VulnerabilitiesCVE-2026-98432CVSS 9.82 min read
Anthropic researchers built an exploit for a use-after-free in IPv4 TCP handling that reached root on a server with an MPTCP listener. Patches are landing, but several major distros were still listed as vulnerable on October 30.
VulnerabilitiesCVE-2026-118539CVSS 6.52 min read
Drupal says unauthenticated attackers are exploiting a missing authorization flaw in the Commerce Core module and is urging admins to upgrade and audit orders for inconsistencies.
VulnerabilitiesBrief2 min read
Defiant says threat actors began hitting a race condition in WordPress's update process within hours of the fix, though the exploit window is narrow and no successful compromises are reported.
VulnerabilitiesCVE-2026-118539CVSS 6.52 min read
Drupal says the highly critical flaw in its e-commerce module is under active attack and tells store owners to audit their orders.
VulnerabilitiesExploitedCVE-2026-46817CVSS 9.82 min read
Defused says its decoys logged exploratory exploitation attempts against a critical SQL injection flaw in Oracle E-Business Suite's Application Object Library, patched in Oracle's October CPU.
VulnerabilitiesCVE-2026-114595CVSS 9.82 min read
The bugs affect the open source toolkit behind control systems at particle accelerators and fusion labs. One could allow code execution, though researchers only demonstrated a crash.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read
Honeypots recorded a confirmed remote code execution against an Apache mod_php install running PHP 8.4.26, according to a Perplexity researcher whose findings a second researcher corroborated.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read
A researcher says attackers ran shell commands on honeypots running PHP 8.4.26, the first reported confirmation of code execution from the PHP2Shell bugs.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.21 min read
CISA added two critical PHP vulnerabilities tracked as PHP2Shell to its Known Exploited Vulnerabilities Catalog and told federal civilian agencies to patch by Thursday.
VulnerabilitiesCVE-2026-76466CVSS 9.82 min read
Cisco's October round covers Expressway Series, IOS XR, Snort 3 and Unified Communications, plus a local privilege escalation in Secure Client's Secure Firewall Posture module.
VulnerabilitiesCVE-2026-76299CVSS 9.91 min read
Splunk fixed 16 CVEs in Enterprise and 15 in SOAR, including critical access control and data exposure bugs, while SolarWinds patched a high-severity authorization flaw in Observability.
VulnerabilitiesCVE-2026-108097CVSS 8.12 min read
Drupal shipped fixes for five vulnerabilities, including two critical remote code execution flaws that need contributed modules to be reachable, and urged admins to make time for core updates.
