Tag
News and blog posts tagged Security Update on AppSecNews.
News Vulnerabilities & Zero-Days
The PHP security team will release fixes for two critical vulnerabilities rated CVSS 9.2 on 21 October 2026 at 14:00 UTC. CERT-EU says they could allow remote code execution. PHP powers 69.3% of websites whose server-side language is known, so teams should prepare to patch now.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
BeyondTrust has patched CVE-2026-102764, a critical flaw in Remote Support that Google's Mandiant says a suspected China-nexus espionage group it calls ARMORY CASTLE exploited as a zero-day from late August 2026. Self-hosted appliances need to be patched manually.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Security firm XBOW says AI agents running OpenAI's publicly available GPT-5.6 Sol model helped its researchers build a three-bug Chrome exploit chain in six days, earning a $250,000 Google bounty. All three bugs are now fixed.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote code execution flaws, one in use cache functions and one in SVG image optimization, plus a high-severity denial of service in Server Actions. There is no workaround for two of the three.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Drupal released fixes on 14 October 2026 for CVE-2026-108097, a critical remote code execution flaw in core's Field UI module. Core alone does not expose it, but at least one known exploit path through a contributed module requires no authentication.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
NGINX released 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, including heap overflows and a use-after-free that F5 says could allow code execution under specific configurations, and a TLS flaw that may skip client certificate checks.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Microsoft's October 2026 updates fix more than 1,400 vulnerabilities, a record, including CVE-2026-96951, a Windows Shell flaw exploited in the wild that bypasses Mark of the Web protections. CISA gave US federal agencies until 16 October to patch it.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
curl 8.23.0, released on 14 October 2026, fixes CVE-2026-92392, a use-after-free in HTTP/2 uploads that affects curl and libcurl 8.12.0 through 8.22.0. A malicious server can trigger it, and the advisory shows it can be turned into code execution under narrow conditions.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
From 13 October 2026, Microsoft stops new security updates for Office 2021, Office LTSC 2021, Windows 11 Home and Pro version 24H2, and Year 3 of Extended Security Updates for Windows Server 2012 and 2012 R2.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Citrix has released emergency security updates for a high-severity NetScaler vulnerability, CVE-2026-88779, after confirming that attackers are exploiting the flaw in targeted attacks. The vulnerability can cause denial-of-service on affected NetScaler deployments using SAML authentication.
Jaydeep Bhatt