SecurityTwo critical flaws in PHP itself can allow remote code execution with no login, fixes exist for 8.2 through 8.5, and 8.1 and older no longer get updates from the projectOn October 21 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 against two critical flaws rated CVSS v4.0 9.2, where an unauthenticated request can run code. Cloudflare writes that they are known as PHP2Shell. On October 23 PHP described a third one, which it calls unlikely.SecurityNode.js fixed ten flaws, and one of them, in Brotli decompression, can lead to code executionNode.js's October 21 bulletin covers four High, three Medium and three Low. The only one where the bulletin mentions code execution, CVE-2026-111497, is in the Brotli decoder and affects 26.x, 24.x and 22.x. Fixes are in v22.23.4, v24.22.1 and v26.12.1.SecurityThe keys of eight eMudhra intermediate certificates are compromised, and Firefox blocked them in under three hours, with no browser updateMozilla received a report that the private keys of eight eMudhra intermediate certificates were compromised, and keys like that can be used to issue fake HTTPS certificates. This is not a code bug, it is compromised keys.SecurityBeyondTrust: a zero-day in Remote Support was used on 29 August, the fix is from 8 October, and the vendor suspects an espionage group with links to ChinaOn 15 October BeyondTrust published advisory BT26-05 for CVE-2026-102764, a flaw in Remote Support that under the right conditions allows file operations on the appliance. According to the company it was used on 29 August against two customers, and the vendor warns that after disclosure the group typically moves to broad exploitation of every unpatched instance.SecurityCisco's email gateway gives root with one message again, this time through an attachment, and PAN-OS entered the exploited-vulnerabilities catalog the same dayOn 14 October Cisco disclosed CVE-2026-76519: on a Secure Email Gateway with File Reputation enabled, an email with a crafted attachment writes files and runs commands with root privileges, no login needed. Cisco says the flaw is already being exploited. The same day CISA also added CVE-2026-0322 in PAN-OS, which needs a logged-in attacker with high privileges.SecurityIvanti patched part of the hole in July, but only for its new platform, and Connect Secure and Windows Shell have joined the exploited-vulnerabilities catalogOn 13 October Ivanti published an advisory for CVE-2026-104935: an authentication bypass in Connect Secure that allows remote command execution without logging in. Ivanti says part of the flaw was patched back in July, but only in version 25.1.3.0. The same day CISA also added a Windows Shell flaw to its catalog of exploited vulnerabilities, with a deadline of 16 October for US federal civilian agencies.SecurityNew critical NetScaler hole with SAML, CVE-2026-107406: the fix is 14.1-73.46 or 13.1-64.29Citrix issued bulletin CTX697191 on 8 October: a memory overflow rated 9.5 that leads to code execution or denial of service. NetScaler configured as a SAML SP or IdP is affected, and for IdP the versions from the last two upgrades are on the list too. The bulletin does not mention exploitation.SecurityCISA, FBI and NSA warn about China-based Integrity Tech, and five old holes from the advisory entered the KEV catalog with an 11 October deadlineAdvisory AA26-281A of 8 October describes how the company supplies tools and infrastructure to threat actors whose techniques CISA calls consistent with Flax Typhoon. The same day KEV received five holes from its list, the newest numbered from 2023.
83 stories