#cve
-
Attackers scan for unpatched Oracle E-Business Suite systems with critical flaw
A week after Oracle shipped a fix for the critical CVE-2026-101767 vulnerability in E-Business Suite, the first scanning and exploratory exploitation attempts have been observed.
-
Two Critical Wasmtime Flaws Let Malicious WebAssembly Escape the Sandbox
Wasmtime's maintainers disclosed two critical bugs in the Cranelift compiler that let an attacker-controlled WebAssembly module break out of the isolating sandbox. Fixes landed on October 19 and 20.
-
PHP2Shell flaws confirmed exploited in the wild for the first time
Researchers have recorded the first successful remote code execution via PHP2Shell — a pair of critical flaws that PHP developers have already patched. Until now, every exploitation attempt had come up empty.
-
Researchers remotely neutralize abandoned Popcorn Time client
A Popcorn Time fork called Time4Popcorn left millions of computers open to remote code execution for years. Eye Security exploited the very same flaw to shut down its dangerous updater.
-
Critical Pillow Flaw Turns a Filename Into Command Execution
Python's most popular image library could be made to run commands on a server simply by the name given to an EPS file it was asked to open. The fix landed in version 13.0.0.
-
Node2Shell: Crafted Brotli Data Runs Attacker Code on an Official Node.js Build
Imperva researchers showed that an application on an official Node.js build can be made to run attacker-supplied code by feeding it a crafted Brotli stream (CVE-2026-111497). Node.js shipped fixes on October 21.
-
Linux Kernel Vulnerabilities Accidentally Dumped Onto Public LKML
Zero Day Initiative researchers mistakenly sent reports on several unpatched kernel flaws to the public mailing list instead of the private security one. Some of the bugs carry a CVSS score of 9.0.
-
That PHP Vulnerability Has No Easy Exploit
A new PHP bug sparked panic, but the author argues the thousands of GitHub "PoCs" don't work against a plain server. The culprit: blind faith in large language models.
-
Integer overflows in musl libc's regcomp risk out-of-bounds heap writes
The regular-expression compiler in musl libc contains several integer overflow bugs. Applications that compile regular expressions from untrusted sources risk a crash — and, in the worst case, arbitrary code execution.
-
PHP Rushes Out-of-Cycle Fix for Two Critical RCE Flaws
PHP's security team scheduled an emergency release for October 21 for two critical vulnerabilities rated 9.2 on CVSS v4.0. watchTowr researchers say both allow remote code execution, but no details have been published yet.
-
Hackers exploit SiteGuard WAF flaw to run commands as root and SYSTEM
A critical OS command injection flaw has been found in the statistics feature of the SiteGuard Server Edition firewall. Attacks are already underway.
-
Critical PwnEscape Flaw in Linux Kernel Lets Guest VMs Read Host Memory
A critical bug in the Linux kernel's networking code lets code inside a virtual machine read the host's memory. The leak was demonstrated against Vercel's live cloud sandboxes.
-
Seven stable kernels patch a critical flaw in the Linux network stack
Greg Kroah-Hartman has released stable kernel updates across seven branches at once. Among the fixes is a critical vulnerability in skb_checksum_help() tied to how IPv4 checksums are handled.
-
NGINX Patches Five Bugs, Including Possible RCE and a TLS Flaw That Can Skip Client-Cert Checks
On October 14, NGINX shipped versions 1.30.6 and 1.31.7 fixing five vulnerabilities — one of them present in every release since May 2005.
-
Critical flaw in Collabora's Built-in CODE plants web shells on Nextcloud servers
Attackers used an optional Nextcloud app, Collabora Online — Built-in CODE Server, to drop web shells. Disabling the app does not help — it must be updated or removed.
-
Vghost: Linux kernel bug hands local users root and lets a guest break out to the host
A flaw in the vhost subsystem let a local user read and write kernel memory and become root for almost nine years, and in one virtualization setup let an untrusted VM break out to the host. The bug was found by Tencent's AI pipeline.
-
Ivanti warns of actively exploited Connect Secure zero-day
Ivanti is urging customers to patch immediately: an actively exploited flaw in its Connect Secure remote access gateway lets attackers bypass authentication and run commands on affected appliances.
-
Two Critical MarkLogic Flaws Let Delegated Managers Seize Admin Control
Progress Software has disclosed 31 flaws in its MarkLogic Server database: an account with only limited management rights could gain persistent administrator control. Fixes have been available since September 10.
-
Freeze the Controller, Defrost the Food: Flaws in Danfoss Refrigeration Controllers
Claroty Team82 researchers found a hidden login mechanism, a command injection, and a way to knock out the web panel in Danfoss AK-SM 800A controllers. Thousands of devices are reachable straight from the internet.
-
Cyberattack defrosts refrigerators at French supermarkets
Overnight on Sunday, attackers remotely raised the temperature in refrigerated displays at hundreds of French supermarkets by hijacking Danfoss controllers. The country's largest retail chains were hit.
- More