Morning Brief

Patch today vendors with the most new CVEs today

• Oracle 64 critical 1080
• Google 29 critical 359
• WordPress 58
• apostrophecms 31
• totolink 30 critical 30
• Eclipse Foundation 1 critical 29
• triggerdotdev 28
• Advantech 24
• Unknown 1 critical 23
• curl 23

Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.

Top developments ranked by cross-source trending

1. 

   CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

   Research Rapid7 Blog21 Oct15 sources

   Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk…

   Read more

   Also in Cisco Security Advisories SANS Internet Storm Center CCCS Alerts & Advisories +3

   CVE-2026-109618 ↗CVE-2026-109619 ↗View on Security Feed

2. AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack

   News Dark Reading1h ago8 sources

   Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply — not contain — the risk.

   Read more

   Also in Infosecurity Magazine Dark Reading The Record +3

   View on Security Feed

   

3. Hackers got a four-day head start on epic PHP2Shell vulnerability

   Media Ars Technica Security21h ago9 sources

   Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were “now being broadly exploited in the wild.” Read full article Comments

   Read more

   Also in Bleeping Computer The Register Security Infosecurity Magazine +3

   View on Security Feed

   

4. Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches

   News The Register Security1h ago5 sources

   Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as "Linus Torvalds Turns to Slop." In the podcast Pivot to AI, podcaster David Gerard agreed: "Linux kernel goes full AI slop code." Meanwhile, in the Tom's Hardware comments section, commenter "LordVile" wrote: "This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage." They followed this by saying this is the "same reason he's flipped-flopped on AI." I've…

   Read more

   Also in The Hacker News CISA Alerts & Advisories CISA Alerts & Advisories +3

   CVE-2026-102204 ↗View on Security Feed

   

5. Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched Systems

   News Cyber Security News1h ago4 sources

   A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The malware targets Secure Boot, a feature designed to help stop untrusted software from running before Windows starts. Researchers say the infected computers had received Windows updates, but a key Secure Boot protection had not been fully applied. Securelist analysts reported the findings on October 22, 2026. They say BlackX uses Baton Drop, a vulnerability tracked as CVE-2022-21894, and shares parts of its design with the BlackLotus bootkit…

   Read more

   Also in The Hacker News Microsoft Security Microsoft Security +2

   CVE-2026-61359 ↗CVE-2026-69902 ↗CVE-2026-83709 ↗View on Security Feed

   

6. Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks

   News Cyber Security News8h ago4 sources

   Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root. Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026. The issue affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and hardware appliances are affected when running vulnerable software with clustering enabled. Successful exploitation could give attackers…

   Read more

   Also in The Register Security Zero Day Initiative CCCS Alerts & Advisories

   CVE-2026-76466 ↗View on Security Feed

   

7. LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

   News The Hacker News22 Oct4 sources

   LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.

   Read more

   Also in SecurityWeek Bleeping Computer Dark Reading

   View on Security Feed

   

8. Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability

   News Cyber Security News6h ago3 sources

   Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM. The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component. Oracle rates exploitation as low complexity, with no authentication or user interaction required…

   Read more

   Also in CCCS Alerts & Advisories Tenable Blog

   CVE-2026-91403 ↗View on Security Feed

   

9. ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

   News The Hacker News19h ago4 sources

   This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed

   Read more

   Also in The Register Security CCCS Alerts & Advisories Bleeping Computer +1

   View on Security Feed

   

10. CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

    News The Hacker News21 Oct4 sources

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)

    Read more

    Also in CISA Alerts & Advisories CISA Alerts & Advisories CISA Alerts & Advisories +3

    View on Security Feed

    

Vulnerability watch what to look at, most urgent first

Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed