL parameters to an insecure endpoint that runs as root, but only before the device is onboarded to Mist or Conductor. CVE-2026-103406 is an OS command injection in Session Smart Conductor's AutomatedProvisioner that lets a remote attacker run commands as root through a crafted salt minion ID. Both affect versions before 7.0.5, 7.1.x before 7.1.7 and 7.2.x before 7.2.3, and are fixed in 7.0.5, 7.1.7 and 7.2.3. Juniper lists no workarounds and says it is not aware of malicious exploitation.

Open incident →

CVE-2026-103409 · CVE-2026-103406

Oct 27PatchedVeeam fixes critical unauthenticated CDP Coordinator bypass in Backup & Replication 13 and a critical SQL injection in Backup for Microsoft 365

Veeam Backup & Replication 13, Veeam Agent for Linux, Veeam Backup for Microsoft 365 and Veeam ONE

On October 27 Veeam published security bulletins for Backup & Replication 13, Backup for Microsoft 365 and Veeam ONE. The worst is CVE-2026-108142 (CVSS 4.0 9.1, critical): an unauthenticated attacker can bypass authorization on the CDP Coordinator Service of Windows-based Backup & Replication servers and the Veeam Software Appliance, on 13.1.1.18 and earlier 13.1 builds and 13.0.2.29 and earlier 13.0 builds (12.x is not affected). The same bulletin fixes two medium path traversal bugs that let a Restore Operator who controls a backed-up NAS share write files anywhere on the backup server (CVE-2026-108140, CVE-2026-108141) and a high-severity local privilege escalation in Veeam Agent for Linux managed by Backup & Replication (CVE-2026-105477). In Veeam Backup for Microsoft 365, an authenticated organization-transfer peer can inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and code execution as the PostgreSQL service account (CVE-2026-106076, 9.0, critical); other fixes cover arbitrary file reads by an Administrator (CVE-2026-106077), an unauthenticated REST API authentication bypass with a forged federation token (CVE-2026-106078) and an installer file-write bug (CVE-2025-64394). Veeam ONE 13.1 Patch 1 fixes an MFA bypass for attackers who already have Administrator credentials (CVE-2026-107671). Veeam's bulletins do not mention exploitation, but Backup & Replication bugs have repeatedly been exploited by ransomware gangs after disclosure. Update Backup & Replication to 13.1.2 (13.1.2.57) or 13.0.3 (13.0.3.63), Agent for Linux to 13.1.2, Backup for Microsoft 365 to 8.6 Patch 1 (8.6.0.5011) and Veeam ONE to 13.1 P1 (13.1.0.7940).

Open incident →

CVE-2026-108142 · CVE-2026-108140 · CVE-2026-108141 +6

Oct 15PatchedAtlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian Multiple Products

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15.

Oct 13PatchedEsri ArcGIS Server: critical SQL injection (CVE-2026-10757), anonymous if a service is public

Esri ArcGIS Server

A SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux lets a remote attacker with access to a service issue database-specific functions that should not be allowed. If the service is configured with public access, that includes anonymous attackers. Esri rates it CVSS 3.1 9.8 and fixed it in the ArcGIS Server Security 2026 Update 3 Patch (released Oct 13) for 12.1, 12.0, 11.5, 11.3 and 11.1; older mature or retired versions get no patch and should upgrade to an LTS release.

Open incident →

CVE-2026-10757 · CVE-2026-33521 · CVE-2026-33522 +3

Sep 27PatchedCitrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772)

Citrix NetScaler ADC and NetScaler Gateway

Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence.

Open incident →

CVE-2026-88771 · CVE-2026-88772 · CVE-2026-88773 +6

Oct 29PatchedTelegram for Android flaw let attackers run code when a victim answered a voice call

Telegram for Android

NebuSec disclosed a flaw in Telegram for Android that let an attacker with an ordinary Telegram account run code on a victim's phone once the victim answered a voice call. The bug was in the code that parses MediaState call messages (mute, camera and video rotation state), which mishandled missing fields and read memory it should not. Versions 8.6.2 through 12.10.3 (March 2022 to September 2026) are affected; Telegram fixed it in 12.10.4, released in late September. NebuSec confirmed it in private calls on ARM64 phones and has no evidence it directly affects the iOS or desktop apps or group calls. There was no CVE identifier as of October 29.

Oct 27PatchedWatchGuard Fireware OS 2026.4 and 12.12.4 fix 17 Firebox flaws, including unauthenticated bugs in the SIP proxy, Access Portal and FireCluster

WatchGuard Fireware OS (Firebox firewalls) and Mobile VPN with SSL client for Windows

On October 27 WatchGuard published 18 advisories: 17 for Fireware OS, the operating system on Firebox firewalls, and one for the Mobile VPN with SSL client for Windows. The worst are a pre-authentication stack buffer overflow in the SIP proxy that lets a remote, unauthenticated attacker run code by sending a crafted request through a policy that uses the SIP proxy (CVE-2026-93857, CVSS 9.2), a pre-authentication integer overflow in Access Portal WebSocket handling that lets an unauthenticated attacker write past a heap buffer when Access Portal is enabled (CVE-2026-93866, 9.2), and a missing-authentication bug in the FireCluster sync daemon that lets an unauthenticated attacker trigger privileged system actions through the FireCluster management IP when clustering is enabled (CVE-2026-93865, 9.2). Other critical bugs need a network position: heap overflows in the Active Directory authentication service reachable by whoever controls or intercepts traffic to the configured AD server (CVE-2026-112709, CVE-2026-112710, 9.2), a stack overflow in the logging service via a crafted certificate from an impersonated log server that gives root (CVE-2026-103593, 9.1), and a stack overflow in WireGuard configuration processing reachable by a man-in-the-middle between the Firebox and WatchGuard Cloud (CVE-2026-103594, 9.5). The rest cover FireCluster privilege escalation and denial of service, an XPath injection in SSH authentication that leaks configuration secrets, an AuthPoint MFA session-hijack bug, root file modification and overwrite, and denial of service in the management interface and certd. WatchGuard says it is not aware of exploitation in the wild for the bugs it lists. Update to Fireware OS 2026.4 or 12.12.4 (12.5.22 on T15 and T35), and Mobile VPN with SSL client to 2026.4.

Open incident →

CVE-2026-93857 · CVE-2026-93866 · CVE-2026-93865 +15

Oct 1PatchedC3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684

Synology DiskStation Manager (DSM)

Since October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.

Open incident →

CVE-2026-13639 · CVE-2026-13684

Oct 22PatchedArista VeloCloud Orchestrator zero-day CVE-2026-114625 exploited in attacks

Arista VeloCloud Orchestrator (VCO) On-Prem

Arista patched an actively exploited critical SQL injection flaw (CVE-2026-114625, CVSS 9.9) in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as the local 'superuser operator'. Hosted VCO is already patched; on-prem admins need to upgrade.

Open incident →

CVE-2026-114625

Sep 30PatchedFortiMail unauthenticated file-write zero-day CVE-2026-104286

Fortinet FortiMail

Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).

Open incident →

CVE-2026-104286

Oct 20PatchedOracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen

Oracle E-Business Suite (Application Object Library)

CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTP through the Thin Client Framework servlet (/OA_HTML/AppsTCFServer). Horizon3.ai, which found it, says it chains to OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update (Oct 20). On Oct 27 Defused said its EBS decoys recorded exploratory exploit attempts. Apply the October CPU patches; until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.

Open incident →

CVE-2026-101767

Oct 16PatchedFortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability

Fortinet Multiple Products

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16.

Oct 27PatchedFirefox 159 and Firefox ESR 153.6 and 115.44 fix 167 bugs, including 13 sandbox escapes

Mozilla Firefox and Firefox ESR

Mozilla's October 27 Firefox release fixes 167 CVEs in Firefox 159 (108 rated high, 52 moderate, 7 low), 145 in Firefox ESR 153.6 and 80 in Firefox ESR 115.44. Thirteen of the Firefox 159 fixes are sandbox escapes (in components such as WebRender, Canvas WebGL, XPCOM, Print Preview and Form Manager), and the rest include many use-after-free and JIT bugs in the JavaScript engine, layout, DOM and WebRTC. The large count comes partly from a change in how Mozilla publishes advisories: it no longer rolls internally found memory-safety bugs into one CVE and now issues one per bug. Mozilla's advisories don't mention exploitation in the wild. Update Firefox to 159, or ESR to 153.6 or 115.44.

Open incident →

CVE-2026-117861 · CVE-2026-117864 · CVE-2026-117868 +10

Oct 22PatchedHPE ArubaOS (AOS-8 / AOS-10): eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws

HPE Networking (Aruba) wireless OS AOS-8 and AOS-10: Mobility Conductors, Controllers, Gateways, Access Points

HPE Networking patched 72 vulnerabilities in its wireless operating systems AOS-8 and AOS-10 (ArubaOS) on Oct 22 2026 (advisory HPESBNW05162). Eight are rated CVSS 10.0: authentication bypasses, command injection, SQL injection and buffer overflows that let an unauthenticated remote attacker run code on Mobility Conductors, Controllers, Gateways and Access Points, several through the web management interface and the PAPI protocol. HPE urges customers to patch quickly and to restrict management interfaces. It knows of no public exploit code or exploitation.

Open incident →

CVE-2026-79844 · CVE-2026-79845 · CVE-2026-79846 +5

Oct 23PatchedMicrosoft Authenticator for Android: any app could impersonate Teams or Outlook and get work-account tokens (AuthMask, CVE-2026-80097)

Microsoft Authenticator for Android

Microsoft Authenticator on Android acts as the sign-in broker for Microsoft apps, and an exported activity in it handed out tokens without checking which app was really asking. A malicious app with zero permissions could claim to be an installed Microsoft app such as Teams and get that app's tokens for the work account signed into Authenticator. Enclave researcher Ofek Levin, who found it, says the tokens gave full delegated mailbox, files and calendar access, and that by posing as Authenticator itself an attacker could change the account's sign-in methods, including adding passkeys that keep access after the app is removed. It needs a malicious app installed on the phone. Microsoft fixed it in September 2026; update Authenticator for Android to 6.2606.4246 or later.

Oct 7PatchedBricksforge WordPress plugin: unauthenticated file upload to RCE exploited in the wild (CVE-2026-85097)

Bricksforge (WordPress plugin)

CVE-2026-85097 (CVSS 10.0) in the Bricksforge plugin for the Bricks builder lets unauthenticated attackers run PHP on a WordPress site. Bricksforge checks an upload's MIME type but trusts the url field in temporaryFileUploads at form submission, so attackers fetch a nonce, upload a GIF/PHP polyglot and have it written to a .php path. Patchstack saw exploitation from Oct 7 from 63 IPs. Versions through 3.1.8.9 are affected; update to 3.1.8.10 or later.

Oct 6PatchedSonicWall SMA1000: max-severity pre-auth SSRF exploited days after the patch (CVE-2026-102255)

SonicWall SMA1000 (6210, 7210, 8200v)

CVE-2026-102255 (CVSS 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface: an unintended alternate access path lets a remote attacker make the appliance send requests to internal functionality and perform unauthorized operations. It affects SMA1000 6210, 7210 and 8200v models (not SMA 100 or firewall SSL-VPN). SonicWall disclosed it on Oct 6; exploitation attempts began Oct 8, and Horizon3.ai warns it can lead to device takeover. Update to 12.4.3-03670 or 12.5.0-03082.

Open incident →

CVE-2026-102255

May 29PatchedPalo Alto Networks PAN-OS GlobalProtect auth bypass (CVE-2026-0257) now used by Qilin and Inc ransomware

Palo Alto Networks PAN-OS

An authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) lets attackers forge an authentication-override cookie and open a VPN session on portals and gateways that accept these cookies with a specific certificate setup. It was patched in May 2026 and added to CISA KEV on May 29. In October Unit 42 said Qilin and Inc ransomware operators are exploiting it on unpatched devices, bypassing MFA to get a VPN foothold and in one case pivoting to vCenter and ESXi to dump domain credentials. Group-IB and NyxLab tied it to the k0t initial-access campaign, which collected over 70,000 firewall and LDAP credentials. Patch, or use a dedicated certificate for authentication override cookies, or disable authentication override.

Oct 22Patchedx402 SDK flaws could let malicious APIs drain AI agents' token balances

x402 SDKs (TypeScript @x402/*, Python x402, Go)

V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later.

Oct 21PatchedHijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones

Apple iOS (Safari/WebKit) on out-of-date iPhones

Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't).

Oct 20PatchedEG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.

Open incident →

CVE-2026-106931

Oct 20PatchedSiemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20.

Open incident →

CVE-2026-110936

Oct 16PatchedPlex2Shell: chained Plex Media Server RCE exploited for miners

Plex Media Server

Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.

Open incident →

CVE-2026-96652 · CVE-2026-96654 · CVE-2026-96655 +1

Oct 14PatchedAhsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability

Ahsay AhsayCBS

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.

Open incident →

CVE-2026-105134 · CVE-2026-105133

Oct 14PatchedCisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco Secure Email Gateway

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.

Oct 14PatchedPalo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability

Palo Alto Networks PAN-OS

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.

Oct 8PatchedPwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)

Linux kernel networking (host side of KVM/Firecracker and similar)

Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.

Oct 4PatchedCitrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Added to CISA KEV on 2026-10-04.

Oct 2PatchedZammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. CISA added CVE-2026-102490, CVE-2026-102489 to the Known Exploited Vulnerabilities catalog on 2026-10-02 based on evidence of active exploitation.

Open incident →

CVE-2026-102490 · CVE-2026-102489