Exploited bugs, new critical vulnerabilities, and what defenders should check.
ExploitedCVE-2026-96654CVSS 6.92 min read
A researcher's honeypot running a vulnerable Plex Media Server recorded in-the-wild exploitation on October 17, with attackers dropping an XMRig-based miner and proxy software.
CVE-2026-15176CVSS 9.21 min read
The bugs need non-default configurations, but successful exploitation can crash a worker process or, in narrower cases, run code.
CVE-2026-113380CVSS 9.32 min read
A peer could flood the call's event queue so the hang-up never ran, leaving audio and possibly video running after the user ended the call. Signal fixed it in RingRTC 2.72.0.
CVE-2026-107186CVSS 8.62 min read
Rapid7 says a legacy DWR endpoint in Eptura Archibus let it run workflow rules without credentials, chain that into a full database read, and reach remote code execution through an insecure file upload.
ExploitedCVE-2026-0257CVSS 7.82 min read
Palo Alto Networks says it continues to see ransomware actors abuse an authentication bypass in PAN-OS and Prisma Access that lets attackers set up unauthorized VPN connections.
CVE-2026-106173CVSS 9.42 min read
Horizon3.ai published exploit code for an unauthenticated gRPC path traversal in FortiSIEM 7.5.0 that Fortinet rated critical and fixed in 7.5.1.
Brief1 min read
Mozilla and Google's Chrome Root Program confirmed the compromise of private keys for eight eMudhra intermediate CA certificates, a failure that could let a key holder mint trusted certificates for any site.
Brief3 min read
A JSON array sent as the api_token let unauthenticated attackers log in as existing users on Laravel apps backed by MySQL or MariaDB, and a working proof-of-concept is public.
ExploitedCVE-2026-109618CVSS 9.22 min read
The PHP security team said it would ship emergency updates for two vulnerabilities rated 9.2 under CVSS v4.0, after details reportedly leaked ahead of the planned disclosure.
ExploitedCVE-2026-109618CVSS 9.22 min read
PHP says fixes for the two critical-severity bugs, publicly dubbed PHP2Shell, are planned for Wednesday, 21 October 2026 at 14:00 UTC, and urges users to prepare to upgrade immediately.
ExploitedCVE-2026-88771CVSS 9.51 min read
The analysis describes appliance compromise, persistence, internal reconnaissance and configuration theft.
ExploitedCVE-2026-102764CVSS 9.31 min read
The report describes an authentication bypass and urges emergency remediation and investigation.
