A use-after-free bug in Linux's IPv4 TCP handshake, present since kernel 4.4, has been patched upstream with fixed releases spanning 5.10 through 7.3, but Ubuntu and RHEL have not yet shipped fixes as of October 31. Anthropic says its Claude model produced a working proof-of-concept that gains root access with no credentials on servers running multipath TCP listeners, and Go's security team notes Go programs enable such listeners by default.
atlasum.net
· 2026-10-31
Security researcher Mark Blah released a working exploit for a zero-click Android vulnerability that lets attackers crash phones or disrupt cellular service by sending a single malformed eight-byte WAP Push message over SMS. The bug stems from unchecked header-length parsing in Android's WapPushOverSms.decodeWapPdu function, which triggers a crash in the com.android.phone process and can drop active calls, including emergency calls. Google patched the issue for Android 14 through 17 in its October 2026 update, though it wasn't listed in the public bulletin, leaving Android 12 and 13 devices unprotected.
bleepingcomputer.com
· 2026-10-31
Apple's iOS 27.2 update, released this week alongside more than 160 vulnerability fixes, addresses a flaw tracked as CVE-2026-86990 in the CoreMedia framework. The bug, credited to researcher Mustafa Calap, could allow an app to access the camera without triggering the usual permission prompt, though Apple's notes only describe it as improved access restrictions. The issue is software-based and does not involve the camera's hardware LED indicator, which remains tied directly to the camera module.
9to5mac.com
· 2026-10-30
Anthropic security researchers created a working exploit for CVE-2026-98432, a use-after-free bug in the Linux kernel's IPv4 TCP code rated 9.8/10 in severity. The flaw lets unauthenticated attackers achieve remote root code execution on servers running Multipath TCP listeners, and it also affects ordinary TCP connections across kernels back to version 4.4, including Ubuntu, RHEL and Rocky Linux, though RCE on non-MPTCP servers hasn't been publicly shown.
bleepingcomputer.com
· 2026-10-30
Netgear has issued a security advisory for CVE-2026-11732, a vulnerability that lets an attacker already on a user's network run unauthorized commands on certain routers if the Block Sites feature is enabled. Affected models include the CAX30, RAX30, RAX5, and RAXE300, and Netgear has released firmware updates for all supported devices. One model, the RAX5, has reached end of support and will not receive further patches.
zdnet.com
· 2026-10-30
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
bleepingcomputer.com
· 2026-10-30
Drupal issued a highly critical advisory for CVE-2026-118539, a missing-authorization bug in its Commerce Core module that lets unauthenticated attackers bypass access controls. The flaw affects Commerce Core versions 0.0.0-2.41 and 3.0.0-3.3.13, and Drupal says it is already being exploited. Admins are urged to update to 3.3.13 or 8.x-2.41 and review order records for signs of tampering.
bleepingcomputer.com
· 2026-10-30
A use-after-free bug has been identified in the Linux kernel's IPv4 TCP handshake code, where a race condition between processors can leave a stale pointer to a freed IP options object. The CVE record rates it 9.8 on CVSS 3.1 as a worst-case network-reachable flaw, while Red Hat scores it 5.9 for its supported products, and Anthropic's Frontier Red Team separately demonstrated a working remote root exploit in a lab setup using a Multipath TCP listener.
penligent.ai
· 2026-10-30
Cisco Talos researchers identified a new threat group, UAT-11473, exploiting a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers and Managers, patched in February 2026, to install a custom malware framework called KeyDrift. The attacks targeted space and satellite services, defense and aerospace firms, and policy research organizations, aiming to steal encryption keys and control-plane traffic. KeyDrift comprises two components, PolyFlame and LittleFilch, which Talos says are under active development with new evasion techniques.
bleepingcomputer.com
· 2026-10-29
A Reddit user running a Synology DS918+ NAS had files encrypted by ransomware after leaving the device's web interface exposed directly to the internet and roughly 18 months behind on security patches. Forensic analysis of logs and system files, after moving the drives to a Proxmox machine, pointed to exploitation of CVE-2024-10441, a remote code execution vulnerability Synology disclosed a year and a half earlier. The user avoided data loss thanks to a 3-2-1 backup setup.
tomshardware.com
· 2026-10-29
Cisco has issued security updates for CVE-2026-76418, a high-severity flaw in ASA and FTD software that lets unauthenticated attackers remotely crash firewalls configured with webvpn and SSL VPN enabled. Cisco's PSIRT confirmed active exploitation in October 2026 but has not disclosed indicators of compromise or details on targeted organizations or attackers. Admins unable to patch immediately can mitigate by disabling secondary authentication on affected tunnel groups.
bleepingcomputer.com
· 2026-10-29
Alpine Linux said an attacker tried to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) against its gitlab.alpinelinux.org instance on October 20-21, a week after a fix was released but before the instance was patched. The attempts crashed worker processes eight times and came close to succeeding, though the team found no confirmed evidence of a successful breach. As a precaution, the instance was rebuilt from scratch, all user passwords were reset, and the service is being tested before reopening to the public.
alpinelinux.org
· 2026-10-28
GoKawiil