Security wire

Exploited and critical vulnerabilities, supply-chain incidents, and what to patch first.

173 articlesRSS

Security wire, page 1

Page 1 of 5

  1. AdvisoryOne gzipped POST crashes Express via body-parser CVE-2026-111181. Upgrade to 1.20.9 or 2.4.0How to fix CVE-2026-111181: upgrade body-parser to 1.20.9 or 2.4.0. Trailing bytes after a compressed request body crash the Node process before routing runs.
  2. AdvisoryRailway breach exposed customer environment variables. Rotate every secret you stored in RailwayHow to fix the Railway environment variable breach: rotate every secret stored in Railway variables, move funds out of any wallet key kept there, and check provider logs for use of the old keys. Railway says an intruder reached encrypted env vars and decrypted some; stolen wallet keys were drained before the notice.
  3. AdvisoryNode.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlibHow to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.
  4. AdvisoryGitLab CVE-2026-110264 lets attackers run code on self-managed servers with no login, even ones patched Oct 12How to fix CVE-2026-110264: upgrade GitLab to 19.5.1, 19.4.3, 19.3.6, or the 19.2.9, 19.1.9, 19.0.10 and 18.11.13 backports. A crafted Org-mode file gives no-login code execution on self-managed GitLab, and servers patched on October 12 are exposed again.
  5. AdvisoryeMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
  6. AdvisoryLiteLLM 1.107.0 on PyPI and Docker latest shipped a credential stealer. Pin 1.106.2 and rotate your AI keysHow to fix the LiteLLM 1.107.0 compromise: pin litellm to 1.106.2, rebuild from a clean image, and rotate every key the host could read. All 1.107.0 wheels on PyPI and the Docker latest, main-latest and main-stable tags shipped a credential stealer that also dumps the proxy's stored provider keys.
  7. ExploitedPHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.
  8. ExploitedPlex Media Server hijacked without a login to mine crypto and run proxies, now on CISA KEV (Plex2Shell, CVE-2026-96652)How to fix CVE-2026-96652: upgrade Plex Media Server to 1.43.3.10861 or later. The Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) is exploited to install crypto miners and proxies, on CISA KEV Oct 20. Updating does not remove an infection.
  9. ExploitedBeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, now on CISA KEV (CVE-2026-102764)How to fix CVE-2026-102764: upgrade BeyondTrust Remote Support to 24.3.1 or later and apply the BT26-05-RS patch from /appliance. Exploited as a zero-day since August, on CISA KEV Oct 16. Patching does not evict an attacker already inside.
  10. ExploitedExploited Atlassian bug lets strangers read files off Jira, Confluence and Bitbucket Data Center, now on CISA KEV (CVE-2026-21589)How to fix CVE-2026-21589: upgrade Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center to Atlassian's Oct 5 fixed releases (Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1). Unauthenticated file read, on CISA KEV since Oct 15.
  11. AdvisoryNext.js October 2026 security update fixes two unauthenticated RCEs. Check sharp too (CVE-2026-96889)How to fix CVE-2026-96889: upgrade next to 16.4.1 (or 15.5.28) and confirm sharp is 0.35.5. Today's Next.js and React releases close two unauthenticated RCEs and a Server Actions DoS.
  12. ExploitedExploited Cisco Secure Email Gateway AMP bug lets attackers write files as root, now on CISA KEV (CVE-2026-76519)How to fix CVE-2026-76519: upgrade Content Scanner Tools to 25.3.0.5525+ (or AsyncOS 15.5.5-014 / 16.5.0-780). Exploited Cisco Secure Email Gateway AMP File Reputation bug writes files as root; CISA KEV due Oct 17.
  13. ExploitedExploited PAN-OS bug gives attackers root on Palo Alto firewalls, now on CISA KEV (CVE-2026-0322)How to fix CVE-2026-0322: upgrade PAN-OS to the hotfix for your train (12.2.4, 12.1.10-h2, 11.2.13-h3, 11.1.16-h3, 10.2.18-h12 and others). Attackers are using this admin-interface bug for root on Palo Alto firewalls and Panorama; CISA due date Oct 17.
  14. AdvisoryMalicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)How to fix CVE-2026-92392: upgrade curl and libcurl to 8.23.0 (or 8.14.3, 8.16.2, 8.20.2 on those branches, or your distro's patched build). A malicious HTTP/2 server can trigger a use-after-free during uploads in curl 8.12.0 through 8.22.0.
  15. ExploitedWindows zero-day lets booby-trapped files skip the download warning (CVE-2026-96951)How to fix CVE-2026-96951: upgrade Windows to the October 2026 cumulative update (KB5127648 on Windows 11 24H2 and 25H2). It closes a Windows Shell Mark of the Web bypass that attackers are already using.
  16. AdvisoryNew no-login code execution bug in Magento and Adobe Commerce (CVE-2026-103849)How to fix CVE-2026-103849: upgrade Adobe Commerce or Magento Open Source to the 2026-oct build for your line (APSB26-153), and keep September's VULN-39341 hotfix in place.
  17. ExploitedIvanti Connect Secure login bypass is being exploited, now on CISA KEV (CVE-2026-104935)How to fix CVE-2026-104935: upgrade Ivanti Connect Secure to 25.1.1.2, 22.8R2.5 or 25.1.3.x. Attackers are using this login bypass to run commands on the VPN, and CISA gave agencies until Oct 16.
  18. AdvisoryGitLab critical patch fixes no-login code execution on self-managed servers (CVE-2026-97229)How to fix CVE-2026-97229: upgrade GitLab to 19.4.2, 19.3.5 or 19.2.8. A crafted regex in CI/CD config could run code on a self-managed GitLab server with no login. GitLab.com is already patched.
  19. AdvisoryOpening a LibreOffice spreadsheet can run remote Java code (CVE-2026-63277)How to fix CVE-2026-63277: upgrade LibreOffice to 26.2.5 or 26.8.0. A saved Calc external data link could load a remote Java driver on open; five sibling file-read, file-write and SSRF bugs are fixed in the same release.
  20. ExploitedNetScaler SAML memory overflow hits CISA KEVHow to fix CVE-2026-88779: upgrade NetScaler ADC/Gateway to 14.1-73.41 or 13.1-64.28 (SAML SP/IdP builds)
  21. ExploitedZammad session fixation to root hits CISA KEVCVE-2026-102489 is not practically exploitable on Zammad 7.x. For CVE-2026-102490, upgrade self-hosted DEB/RPM packages to 7.2.2 or later.
  22. ExploitedFortiMail unauthenticated path traversal hits CISA KEVHow to fix CVE-2026-104286: disable FortiMail IBE (config system encryption ibe / set status disable) or upgrade to 8.0.2 / 7.6.7 / 7.4.9 or later
  23. AdvisoryNext.js image optimizer SSRF and cache poisons in September 2026 releaseHow to fix CVE-2026-94483: upgrade next to 15.5.27 or 16.3.8
  24. ExploitedCisco SD-WAN Manager admin API bypass hits CISA KEVHow to fix CVE-2026-76504: upgrade Cisco Catalyst SD-WAN Manager to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1

Keep exploring

The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.

Security research hubPlugin marketplace