A memory-corruption vulnerability, CVE-2026-97631, rated 9.5 out of 10 in severity, has been found in the TianoCore EDK II codebase that underpins UEFI firmware used by nearly all major hardware vendors including AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu fork. The flaw lies in an ICMP component and lets attackers run malicious code before Secure Boot and other defenses load, though the payload itself does not persist across reboots. A planned coordinated disclosure for January was disrupted when AMI published a pull request detailing the bug and its fix last month, prompting TianoCore to issue a public advisory last week.
wired.com
· 2026-10-28
Security firm Defused says it detected threat actors scanning for systems vulnerable to CVE-2026-101767, an unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that can lead to remote code execution. Oracle patched the issue in its October 20 Critical Patch Update, and Shadowserver currently tracks over 670 internet-exposed EBS instances, mostly in the US.
bleepingcomputer.com
· 2026-10-28
CISA confirmed attackers are actively exploiting a critical vulnerability in Google's Brotli compression library, dubbed Node2Shell, that can let unauthenticated attackers crash systems, leak memory, or run arbitrary code. The agency added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 10 under Binding Operational Directive 26-04. Microsoft separately issued an emergency .NET update days earlier addressing related privilege-escalation risk from the same flaw.
bleepingcomputer.com
· 2026-10-28
Researchers from Anthropic and Google found a memory-corruption vulnerability (CVE-2026-97631) in an ICMP component of TianoCore EDK II, the open-source codebase underlying UEFI firmware used by nearly all major hardware vendors including AMI, Insyde and Phoenix. The flaw allows code execution before the OS or protections like Secure Boot load, though the payloads it delivers aren't persistent on their own. A coordinated disclosure planned for January was disrupted after AMI published a pull request with details and a fix, prompting TianoCore to issue a public advisory early.
it.slashdot.org
· 2026-10-27
Researchers Alex Matrosov and Dan Holmes discovered a memory-corruption flaw, rated 9.5 out of 10 in severity, in an ICMP component of TianoCore EDK II, the open-source reference code underlying UEFI firmware used by most hardware vendors including AMI, Insyde, and Phoenix. The flaw allows code execution before the operating system or protections like Secure Boot can engage, and although the initial exploit payload doesn't persist, it could be used to install other malware that runs at every boot. A planned coordinated disclosure for January was disrupted after AMI published a pull request detailing the bug and fix last month, prompting TianoCore to issue a public advisory early.
arstechnica.com
· 2026-10-27
Security firm Sansec says a Brazilian credit-card skimming group compromised a shared Plausible analytics tracker hosted on e-commerce platform Convertr's infrastructure, injecting malicious code that loads on checkout pages across the dozens of fashion merchants it serves. The skimmer, identified on October 24 and refined by October 26 to match Convertr's specific payment API fields, was designed to capture card numbers, expiration dates, CVVs, cardholder names and CPF tax IDs.
bleepingcomputer.com
· 2026-10-27
Wiz Research is monitoring activity related to two PHP vulnerabilities disclosed on October 21, 2026, dubbed PHP2Shell. The firm says it has seen only limited exploitation attempts in its telemetry and no public proof-of-concept for complete end-to-end attacks, though some partners have privately shared working exploits. Wiz reports internet-exposed vulnerable machines dropped about 67% in days following disclosure, and affected organizations fell roughly 47.9%.
wiz.io
· 2026-10-27
Apple has backported a security patch for CVE-2026-86950, a CoreGraphics out-of-bounds write flaw, to older devices including the iPhone XS, XR, and several iPad models. The vulnerability, originally patched last month for newer iOS, iPadOS and macOS versions, was discovered by Meta Product Security and has reportedly been exploited in a highly targeted attack against specific individuals on iOS versions before iOS 27.
bleepingcomputer.com
· 2026-10-27
Security researchers confirmed successful exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), just days after patches shipped and earlier exploitation attempts had failed. Adel Karimi of Perplexity reported honeypot evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26, including an 800 KiB decoded cookie dump and a function address matching a public exploit's offsets appearing in the execution payload. Expel researcher Marcus Hutchins corroborated the finding, calling it the highest-quality confirmation of in-the-wild exploitation seen so far.
yro.slashdot.org
· 2026-10-26
A critical buffer overflow in the Brotli compression library, affecting versions 1.0.3-1.0.9, 1.1.0 and 1.2.0, can let attackers craft malicious compressed streams that corrupt memory on vulnerable decoders. The bug, nicknamed HTTP2Shell, Broccoli2Shell or Node2Shell, originated in Node.js but also touches Python libraries like urllib3, requests, httpx and aiohttp, prompting Microsoft to ship an emergency .NET update on Sunday.
bleepingcomputer.com
· 2026-10-26
Microsoft has shipped emergency security updates for .NET 8, 9, and 10, plus .NET 11 Release Candidate 3, to fix a critical vulnerability dubbed Broccoli2Shell (CVE-2026-111497). Discovered by Imperva's Red Team, the bug is an out-of-bounds write in the Brotli decompression library that can let attackers crash apps, leak memory, or in some cases execute code remotely via crafted Brotli-compressed data.
bleepingcomputer.com
· 2026-10-26
A hacker breached an intentionally vulnerable server running unpatched PHP software, claiming a Bitcoin bounty posted on the Steal My Bitcoin website. The prize, initially worth around $502, grew through donations to 0.02511679 BTC ($2,021.22) before being claimed at 15:47 UTC on October 25, about 19.28 hours after the challenge began. The creator, 'cloudlandsdev', set up the test to see if the recently disclosed CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities, patched on October 21, could actually be exploited in practice.
tomshardware.com
· 2026-10-26
GoKawiil