Tag
News and blog posts tagged Open Source Security on AppSecNews.
News Vulnerabilities & Zero-Days
The PHP security team will release fixes for two critical vulnerabilities rated CVSS 9.2 on 21 October 2026 at 14:00 UTC. CERT-EU says they could allow remote code execution. PHP powers 69.3% of websites whose server-side language is known, so teams should prepare to patch now.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote code execution flaws, one in use cache functions and one in SVG image optimization, plus a high-severity denial of service in Server Actions. There is no workaround for two of the three.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Drupal released fixes on 14 October 2026 for CVE-2026-108097, a critical remote code execution flaw in core's Field UI module. Core alone does not expose it, but at least one known exploit path through a contributed module requires no authentication.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
NGINX released 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, including heap overflows and a use-after-free that F5 says could allow code execution under specific configurations, and a TLS flaw that may skip client certificate checks.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
curl 8.23.0, released on 14 October 2026, fixes CVE-2026-92392, a use-after-free in HTTP/2 uploads that affects curl and libcurl 8.12.0 through 8.22.0. A malicious server can trigger it, and the advisory shows it can be turned into code execution under narrow conditions.
Jaydeep Bhatt