Cybersecurity news: vulnerabilities, attacks, data breaches, privacy and regulation.
Palo Alto Networks says attackers are exploiting PHP2Shell vulnerabilities against internet-exposed management interfaces. Operators should review affected PAN-OS versions, apply available fixes and restrict management access to trusted internal addresses.
Tailscale has published details of the Tailworm findings, including five issues involving Tailscale Serve and Funnel. Three bugs are fixed in version 1.104.4, while two findings describe expected behavior.
Attackers are exploiting a critical SQL injection flaw in Arista VeloCloud Orchestrator and a command-injection flaw in the Collabora Online Built-in CODE Server for Nextcloud. Administrators should apply the available updates and investigate systems for signs of compromise.
CVE-2026-111497 affects Brotli versions 1.0.3 through 1.2.0 and can enable memory disclosure, denial of service or code execution through crafted compressed data. Fixed Brotli releases and updates for Node.js, PHP, Python and other software are available, while attacks in the wild have not been reported.
CISA has added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog after successful remote-code-execution attacks were observed against honeypots. Fixed PHP releases are available, but exposure estimates remain difficult to interpret because some Linux distributions backport patches.
The Dutch NCSC has published an advisory detailing vulnerabilities in Cisco Secure Firewall ASA, Threat Defense, and Management Center, with two flaws rated 9.9 and two others actively exploited in the wild.
Researchers have disclosed an AI-assisted attack leveraging PHP2Shell vulnerabilities to root 25 servers, including three in a U.S. government-affiliated network, highlighting risks in embedded PHP management interfaces.
A critical buffer overflow in EDK II can enable code execution before Secure Boot, but only when a machine is booting from the network. Stable firmware fixes are not yet broadly available.
Black Lotus Labs describes a relay framework that lets Volt Typhoon chain compromised routers and enterprise systems into temporary attack paths, including during zero-day attacks against management platforms.
Veeam has released fixes for four vulnerabilities affecting Backup & Replication, Veeam Agent for Linux and Veeam ONE. Administrators should check the affected installations and apply the specified versions promptly.
Attackers modified a shared Plausible analytics script used on Convertr checkout pages. The suspected entry point remains unconfirmed, while affected shoppers are advised to contact their bank and clear browser caches.
Two sandbox-escape vulnerabilities in Wasmtime affect supported release lines, with one limited to ARM64. Operators must update each application that embeds the runtime rather than only replacing a command-line tool.
A campaign active since July 2025 has injected malicious JavaScript into 953 online stores. Store operators should audit administrator accounts and CMS content, while the final payload remains unknown.
Python has released security updates for five supported branches after attackers could use weak eMudhra intermediate-certificate keys to issue certificates for arbitrary domains. The releases also fix archive-extraction, cookie-policy and parser flaws.
A campaign tracked by Wiz is planting workflows in repositories accessible to stolen GitHub tokens and extracting secrets through Actions logs. Private repositories and GitHub Enterprise Server are not covered by GitHub’s current approval safeguard.
Researchers demonstrated that a malicious instruction file in a Downloads folder can cause AI coding agents to install packages, execute commands or expose credentials when the agent is launched from that directory.
OpenAI says red-team agents found virtual-machine escapes, indirect internet access and cache-based communication between isolated environments before frontier training resumed.
An attacker used an exposed LiteLLM master key to access GitHub credentials, alter the release process and publish LiteLLM 1.107.0 with credential-stealing and backdoor capabilities.
CVE-2026-111497 affects software that decodes untrusted Brotli data. Code execution has been demonstrated on one unpatched Node.js build, while other affected components require their own updates or mitigations.
Ruby has released security updates for three Onigmo bugs linked to four critical GitLab flaws. Applications that compile attacker-controlled regular expressions should upgrade or stop processing untrusted patterns.
A campaign attributed to k0t targeted internet-facing Fortinet and Palo Alto Networks appliances between February and June 2026, using known vulnerabilities and credential attacks to establish access, steal data, and maintain persistence.
Pillow maintainers released version 13.0.0 on October 16 to address multiple vulnerabilities, including an EPS filename flaw that can lead to operating-system command execution under specific server conditions.
PHP disclosed CVE-2026-115560 on October 23, 2026. The issue affects an unusual application configuration, is not fixed by the latest PHP2Shell patches, and can be mitigated by disabling session upload progress.
Railway says suspicious activity may have exposed decrypted customer environment variables. Users are urged to rotate secrets, revoke relevant AI-provider keys, and check service logs while deployment availability remains uneven.
LiteLLM’s release pipeline was compromised on October 21, sending a malicious Python package and container images to users. Organizations that installed version 1.107.0 should stop affected deployments, isolate and rebuild systems, and rotate exposed secrets.
A public proof-of-concept targets Fortinet FortiSIEM vulnerability CVE-2026-106173, a critical unauthenticated path-traversal flaw that can lead to arbitrary code execution. Administrators running FortiSIEM 7.5.0 should upgrade to 7.5.1 or later.
Attackers used compromised UpdraftCentral connection keys to send commands to connected WordPress sites. TeamUpdraft has rotated credentials and released updates, while site owners should check accounts, plugins and storage keys.
GoDaddy is replacing and revoking hundreds of thousands of certificates whose technical details were correct but did not match the certification policy documentation in force when they were issued.
Arista says attackers are exploiting CVE-2026-114625 in VeloCloud Orchestrator. Administrators should install the fixed on-premises releases or restrict access and investigate logs until upgrading is possible.
Two KSMBD vulnerabilities rated CVSS 9.0 are public, including one that requires no network authentication. Administrators can check whether KSMBD is active while waiting for fixes to reach stable and distribution kernels.
Fortinet is preparing unscheduled updates for FortiOS, FortiManager, FortiAnalyzer and other products. Customers should prioritize internet-facing devices and restrict administrative access if they cannot patch immediately.
BIND maintainers disclosed a high-severity vulnerability that can be exploited over the internet through replayed GSS-TSIG-signed UDP packets. Operators should check affected versions and update to a fixed release.
Microsoft says the China-aligned actor used an AI-enabled framework to abuse trusted cloud applications, automate password spraying and pursue persistent access across customer environments.
GitLab released fixes on October 21 for CVE-2026-110264, a maximum-severity flaw in its regular-expression compiler. Self-managed administrators should upgrade to the corrected release for their branch.
The PHP security team and CISA have issued emergency patches for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, affecting all PHP installations serving web requests.
CISA has added four Plex Media Server vulnerabilities to its KEV Catalog due to active exploitation in the ‘Plex2Shell’ attack chain, urging organizations to prioritize remediation.
US agencies released a joint advisory on October 20, 2026, detailing SafePay ransomware attacks on over 600 organizations since August 2024, outlining specific vulnerabilities exploited and required mitigations.
Mozilla, Google, and Apple have blocked compromised certificates from CA eMudhra after researchers discovered private keys were trivially guessable. Node.js has released emergency patches for versions 22.x, 24.x, and 26.x to address these risks.
