#vulnerability
24 posts
Node ships three security releases in one day: 11 CVEs, five high, two in tls and one in dns
On October 21 Node released 26.12.1, 24.22.1 and 22.23.4 together, fixing 11 CVEs. The high-severity ones cluster in tls and dns input parsing, alongside two permission-model edge cases and a root store bump to NSS 3.131.1.
Redis patches three lines at once: propagating a 4GB+ message over the cluster bus overflows the heap
8.10.3, 8.8.4 and 8.6.8 fix the same bug: in cluster mode, propagating a PUBLISH or SPUBLISH message larger than 4GB over the cluster bus overflows a heap buffer. Narrow impact, but the trigger conditions are worth remembering.
BeyondTrust Remote Support auth bypass is exploited in the wild, CISA adds it to KEV
CVE-2026-102764 is an auth bypass in BeyondTrust Remote Support up to 26.2.3, added to CISA KEV on October 16. Blast radius, patch path and what to hunt.
MCP Inspector's 9.4: a dev tool that runs commands should not listen on 0.0.0.0
Before 0.14.1, MCP Inspector had no authentication between its browser UI and its local proxy, so an unauthenticated request could launch MCP commands over stdio. CVSS 9.4 — and the lesson applies to every local-proxy dev tool.
PHP's two 9.2 RCEs: the official root causes, and what the public PoC actually demonstrates
On October 21 PHP fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); a public PoC with a full lab appeared the next day. Here are the longjmp and stale-global-state root causes, a reproducible lab, the PoC, and where the PoC diverges from the advisory.
The CVSS 10.0 React bug: one request, code execution on your server
A flaw in how React Server Components decode payloads earned a perfect 10.0 — unauthenticated remote code execution. Here is who is affected, how to check, and what to do about it.
A retargeted tag: twenty thousand repos leaked secrets into build logs
In March 2025 the version tags of tj-actions/changed-files were pointed at a malicious commit, and CI tokens were printed into workflow logs. CVE-2025-30066 is the bill for mutable tags.
What a CVSS 4.0 score of 9.2 says, and the three things it does not
Both PHP vulnerabilities today are rated CVSS v4.0 9.2. That number is a filter, not a priority: it measures the vulnerability, not your assets, your exposure, or the cost of patching.
Eight intermediate CA private keys that were all integers below 256
Someone scanned the CCADB certificate corpus and found that eight eMudhra intermediate CA keys could simply be enumerated — they were generated as integers between 0 and 255. Yesterday Mozilla decided to remove trust in emSign ECC Root CA - G3.
PHP ships two 9.2 fixes today at 14:00 UTC: what to do before then
PHP posted an advance notice on 20 October: a security release on 21 October at 14:00 UTC fixes two vulnerabilities, both rated CVSS v4.0 9.2. Details come with the release, but your rollback plan can be settled now.
CVE-2026-99999: the IPv4 checksum bug that can escape a VM
Debian security tracker lists CVE-2026-99999 as a missing IPv4 checksum check in the Linux kernel, exploitable from a guest to the KVM host. Fixed in 6.1.190-1 (bookworm) and 6.12.113-1 (trixie).
873 bugs, 54 models: notes on the 2026 LLM security report
2,467 white hats tested 54 LLM and agent products from 25 vendors and found 873 vulnerabilities, 608 of them LLM-specific. Prompt injection still ranks first; a hardcoded API key exposed keys for 239 models at once.
Next.js October patch: three holes, two of them remote code execution
In mid-October Next.js and React shipped three vulnerabilities: an image-processing RCE, a use cache RCE and a Server Action denial of service. The patches are out of band — do not wait for the next minor version.
PwnEscape and agent sandboxes: a microVM is not an absolute boundary
PwnEscape exploits an L2/L3 offset mismatch in virtio-net/TAP to reach the KVM host from a guest, tracked as CVE-2026-99999. It is a reminder that isolating untrusted code in a microVM assumes the host kernel has no reachable path from the guest.
Debian DSA-6045: a poisoned resolver can also break DNSSEC
Debian issued DSA-6045-1 for pdns-recursor, fixing CVE-2026-52690 and related issues. An attacker can forge answers so the resolver marks an authoritative server as EDNS-incapable, which makes DNSSEC validation fail.
Artex goes closed source: what an author can do when a security tool is abused
An AI-driven pentest tool was linked to data breaches at Korean banks; its author stopped development and closed the source. The responsibility boundary for open security tooling is on the table again.
A poisoned npm release: what one postinstall can carry away
In October 2026, tensorlake 0.5.144 shipped a Shai-Hulud credential-stealing worm aimed at npm, GitHub, cloud and AI credentials. The bar for a supply-chain attack is now one compromised account.
An AI agent chained two zero-days: the seconds that took down DIVD
An autonomous AI agent chained two Zammad zero-days into a full attack path and took over DIVD, an organisation whose job is coordinating vulnerability disclosure.
GLPI template-injection RCE: why admin rights should not equal root
CVE-2026-26026 lets a GLPI administrator reach arbitrary command execution on the server by editing a template. CVSS 9.1. The interesting part is not the attack chain but the assumption it exposes: why should the person with the admin console be able to run system commands?
SharePoint deserialisation RCE: CVE-2026-45659
A plain Site Member account is enough to run code on a SharePoint server. Microsoft rated exploitation unlikely, and CISA put it in the KEV catalogue with three days to remediate.
n8n unauthenticated RCE (Ni8mare): CVE-2026-21858
The form node skips Content-Type validation, so one application/json request makes it read an arbitrary file. The key inside the config forges an admin JWT, and a sandbox bypass turns that into RCE.
Cisco FMC unauthenticated Java deserialisation RCE: CVE-2026-20131
CVSS 10.0, no authentication, code execution as root, and 36 days of use as a zero-day by a ransomware crew. Breaking the firewall management hub hands over every policy and log with it.
Next.js incremental cache path traversal to RCE: CVE-2026-75604
One unescaped backslash turns the incremental cache into arbitrary file read and write on Windows, and the leaked Server Action encryption key forges a request that walks a React Flight property chain to Function.
React Router prototype pollution chained into RCE: CVE-2026-42211
turbo-stream v2 calls a constructor while rehydrating the TYPE_ERROR branch without checking where it came from. If the app already has a prototype pollution bug, that path reaches Function and two moderate flaws become RCE.