News about newly discovered vulnerabilities, actively exploited flaws, zero-day vulnerabilities, CVEs, patches, and security advisories.
News Vulnerabilities & Zero-Days
The PHP security team will release fixes for two critical vulnerabilities rated CVSS 9.2 on 21 October 2026 at 14:00 UTC. CERT-EU says they could allow remote code execution. PHP powers 69.3% of websites whose server-side language is known, so teams should prepare to patch now.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
BeyondTrust has patched CVE-2026-102764, a critical flaw in Remote Support that Google's Mandiant says a suspected China-nexus espionage group it calls ARMORY CASTLE exploited as a zero-day from late August 2026. Self-hosted appliances need to be patched manually.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Security firm XBOW says AI agents running OpenAI's publicly available GPT-5.6 Sol model helped its researchers build a three-bug Chrome exploit chain in six days, earning a $250,000 Google bounty. All three bugs are now fixed.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management interface flaw that lets an authenticated attacker run code as root, after observing very limited exploitation. CISA gave US federal agencies until 17 October 2026 to fix it.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote code execution flaws, one in use cache functions and one in SVG image optimization, plus a high-severity denial of service in Server Actions. There is no workaround for two of the three.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Drupal released fixes on 14 October 2026 for CVE-2026-108097, a critical remote code execution flaw in core's Field UI module. Core alone does not expose it, but at least one known exploit path through a contributed module requires no authentication.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
NGINX released 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, including heap overflows and a use-after-free that F5 says could allow code execution under specific configurations, and a TLS flaw that may skip client certificate checks.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Microsoft's October 2026 updates fix more than 1,400 vulnerabilities, a record, including CVE-2026-96951, a Windows Shell flaw exploited in the wild that bypasses Mark of the Web protections. CISA gave US federal agencies until 16 October to patch it.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Ivanti patched CVE-2026-104935 in Connect Secure on 13 October 2026 after limited exploitation in the wild, and CISA gave US federal agencies until 16 October to fix it. Volexity says an attacker chained it with a third, still unpatched flaw to run commands as root.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Cisco says attackers are exploiting CVE-2026-76519, a 9.8-rated flaw that lets an unauthenticated sender write files to a Secure Email Gateway with a crafted attachment, which can lead to commands running as root. There is no workaround.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
curl 8.23.0, released on 14 October 2026, fixes CVE-2026-92392, a use-after-free in HTTP/2 uploads that affects curl and libcurl 8.12.0 through 8.22.0. A malicious server can trigger it, and the advisory shows it can be turned into code execution under narrow conditions.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Docker fixed CVE-2026-105445, a critical Docker Hub flaw that let a user push, pull or delete images as another user by abusing account-to-organization conversion. Docker says it found no evidence of exploitation and has deactivated the affected tokens.
Jaydeep Bhatt