Exploited bugs, new critical vulnerabilities, and what defenders should check.
Brief2 min read
Quentin Kaiser said an attacker within radio range could run code as root on Broadcom-based routers without the network password or a pairing step, and showed it working on gateways from three Belgian ISPs.
CVE-2026-108097CVSS 8.12 min read
Drupal shipped fixes for five vulnerabilities, including two critical remote code execution flaws that need contributed modules to be reachable, and urged admins to make time for core updates.
Brief2 min read
A researcher says attackers chained four Plex Media Server flaws, called Plex2Shell, to deploy miners and reverse proxy software a day after a proof-of-concept went public.
ExploitedCVE-2026-110936CVSS 8.41 min read
Siemens has fixed a DLL sideloading vulnerability in Software Center that it says was exploited in ClickFix attacks to deliver a remote access trojan, according to The Hacker News.
Brief2 min read
Go 1.27.3 and Go 1.26.10 make the certificate verifier refuse chains built on eight intermediate CA keys. The Go team hasn't said publicly what prompted the block.
CVE-2026-9853CVSS 8.52 min read
The ICS advisory describes a CSV injection bug, an authentication weakness and a privilege escalation path in the SCADA product used in the energy sector, with version 10.8 named as the vendor fix.
CVE-2026-106173CVSS 9.41 min read
Researchers published exploit code for a critical FortiSIEM path traversal bug that could let unauthenticated attackers run code. The flaw is described as recently patched.
Brief2 min read
PHP's security team rated two undisclosed vulnerabilities 9.2 on the CVSS v4.0 scale. watchTowr researchers say both allow remote code execution, and only the four supported branches can get the fix.
Brief2 min read
GitLab released fixes on October 21 for a flaw rated CVSS 10.0 that lets an attacker run code on a self-managed server without logging in, affecting releases going back to 7.0.
Brief2 min read
Amazon's Threat Intelligence team says the October 17, 2026 attempt came from an IP tied to a commercial anonymization network, and that the PHP2Shell flaws are now being exploited widely after patches shipped.
Brief2 min read
FoxIO disclosed QPACK flaws that let an unauthenticated attacker crash many HTTP/3 servers with a single connection, and released proof-of-concept code.
CVE-2026-91403CVSS 9.12 min read
Tenable's count puts 1,209 unique CVEs in the quarterly update, 95 of them critical. A separate Java advisory followed a day later.
