Practical articles on AI, online safety, and security (88 articles)
CISA added this flaw to the KEV catalog on August 24, 2026 with a remediation deadline of August 27. Exploitable over the network without authentication and scored 10.0 under CVSS 3.1, here are the affected versions, the patch to apply, and Oracle's own stance on workarounds.
A critical flaw in self-managed GitLab, CVE-2026-97229, was added to CISA's Known Exploited Vulnerabilities catalog on October 29. A second flaw of the same kind, CVE-2026-110264, was fixed on October 21, so the October 12 release is not enough. Which versions to update to, and what to check.
The Linux kernel flaw "Fragnesia" (CVE-2026-46300), which lets a local user gain root, was added to CISA's Known Exploited Vulnerabilities catalog on October 28. Affected kernels, fixed versions, and the vendor mitigations with their side effects.
CISA added two critical PHP remote code execution flaws (CVSS v4.0 9.2) to its Known Exploited Vulnerabilities catalog on 26 October 2026. What changed, attempts that began before disclosure (AWS), public exploit code, and what to check after updating.
Identify the PHP runtime serving your site, distinguish CLI from Web PHP, and match your hosting service, server package or container to its provider's security guidance. A version number alone is not proof of a fix.
The Nextcloud document-editing app "Collabora Online - Built-in CODE Server" (richdocumentscode) has an unauthenticated OS command injection (CVE-2026-110447). Exploitation has been reported since September 2026 and CISA added it to KEV on 23 October. Disabling the app does not help; update to 26.4.303 or later, or remove it. CVSS v4.0 is 9.2.
The week of 19-23 October brought two unauthenticated PHP RCE fixes, a one-time update of certificate stores after eMudhra's intermediate CA keys were found forgeable (Chrome, Firefox, Go, Node.js and more), ten Node.js fixes, 353 fixes in Chrome 156 and Oracle's Java patch update. Here are the fixed versions, whether exploitation is reported, priorities and a checklist, from the official announcements.
PHP has fixed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) that can allow unauthenticated remote code execution. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP rates Apache mod_php at highest risk and urges immediate updating. Here are the partial mitigations if you cannot update, how 8.1 and older are treated, and what is unconfirmed.
On 20 October the PHP security team gave advance notice of a security release at 14:00 UTC on 21 October (23:00 JST) fixing two critical vulnerabilities, both CVSS v4.0 9.2. CVE IDs, affected versions and fixed versions will be published with the release. This is a bulletin from before the release and lists what to check now.
The statistics feature of SiteGuard Server Edition, a Japanese host-based WAF, has a flaw (CVE-2026-106931) that lets an attacker run arbitrary OS commands as root or SYSTEM. The vendor confirmed exploitation on 14 October and CISA added it to KEV on 20 October. Updating can erase traces of an attack, so save the diagnostic information first. CVSS v4.0 is 8.5.
The CLI of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager has a flaw (CVE-2025-61624) that lets an admin write or delete arbitrary files. Fortinet published it on 14 April, and CISA added it to KEV on 16 October on evidence of exploitation. On 14 October Unit 42 reported an intrusion where it was used to gain root and plant the memory-resident malware PEERSTITCH. FortiOS 7.6 needs 7.6.5 or later and 7.4 needs 7.4.10 or later. CVSS v3.1 is 6.5 (MEDIUM).
BeyondTrust Remote Support has a flaw (CVE-2026-102764) that lets an attacker perform file operations on the appliance without authenticating. All versions up to 26.2.3 are affected, Mandiant reports it has been exploited since late August, and CISA added it to KEV on 16 October. Self-hosted appliances need the BT26-05-RS patch and a check for signs of compromise. CVSS v4.0 is 9.3.
PAN-OS, the operating system of Palo Alto Networks firewalls (PA-Series, VM-Series) and Panorama, has a flaw (CVE-2026-0322) that lets an authenticated attacker run arbitrary code as root through the management interface. The vendor reports very limited exploitation and CISA added it to KEV. There is no workaround: update to a fixed version and restrict management access. CVSS v4.0 is 8.6.
Cisco Secure Email Gateway has a flaw (CVE-2026-76519) that can let an unauthenticated attacker run commands as root by sending an email with a crafted attachment through the device. Cisco says it became aware of active exploitation in October 2026, and CISA added it to KEV on 14 October. There is no workaround: update Content Scanner Tools or move to a fixed release. CVSS v3.1 is 9.8 (rated by Cisco).
Microsoft fixed Windows Shell vulnerability CVE-2026-96951 in its 13 October 2026 monthly update. It can let an attacker evade Mark of the Web (MOTW) defenses, the marker on files that came from the internet. Microsoft says it is being exploited and CISA added it to KEV the same day. CVSS v3.1 is 8.8 (Microsoft's rating). Update through Windows Update, and confirm with the sender before opening files that arrive by email or chat.
Apache HTTP Server 2.4.69 came out on 1 October 2026 and fixes 20 vulnerabilities. CISA's CVSS in NVD is 9.8 for three of them (CVE-2026-57941, 56154, 59797), but the Apache security team rates the 20 as 5 "moderate" and 15 "low", and none is in CISA's KEV catalog. If you run 2.4.68 or earlier, update to 2.4.69; if Apache comes from your OS, check your distribution's fix status, not the version number.
Six Apart's CMS Movable Type has an unauthenticated remote-code-execution and SQL-execution flaw (CVE-2026-96408) and a site-search SQL injection (CVE-2026-103668), published on 7 October. JPCERT/CC rates the first CVSS v4.0 9.3 (CRITICAL) and fixed versions are out. Neither is in CISA's KEV catalog, and the official advisories do not report confirmed exploitation. Update, or apply the official mitigation that blocks mt-upgrade.cgi, mt-search.cgi and mt-ftsearch.cgi.
On 8 October 2026 CISA added five vulnerabilities published between 2015 and 2023 (ProFTPD, Apache Struts, ISC BIND, Strapi and ONLYOFFICE Docs) to its Known Exploited Vulnerabilities catalog. Fixes have existed for years, so this is not about a new hole but about old versions still running. Inventory your servers for these products and update to the fixed versions.
An unauthenticated file-access flaw (CVE-2026-21589) in Atlassian Data Center products such as Confluence, Jira and Bitbucket was published on 5 October. Atlassian rates it CVSS v4.0 9.3 (CRITICAL) and fixed versions are out. The advisory does not report exploitation. Update, or if you cannot yet, apply the official WAF or server-side mitigation that blocks URLs containing "..".
Two flaws in the open-source helpdesk Zammad (CVE-2026-102489 and CVE-2026-102490) were added to CISA's KEV catalog on 2 October as a chain used in a real intrusion. The root escalation CVE-2026-102490 was fixed in Zammad 7.2.2 on 8 October (no fix existed when this article was first published on 6 October). It affects DEB/RPM packages (packager.io) up to 7.2.1; Zammad's GitHub advisory says installs from source and the official container images are not affected. Zammad says 7.0 and later are not practically affected by the RCE and that the escalation cannot be exploited remotely on its own. Update 6.5 and earlier now and limit who can reach the server.
CVE-2026-88779, a memory-corruption flaw in NetScaler ADC and Gateway, was published on 4 October and added to the CISA KEV catalog. It allows an unauthenticated denial of service when the appliance is configured as a SAML SP or SAML IdP. Fixes are 14.1-73.41 and 13.1-64.28. Appliances already moved to 73.37 or 64.23 for the 27 September batch need another update.
Fujifilm Business Innovation and Sharp multifunction printers have a path traversal flaw, CVE-2026-78249. Act now: update affected models to the fixed firmware and change the administrator password from its default. Exploitation requires a login to the web management interface. Sharp lists two North America models; Fujifilm lists 28 rows, 19 fixed at 1.50.6 and nine at other version numbers.
Authlib returns a JWS carrying no signature as if it had been verified (CVE-2026-96760). No key and no signature are required. As of 29 September 2026 there is no fixed release, and the file is byte-identical in 1.8.0, which the CVE lists as outside the affected range.
JPCERT/CC disclosed two flaws in the configuration screens of Buffalo Wi-Fi devices (JVNVU#94863997). Only two models are affected, and the fixed firmware shipped on 25 August and 3 September, before the disclosure. Automatic updates are on by default, so if the installed version already reads as the fixed one, checking it is all that is needed.
F5 BIG-IP APM has a heap-based buffer overflow that reaches unauthenticated remote code execution. CISA added it to the KEV catalog on 22 September 2026 with a 25 September deadline. It only affects deployments configured as an OAuth Authorization Server.
Zyxel shipped the fix on 16 June 2026, but CISA added CVE-2026-7273 to the KEV catalog on 21 September. 996 switches across 48 countries were compromised, 564 of them still on factory default credentials. Here are the ten affected models and their fixed firmware.
CISA added three Linux kernel flaws to KEV on 18 September, not two — our 18 September article covered only two of them. The third, CVE-2025-39682, is in the kernel TLS receive path and its deadline is today, 21 September. Three assessors disagree: kernel.org 9.8, NIST 7.1, Red Hat 7.0.
CISA added three Linux kernel flaws to KEV on 18 September 2026; this article covers two of them (the third has its own article). One carries two conflicting CVSS scores on NVD. Remediation means confirming your release and kernel flavour are marked fixed, installing that package, then rebooting into it.
Google's 15 September Pixel Update Bulletin fixes CVE-2026-58704, a permission bypass in the cellular modem, and states there are indications of limited, targeted exploitation. CISA added it to KEV on 16 September. The fix is security patch level 2026-09-05 or later.
JetFormBuilder for WordPress (about 80,000 active installs) lets an unauthenticated attacker create an administrator account. Wordfence scores it 9.8 CRITICAL on CVSS v3.1. This CVE itself is fixed in 3.6.2.1, but five more CVEs landed in September, so clearing all six takes 3.6.5.2 or later.
A crafted email is enough to run commands as root on Cisco Secure Email Gateway, with no authentication. Cisco scores it 9.8 CRITICAL on CVSS v3.1 and states it became aware of active exploitation in September 2026. There are no workarounds.
Self-managed GitLab has a flaw that lets an unauthenticated attacker read arbitrary files from the server. CVE-2026-85706 is scored 10.0 CRITICAL on CVSS v3.1 by GitLab. CISA added it to the Known Exploited Vulnerabilities catalog on 11 September 2026. Fixed in 19.1.8, 19.2.6 and 19.3.2.
A flaw in the WordPress plugin miniOrange 2FA lets any unauthenticated visitor delete arbitrary site options. WPScan scores it 10.0 CRITICAL on CVSS v3.1. Fixed in 6.3.1 (free) and 19.3 (Pro), with a proof of concept scheduled for public release on 8 October 2026.
Google shipped Chrome 153 (153.0.8010.36) to fix CVE-2026-87491, an out-of-bounds write in V8. Google rates it Medium, but its own release notes confirm an exploit exists in the wild, CISA set a 23 September 2026 deadline, and other Chromium browsers such as Edge and Opera are in scope too.
Google's Agent Development Kit for Python, google-adk 2.0.0 through 2.6.0, has a CVSS 10.0 code injection. A crafted test session replay against adk web on a host with pytest installed gives an unauthenticated attacker code execution. Fixed in 2.7.0 — and we verified in the source that 2.6.1 through 2.6.3 are unpatched too.
The WordPress plugin Frontend Admin by DynamiApps is vulnerable to a CVSS 9.8 authentication bypass in all versions up to and including 3.29.12. An unauthenticated attacker can overwrite an administrator's email address and take the account over through the password reset flow. Version 3.29.13 shipped on 25 August 2026. Around 9,000 active installs.
Inventory the web tier separately from WebLogic Server. Record Oracle Home patch history, the configured plug-in path and post-change checks in a handoff template.
MapLibre GL JS 6.4.0 and earlier carry a CVSS 10.0 XSS. The sanitizer skips one dangerous attribute out of every adjacent pair, and the surviving handler fires the moment the map renders its attribution. Update the maplibre-gl npm package to 6.4.1 or later.
CISA added LiteLLM's MCP auth bypass and Starlette's missing Host header validation to its KEV catalog of actively exploited flaws on September 2, 2026. Update LiteLLM to 1.84.0, Starlette to 1.0.1.
Amelia Premium 8.0 through 9.6.2 lets an unauthenticated attacker overwrite an administrator's password and take over the account (CVE-2026-9055, CVSS v3.1 9.8 CRITICAL). The fix is 9.6.3; the current release is 9.8.1. Check your version number first — the free edition uses a different version series.
PaperCut NG/MF, CVE-2026-81578 and CVE-2026-82078: restrict internet access to the admin interface now, then apply Emergency Patch Release 3. The two are being chained in real attacks and CISA added both to its Known Exploited Vulnerabilities catalog on 2026-08-31. Version numbers will not tell you whether you are safe.
An SMTP command injection in Nodemailer via envelope.size. It does not occur under default settings, and scoring is split between LOW and CRITICAL. Here is how to tell whether you are actually affected.
An authenticated user can write outside the intended Docker cache path, so a forged image gets cached under a trusted name. The CVSS score is only 5.3, but it was exploited in the wild and is now in CISA's KEV catalog.
Gitea 1.17 through 1.27.0 lets an attacker plant a live Git hook through the diffpatch API and run commands as the Gitea service account. CISA added it to KEV on August 25 with an August 28 due date. Affected versions, real preconditions, and checks.
CVE-2026-4342 starts with a low-privileged user who can create or modify Ingress annotations. This correction lists the exact affected and fixed versions and resulting impact.
An unauthenticated SQL injection can lead to Metabase administrator access. Update to the fixed release for the deployed branch and perform the vendor's compromise checks.
The previous CVE identifier and WordPress 7.0.4 claims were incorrect. This correction uses the official 7.0.2 release and CVE-2026-60137/63030 details.
Microsoft lists a Critical security bypass and a High-severity RCE, but not confirmed exploitation at publication. Apply the product-specific updates promptly.
Hotfix 1 has been superseded by additional mitigation. On-premises deployments should install 2026.3.1.10 and investigate for compromise because exploitation has been observed.
The three NVMe/TCP, SMC, and SCTP issues should not be described collectively as CVSS 9.8 remote RCEs. This correction uses the official Linux CVE announcements.
An urgent backdoor, CVE-2026-18072, has been discovered in WordPress plugin 'Advanced Responsive Video Embedder (ARVE)' version 10.8.7. Please delete the affected plugin immediately.
A security settings checklist that Web service developers should integrate into their weekly routine. Review it now and maintain secure operations.
CVE-2026-16812 lets an unauthenticated remote attacker reach privileged internal functionality in VeloCloud Orchestrator On-Prem. Arista rates it CVSS v3.1 10.0. Install the fixed build for your branch immediately.
An urgent vulnerability (CVE-2026-47304) affecting Microsoft .NET and Visual Studio has been discovered, allowing unauthenticated attackers to bypass security features. Immediate update to a patched version is mandatory.
An authentication bypass vulnerability (CVE-2026-66013) has been discovered in OpenRemote versions prior to 1.26.2. Unauthorized attackers could update console assets and hijack notifications, necessitating an immediate update to the patched version.
A practical recurring checklist for patching, MFA, least privilege, backups, and logging. Prioritize each control for your assets and risk instead of relying on a daily news cycle.
REST API batch-route confusion and SQL injection can lead to remote code execution. Check the applicable fixed release: 6.9.5 for the 6.9 branch or 7.0.2 for 7.0.
Separate SharePoint authentication-bypass privilege escalation CVE-2026-56164 from deserialization RCE CVE-2026-58644 and install each fixed build. Microsoft's scores are 5.3 MEDIUM and 9.8 CRITICAL.
A heap buffer overflow affects NGINX map regular-expression processing. It can restart workers and cause DoS; code execution requires ASLR to be disabled or bypassed. Install a fixed release.
Cisco IOS 12.4 on the Cisco 871 has CSRF flaws that abuse an authenticated administrator session. Disable or restrict HTTP administration and migrate to supported hardware.
CVE-2026-53359 affects x86 KVM shadow paging and can cross the guest-to-host security boundary. Check the virtualization host's patch status. The earlier success-rate claims have been withdrawn.
A flaw in Linux rtmutex handling can lead to use-after-free through local futex operations. Install the kernel vendor's fixed package and verify that the fix is running.
A critical path traversal vulnerability, CVE-2026-48282, in Adobe ColdFusion is being actively exploited. With a CVSS score of 10.0, immediate patching for this vulnerability is imperative.
NetScaler ADC/Gateway configured as a SAML IdP has an unauthenticated memory over-read flaw. The CNA rates it CVSS v4.0 8.8 HIGH. Update the affected build.
A severe authenticated RCE vulnerability, 'CVE-2026-45659,' has been discovered in Microsoft SharePoint Server and added to the CISA KEV catalog. It allows code execution even by low-privileged users, necessitating immediate patch application.
This third-party WordPress plugin allows an authenticated Author-level user to execute code. Versions through 1.10.2 are affected; it is not a Cloudflare product.
An unrestricted upload of a dangerous file type can lead to code execution without authentication or user interaction. Install the fixed releases in Adobe bulletin APSB26-68.
Partial copy-on-write handling in tc pedit can corrupt page-cache data. This is a local CAP_NET_ADMIN attack, not remote RCE. Install a fixed distribution kernel.
Ultimate Member 2.11.4 and earlier can expose password-reset links to an authenticated Contributor-level attacker, enabling takeover of accounts including administrators.
A critical vulnerability has been discovered in the Deno runtime that allows bypassing the --deny-net rule, enabling access to internal networks. Immediate update to version 2.8.1 or later is required.
A compromised update server distributed malicious code to three Pro plugins. Install each product's fixed release, rotate credentials, and investigate the site for persistence.
JCE 1.0.0 through 2.9.99.4 can allow unauthenticated creation of editor profiles followed by PHP upload and execution. Apply JCE's fixed release or official legacy patch.
A severe unauthenticated SQL injection vulnerability has been discovered in WordPress plugin 'eCommerce Product Catalog' versions 3.5.5 and below, allowing database manipulation without authentication. Immediate update is mandatory.
A critical vulnerability has been discovered in applications that process JavaScript embedded in PDF files. Maliciously crafted PDFs could lead to arbitrary code execution.
An authentication bypass vulnerability has been discovered in the PHP application of Nefteprodukttekhnika BUK TS-G. This could allow a remote, unauthenticated attacker to seize administrator privileges and manipulate the system.
A severe vulnerability (CVSS 9.8) allowing unauthenticated remote code execution has been discovered in Oracle PeopleSoft Enterprise PeopleTools, and numerous organizations have been compromised by zero-day attacks. Immediate patching and access restrictions are required.
An unauthenticated OS command injection vulnerability in Ivanti Sentry has been urgently disclosed. Rated with a CVSS score of 10.0, active exploitation has already been confirmed. Immediate patch application and access restrictions are mandatory.
UpdraftPlus 1.26.4 and earlier has an authentication bypass (CVE-2026-10795) that lets unauthenticated attackers run commands as an administrator. Update the free version to 1.26.5 or later.
A certificate-validation logic flaw in deprecated IKEv1 can let an unauthenticated attacker establish Remote Access VPN without a valid user password.
V8 in Chrome before 149.0.7827.103 has an out-of-bounds read/write that can execute code inside the sandbox through crafted HTML. Install Google's fixed release.
A critical denial-of-service (DoS) vulnerability, CVE-2026-49975, has been disclosed in the mod_http module of Apache HTTP Server. Versions 2.4.17 through 2.4.67 are affected, and a prompt update is recommended.
CVE-2026-49975 combines HTTP/2 HPACK compression with flow-control stalling to consume large server resources from limited traffic. It is rated CVSS v3.1 7.5 HIGH. Apply the product-specific fix or official mitigation.
Unauthenticated RCE in Everest Forms Pro and SQL injection in PDO Firebird are separate issues. Their authoritative scores are CVSS v3.1 9.8 and CVSS v4.0 7.4.
Full Page Cache Warmer for Magento 2 before 1.11.12 unsafely deserializes the CacheWarmer cookie, allowing unauthenticated RCE through available gadget chains.
WP Maps Pro 6.1.0 and earlier exposes a nonce and temporary-access handler that can create an administrator without authentication. Update to version 6.1.1 or later.
WP Maps Pro 6.1.0 and earlier exposes a nonce and temporary-access handler that can create an administrator without authentication. Update to version 6.1.1 or later.
XPath injection in APS Application Catalog search can let a low-privileged authenticated user execute OS commands. The authoritative CVSS v3.1 score is 9.9, not 10.0.
A severe authentication bypass vulnerability (CVE-2026-0257) has been disclosed in Palo Alto Networks PAN-OS GlobalProtect, and active exploitation has been confirmed. Urgent patch application and mitigation measures are essential.