The PHP security team announced it will ship fixes on Wednesday, October 21 at 14:00 UTC for two vulnerabilities each rated 9.2 on CVSS v4.0, after details reportedly leaked ahead of a planned embargoed disclosure. Researchers at watchTowr say the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs affecting PHP versions 5 through 8, and that watchTowr has reproduced one of them without releasing technical details.
bleepingcomputer.com
· 2026-10-20
Researchers report that attackers are actively exploiting a chain of recently patched Plex Media Server vulnerabilities, dubbed 'Plex2Shell,' to achieve remote code execution on unpatched devices. A honeypot set up to monitor the activity recorded scanning within a day and subsequent successful infections that install cryptomining software and residential proxy applications.
arstechnica.com
· 2026-10-19
F5 released out-of-band security updates fixing multiple NGINX vulnerabilities, including three critical-severity bugs in the ngx_http_v3_module and the map directive. The flaws allow unauthenticated remote attackers to trigger heap overflows or use-after-free conditions in NGINX worker processes, potentially causing crashes or code execution on non-default configurations. Affected products include NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric, and Instance Manager.
bleepingcomputer.com
· 2026-10-19
Security researchers and Japan's JPCERT/CC report that attackers are actively exploiting CVE-2026-106931, a critical OS command-injection bug in the statistics feature of SiteGuard Server Edition, a web application firewall used on roughly 500,000 to 1.5 million sites. The flaw lets attackers run commands with root or SYSTEM privileges on hosts where the default-enabled statistics function is active, and the vendor has released patches for multiple affected versions, including some end-of-life builds.
bleepingcomputer.com
· 2026-10-18
Drupal has released fixes for two critical remote-code-execution vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, affecting all currently supported versions of the CMS. The project's security team urged administrators to update before October 14, warning that attackers could build exploits within hours or days of disclosure. Exploitation of either flaw generally requires interaction with contributed modules or custom code rather than core alone.
bleepingcomputer.com
· 2026-10-17
BeyondTrust disclosed that the China-linked group Mandiant tracks as Armory Castle exploited a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support appliances starting August 29, 2026. The flaw, rated 9.3 CVSS, stemmed from an internal messaging component failing to validate message origin, letting attackers deploy a custom PHP webshell called SAWFLY within 11 minutes of exploitation.
darkreading.com
· 2026-10-16
Sansec has disclosed CVE-2026-103849, dubbed BlockStrap, a maximum-severity vulnerability in Adobe Commerce, Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3 that could let attackers execute arbitrary PHP code via a second-pass injection in the email template engine. No active exploitation has been observed yet, but Sansec says it found four potential attack paths within a day of analysis and is urging merchants to apply Adobe's October patch or isolated fix rather than relying on a standard Composer install.
bleepingcomputer.com
· 2026-10-16
BeyondTrust has issued a patch for CVE-2026-102764, an authentication bypass flaw in its Remote Support software that attackers exploited since late August to run unauthorized file operations on unpatched appliances. SaaS customers were automatically patched on October 8, while self-hosted users must update manually. Mandiant and GTIG attribute the attacks to a suspected China-nexus group called Armory Castle (also tracked as Warp Panda by CrowdStrike), which used the bug to gain root access, deploy web shells and tunneling malware, and move laterally across victim networks.
bleepingcomputer.com
· 2026-10-16
Hackers have been exploiting a critical command injection vulnerability in Nextcloud's built-in Collabora Online CODE server app since at least September 10, weeks before the issue received a formal advisory and CVE number. The flaw lets unauthenticated attackers send a crafted request to the app's proxy.php endpoint and run system commands when the bundled CODE server is down, such as after a restart or crash, allowing them to plant PHP webshells and hunt for passwords and crypto wallets.
bleepingcomputer.com
· 2026-10-15
Empirical Security founder Jay Jacobs described how one organization's vulnerability management system collapsed after September's Patch Tuesday, unable to handle the volume despite fewer than 1,000 CVEs spread across tens of millions of vulnerable assets. Industry voices say record-breaking Patch Tuesdays, emergency fixes, and AI-driven vulnerability discovery are pushing security teams toward prioritization frameworks like CISA's Known Exploited Vulnerabilities list and VulnCheck's KEV catalog rather than raw vulnerability scores.
darkreading.com
· 2026-10-15
Acros Security's 0patch service released micropatches fixing CVE-2026-62878, a remote code execution vulnerability in the Windows DNS Server service, for Windows Server versions that no longer receive official Microsoft updates. Microsoft had already patched the flaw in supported editions in August 2026 by capping DNS query recursion nesting depth at 62, and 0patch used a public proof-of-concept exploit credited to researchers Nicolas Alejandro Malizia and Joaquín Grassi to build equivalent fixes for legacy systems.
techspot.com
· 2026-10-15
A high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS, tracked as CVE-2026-104935, was only partially fixed when Ivanti issued a patch in July. Threat actors have since exploited the remaining gap, according to reports, allowing attacks to continue despite the earlier remediation attempt.
darkreading.com
· 2026-10-14
GoKawiil