VulnerabilitiesBrief2 min read
PHP's security team rated two undisclosed vulnerabilities 9.2 on the CVSS v4.0 scale. watchTowr researchers say both allow remote code execution, and only the four supported branches can get the fix.
VulnerabilitiesBrief2 min read
The project shipped fixes for 10 flaws across its three supported release lines on October 21, with the bundled Brotli decompression code rated the most serious.
VulnerabilitiesBrief1 min read
Trend Micro's Zero Day Initiative rated both KSMBD remote code execution flaws 9.0. One can be triggered before any network authentication, and no mainline kernel fix was available at disclosure.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
Researchers say crafted Brotli data made an official Node.js 24.22.0 Linux arm64 image run attacker-supplied code, exploiting a buffer overflow in the bundled decoder.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.21 min read
The PHP security team published workaround advice for a new remote code execution flaw that has no patch, and said the earlier PHP2Shell bugs are already being probed in the wild.
VulnerabilitiesCVE-2026-93674CVSS 9.82 min read
Rapid7's Metasploit release covers an auth bypass, three unauthenticated RCE paths and two authenticated code execution flaws in the open-source LLM workflow builder.
VulnerabilitiesBrief2 min read
Ruby shipped 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in its built-in Onigmo regex engine, which GitLab tied to four critical remote code execution flaws patched over the past month.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.21 min read
A buffer overflow in Google's Brotli decoder lets crafted compressed data corrupt memory, and the affected code ships inside many programs that unpack Brotli streams.
VulnerabilitiesCVE-2026-108097CVSS 8.12 min read
The project fixed bugs in core's Field UI module and the contributed Entity List module, and told admins to update before the disclosure window closed.
Threat intelExploitedCVE-2024-47575CVSS 9.82 min read
A suspected state-sponsored group used a FortiManager flaw for initial access, then a path traversal bug to gain root and deploy the PeerStitch implant, researchers say.
VulnerabilitiesCVE-2026-107186CVSS 8.62 min read
Rapid7 says a legacy DWR endpoint in Eptura Archibus let it run workflow rules without credentials, chain that into a full database read, and reach remote code execution through an insecure file upload.
VulnerabilitiesCVE-2026-106173CVSS 9.42 min read
Horizon3.ai published exploit code for an unauthenticated gRPC path traversal in FortiSIEM 7.5.0 that Fortinet rated critical and fixed in 7.5.1.
