CVE
109 articles · page 2 of 10
Part of Security wire
eMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)
How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
HOL Guard
PHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)
How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.
HOL Guard
Plex Media Server hijacked without a login to mine crypto and run proxies, now on CISA KEV (Plex2Shell, CVE-2026-96652)
How to fix CVE-2026-96652: upgrade Plex Media Server to 1.43.3.10861 or later. The Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) is exploited to install crypto miners and proxies, on CISA KEV Oct 20. Updating does not remove an infection.
HOL Guard
BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, now on CISA KEV (CVE-2026-102764)
How to fix CVE-2026-102764: upgrade BeyondTrust Remote Support to 24.3.1 or later and apply the BT26-05-RS patch from /appliance. Exploited as a zero-day since August, on CISA KEV Oct 16. Patching does not evict an attacker already inside.
HOL Guard
Exploited Atlassian bug lets strangers read files off Jira, Confluence and Bitbucket Data Center, now on CISA KEV (CVE-2026-21589)
How to fix CVE-2026-21589: upgrade Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center to Atlassian's Oct 5 fixed releases (Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1). Unauthenticated file read, on CISA KEV since Oct 15.
HOL Guard
Next.js October 2026 security update fixes two unauthenticated RCEs. Check sharp too (CVE-2026-96889)
How to fix CVE-2026-96889: upgrade next to 16.4.1 (or 15.5.28) and confirm sharp is 0.35.5. Today's Next.js and React releases close two unauthenticated RCEs and a Server Actions DoS.
HOL Guard
Exploited Cisco Secure Email Gateway AMP bug lets attackers write files as root, now on CISA KEV (CVE-2026-76519)
How to fix CVE-2026-76519: upgrade Content Scanner Tools to 25.3.0.5525+ (or AsyncOS 15.5.5-014 / 16.5.0-780). Exploited Cisco Secure Email Gateway AMP File Reputation bug writes files as root; CISA KEV due Oct 17.
HOL Guard
Exploited PAN-OS bug gives attackers root on Palo Alto firewalls, now on CISA KEV (CVE-2026-0322)
How to fix CVE-2026-0322: upgrade PAN-OS to the hotfix for your train (12.2.4, 12.1.10-h2, 11.2.13-h3, 11.1.16-h3, 10.2.18-h12 and others). Attackers are using this admin-interface bug for root on Palo Alto firewalls and Panorama; CISA due date Oct 17.
HOL Guard
Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)
How to fix CVE-2026-92392: upgrade curl and libcurl to 8.23.0 (or 8.14.3, 8.16.2, 8.20.2 on those branches, or your distro's patched build). A malicious HTTP/2 server can trigger a use-after-free during uploads in curl 8.12.0 through 8.22.0.
HOL Guard
Windows zero-day lets booby-trapped files skip the download warning (CVE-2026-96951)
How to fix CVE-2026-96951: upgrade Windows to the October 2026 cumulative update (KB5127648 on Windows 11 24H2 and 25H2). It closes a Windows Shell Mark of the Web bypass that attackers are already using.
HOL Guard
New no-login code execution bug in Magento and Adobe Commerce (CVE-2026-103849)
How to fix CVE-2026-103849: upgrade Adobe Commerce or Magento Open Source to the 2026-oct build for your line (APSB26-153), and keep September's VULN-39341 hotfix in place.
HOL Guard
Ivanti Connect Secure login bypass is being exploited, now on CISA KEV (CVE-2026-104935)
How to fix CVE-2026-104935: upgrade Ivanti Connect Secure to 25.1.1.2, 22.8R2.5 or 25.1.3.x. Attackers are using this login bypass to run commands on the VPN, and CISA gave agencies until Oct 16.
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.