#уязвимости
-
CERT-UA: Attackers Hijack Dahua Cameras in Ukraine via P2P Service and Weak Authentication
Ukraine's computer emergency response team has warned of unauthorized access to Dahua IP cameras and video recorders. The main loophole is the Easy4IP cloud P2P service combined with predictable device serial numbers.
-
Two Critical Wasmtime Flaws Let Malicious WebAssembly Escape the Sandbox
Wasmtime's maintainers disclosed two critical bugs in the Cranelift compiler that let an attacker-controlled WebAssembly module break out of the isolating sandbox. Fixes landed on October 19 and 20.
-
PHP2Shell flaws confirmed exploited in the wild for the first time
Researchers have recorded the first successful remote code execution via PHP2Shell — a pair of critical flaws that PHP developers have already patched. Until now, every exploitation attempt had come up empty.
-
CISA Adds Actively Exploited Flaws in Collabora Online and Arista VeloCloud to KEV
The U.S. cybersecurity agency CISA has added two critical vulnerabilities, both already seen in real-world attacks, to its Known Exploited Vulnerabilities catalog.
-
Millions of PHP2Shell Attack Attempts — Yet Not One Has Worked
Attackers are mass-probing the freshly disclosed PHP2Shell flaws to pull servers into a Mirai botnet, but a reliable working exploit still eludes them.
-
Two CVSS 9.0 KSMBD RCE Flaws Go Public on Mailing Lists Before Any Kernel Fix
KSMBD, the Linux kernel's built-in SMB server, is exposed to two remote-code-execution flaws rated 9.0, with no mainline fix yet — and the reports landed on public mailing lists.
-
Node.js Brotli Decoder Flaw Threatens Remote Code Execution Across All Supported Versions
On October 21 Node.js shipped updates for its three supported release lines, fixing 10 flaws. The most serious is a bug in the bundled Brotli decompression code that the project says could allow remote code execution.
-
Critical GitLab Flaw (CVSS 10.0) Threatens RCE Across 12 Years of Releases
On October 21 GitLab shipped fixes for a flaw that lets an attacker run code on a self-managed server without logging in. The weakness reaches back to version 7.0, released in 2014.
-
CISA Orders Agencies to Patch Exploited Plex, Siemens, and SiteGuard Flaws
The U.S. cybersecurity agency CISA has added the Plex2Shell bug cluster, plus flaws in Siemens Software Center and SiteGuard, to its catalogue of actively exploited vulnerabilities.
-
PHP preps emergency patches after two critical flaws leak early
The PHP security team is urging administrators to brace for urgent updates after details of two critical vulnerabilities leaked ahead of their planned disclosure.
-
Plex2Shell Attacks: Hackers Drop Crypto Miners and a Proxy Backdoor on Plex Servers
Just a day after a proof-of-concept went public, attackers began chaining four Plex Media Server vulnerabilities to achieve remote code execution and plant miners and a reverse proxy.
-
F5 ships out-of-band patches for critical NGINX flaws
F5 has closed several NGINX web server vulnerabilities, including three critical ones that could let attackers run code on affected systems.
-
Critical PwnEscape Flaw in Linux Kernel Lets Guest VMs Read Host Memory
A critical bug in the Linux kernel's networking code lets code inside a virtual machine read the host's memory. The leak was demonstrated against Vercel's live cloud sandboxes.
-
Cisco Patches New Actively Exploited Secure Email Gateway Zero-Day
A flaw in the gateway's malware-protection feature let remote, unauthenticated attackers run commands as root. Cisco says it saw the bug exploited in the wild in October 2026.
-
Researchers Run Their Own Code Inside a Windows SmartScreen Enclave
In a lab, Doyensec broke the isolation of a VBS enclave that stores the password hash for a Windows anti-phishing feature. Microsoft had already patched the flaw in its September update.
-
Microsoft Patches a Record 1,400-Plus Flaws in a Single Month
Microsoft's October update batch eclipses even September's record of nearly a thousand fixes. The company credits large language models for the flood of discoveries.
-
Three webOS flaws chain into local-network root takeover of LG TVs
A chain of three bugs gives an attacker on the same local network root access to certain LG smart TVs with no PIN and no action from the owner. LG has shipped a fix.
-
Freeze the Controller, Defrost the Food: Flaws in Danfoss Refrigeration Controllers
Claroty Team82 researchers found a hidden login mechanism, a command injection, and a way to knock out the web panel in Danfoss AK-SM 800A controllers. Thousands of devices are reachable straight from the internet.
-
GitLab Patches Max-Severity Code Execution Flaw in CI/CD Regex Compiler
An integer overflow bug let an unauthenticated attacker run arbitrary code on a GitLab server through a specially crafted regular expression. The company urges immediate upgrades.
-
Critical SonicWall SMA 1000 Flaw Exploited Days After Patch
CVE-2026-102255, rated a maximum CVSS 10.0, allows pre-authenticated SSRF attacks. Researchers have already logged 135 exploitation attempts.
- More