Exploited bugs, new critical vulnerabilities, and what defenders should check.
Brief2 min read
The project shipped fixes for 10 flaws across its three supported release lines on October 21, with the bundled Brotli decompression code rated the most serious.
Brief2 min read
Anomaly fixed the AI coding agent flaw in version 1.18.33, according to a report from October 22, 2026.
Brief1 min read
Trend Micro's Zero Day Initiative rated both KSMBD remote code execution flaws 9.0. One can be triggered before any network authentication, and no mainline kernel fix was available at disclosure.
ExploitedCVE-2026-109618CVSS 9.22 min read
Threat actors have been attempting to exploit the newly disclosed PHP2Shell flaws to enroll systems in a Mirai variant called Potassium, but the attempts have not worked, and weaponizing the bugs may be harder than first thought.
ExploitedCVE-2026-111497CVSS 9.22 min read
Researchers say crafted Brotli data made an official Node.js 24.22.0 Linux arm64 image run attacker-supplied code, exploiting a buffer overflow in the bundled decoder.
CVE-2026-112900CVSS 9.21 min read
A reported flaw in Pillow's EPS plugin passes a caller-controlled filename to Ghostscript without making it a safe absolute path, so a name starting with a hyphen can be read as an option.
ExploitedCVE-2026-109618CVSS 9.21 min read
The PHP security team published workaround advice for a new remote code execution flaw that has no patch, and said the earlier PHP2Shell bugs are already being probed in the wild.
CVE-2026-93674CVSS 9.82 min read
Rapid7's Metasploit release covers an auth bypass, three unauthenticated RCE paths and two authenticated code execution flaws in the open-source LLM workflow builder.
Brief2 min read
Ruby shipped 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in its built-in Onigmo regex engine, which GitLab tied to four critical remote code execution flaws patched over the past month.
ExploitedCVE-2026-110447CVSS 9.22 min read
The agency cited reports of active exploitation in the wild for the critical OS command injection bug in the Nextcloud app, which allows remote code execution.
ExploitedCVE-2026-111497CVSS 9.21 min read
A buffer overflow in Google's Brotli decoder lets crafted compressed data corrupt memory, and the affected code ships inside many programs that unpack Brotli streams.
CVE-2026-108097CVSS 8.12 min read
The project fixed bugs in core's Field UI module and the contributed Entity List module, and told admins to update before the disclosure window closed.
