{"date_iso":"2026-10-23","date_human":"Friday, October 23, 2026","generated_utc":"2026-10-23 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP","link":"https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php","reason":"CVE-2026-109618","category":"Research","sources":["CCCS Alerts & Advisories","CISA Alerts & Advisories","Cisco Security Advisories","CyberScoop","Elastic Security Labs","Fortinet PSIRT","Huntress","Kaspersky Securelist","NCSC UK","Palo Alto Unit 42","Rapid7 Blog","Recorded Future Intelligence","SANS Internet Storm Center","Sophos Threat Research","Tenable Blog"],"coverage":15,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a\u2026","source":"Rapid7 Blog","date_rel":"21 Oct","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt65a432ba319f4043/6846abddaf18306debe6cf4d/ETR.webp","description":"Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk\u2026","related":[{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"13h ago"},{"title":"Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)","link":"https://isc.sans.edu/diary/rss/33440","source":"SANS Internet Storm Center","date_rel":"21 Oct"},{"title":"AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619","link":"https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619","source":"CCCS Alerts & Advisories","date_rel":"21 Oct"},{"title":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619","link":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","source":"Palo Alto Unit 42","date_rel":"21 Oct"},{"title":"Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)","link":"https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/","source":"Kaspersky Securelist","date_rel":"21 Oct"},{"title":"PHP releases emergency fixes for 2 critical vulnerabilities","link":"https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/","source":"CyberScoop","date_rel":"21 Oct"}]},{"title":"AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack","link":"https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack","reason":"Microsoft","category":"News","sources":["Cisco Talos","CyberScoop","Dark Reading","Huntress","Infosecurity Magazine","The Hacker News","The Record","The Register Security"],"coverage":8,"cve_ids":[],"summary":"Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply \u2014 not contain \u2014 the risk.","source":"Dark Reading","date_rel":"1h ago","thumbnail":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt521637665481bcc9/65dfe9cfea879b040a14fbb9/policerobot-Agencja_Fotograficzna_Caro-alamy.jpg?width=720&quality=80&disable=upscale","description":"","related":[{"title":"Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise","link":"https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack","link":"https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack","source":"Dark Reading","date_rel":"16h ago"},{"title":"Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents","link":"https://therecord.media/china-cyber-connectwise-ai","source":"The Record","date_rel":"20h ago"},{"title":"M365 Token Spray and Replay Campaign Compromises Business Email Accounts","link":"https://www.huntress.com/blog/token-replay-spray","source":"Huntress","date_rel":"23h ago"},{"title":"Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants","link":"https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687","source":"The Register Security","date_rel":"22 Oct"},{"title":"Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants","link":"https://www.infosecurity-magazine.com/news/microsoft-chinese-ai-connectwise/","source":"Infosecurity Magazine","date_rel":"22 Oct"}]},{"title":"Hackers got a four-day head start on epic PHP2Shell vulnerability","link":"https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/","reason":"Amazon","category":"Media","sources":["Ars Technica Security","Bleeping Computer","Dark Reading","Huntress","Infosecurity Magazine","Malwarebytes Labs","The Hacker News","The Register Security","Wired Security"],"coverage":9,"cve_ids":[],"summary":"Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being \u201cbroadly exploited\u201d as governments and companies rush to secure their systems\u2026","source":"Ars Technica Security","date_rel":"21h ago","thumbnail":"https://cdn.arstechnica.net/wp-content/uploads/2022/03/internet-routing-500x500.jpeg","description":"Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being \u201cbroadly exploited\u201d as governments and companies rush to secure their systems. The world\u2019s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were \u201cnow being broadly exploited in the wild.\u201d Read full article Comments","related":[{"title":"Amazon says PHP2Shell exploitation began 4 days before patches","link":"https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/","source":"Bleeping Computer","date_rel":"23h ago"},{"title":"Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure","link":"https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749","source":"The Register Security","date_rel":"22 Oct"},{"title":"PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure","link":"https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/","source":"Infosecurity Magazine","date_rel":"22 Oct"},{"title":"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","link":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","link":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","source":"Wired Security","date_rel":"22 Oct"},{"title":"Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware","link":"https://www.huntress.com/blog/amazon-clickfix-finger","source":"Huntress","date_rel":"21 Oct"}]},{"title":"Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches","link":"https://www.theregister.com/columnists/2026/10/23/torvalds-ai-is-fine-for-competent-devs-but-spare-us-the-drive-by-patches/5304357","reason":"Linux","category":"News","sources":["CISA Alerts & Advisories","CISA ICS Advisories","Microsoft Security","The Hacker News","The Register Security"],"coverage":5,"cve_ids":["CVE-2026-102204"],"summary":"Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as \"Linus\u2026","source":"The Register Security","date_rel":"1h ago","thumbnail":"https://image.theregister.com/?imageId=5226908&width=800","description":"Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as \"Linus Torvalds Turns to Slop.\" In the podcast Pivot to AI, podcaster David Gerard agreed: \"Linux kernel goes full AI slop code.\" Meanwhile, in the Tom's Hardware comments section, commenter \"LordVile\" wrote: \"This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage.\" They followed this by saying this is the \"same reason he's flipped-flopped on AI.\" I've\u2026","related":[{"title":"Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","link":"https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html","source":"The Hacker News","date_rel":"19h ago"},{"title":"Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 TM MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11","source":"CISA ICS Advisories","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 TM MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16","source":"CISA ICS Advisories","date_rel":"22 Oct"},{"title":"CVE-2026-102204 Windows Subsystem for Linux Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102204","source":"Microsoft Security","date_rel":"20 Oct"}]},{"title":"Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched Systems","link":"https://cybersecuritynews.com/hackers-use-new-blackx-bootkit/","reason":"Windows","category":"News","sources":["Cyber Security News","Huntress","Microsoft Security","The Hacker News"],"coverage":4,"cve_ids":["CVE-2026-61359","CVE-2026-69902","CVE-2026-83709"],"summary":"A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The malware targets Secure Boot, a feature designed to help stop\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Use-New-BlackX-Bootkit-to-Bypass-Windows-Secure-Boot-on-Fully-Patched-Systems.webp","description":"A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The malware targets Secure Boot, a feature designed to help stop untrusted software from running before Windows starts. Researchers say the infected computers had received Windows updates, but a key Secure Boot protection had not been fully applied. Securelist analysts reported the findings on October 22, 2026. They say BlackX uses Baton Drop, a vulnerability tracked as CVE-2022-21894, and shares parts of its design with the BlackLotus bootkit\u2026","related":[{"title":"OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL","link":"https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61359","source":"Microsoft Security","date_rel":"21 Oct"},{"title":"CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83709","source":"Microsoft Security","date_rel":"21 Oct"},{"title":"CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69902","source":"Microsoft Security","date_rel":"21 Oct"},{"title":"Attack Reduction in Huntress Managed ESPM: Disrupting ClickFix","link":"https://www.huntress.com/blog/espm-attack-reduction-clickfix","source":"Huntress","date_rel":"21 Oct"}]},{"title":"Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks","link":"https://cybersecuritynews.com/critical-cisco-expressway-vulnerability/","reason":"Cisco","category":"News","sources":["CCCS Alerts & Advisories","Cyber Security News","The Register Security","Zero Day Initiative"],"coverage":4,"cve_ids":["CVE-2026-76466"],"summary":"Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root. Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8\u2026","source":"Cyber Security News","date_rel":"8h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Critical-Cisco-Expressway-Vulnerability-Enables-Remote-Code-Execution-Attacks.webp","description":"Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root. Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026. The issue affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and hardware appliances are affected when running vulnerable software with clustering enabled. Successful exploitation could give attackers\u2026","related":[{"title":"IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall","link":"https://www.theregister.com/security/2026/10/22/it-department-and-auditors-at-major-pharmacy-chain-got-into-a-rip-roaring-fight-about-using-password-on-cisco-firewall/5304592","source":"The Register Security","date_rel":"22 Oct"},{"title":"ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-788/","source":"Zero Day Initiative","date_rel":"22 Oct"},{"title":"Cisco security advisory (AV26-1073)","link":"https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1073","source":"CCCS Alerts & Advisories","date_rel":"21 Oct"}]},{"title":"LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release","link":"https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html","reason":"Github","category":"News","sources":["Bleeping Computer","Dark Reading","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"LiteLLM on Wednesday disclosed that threat actors compromised \"multiple independent security controls\" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21\u2026","source":"The Hacker News","date_rel":"22 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiEKKMESHBCMBHXA8Yf_clmAeFQXSdaKTEz0t_6RDzj1zXcwiPxA4gy2MPmftM6vyCkoG7OsCZJ2a8t7xJe1qbn3tEWRZfVgStzQVJy0ZfwEkjhg6-A34iT3XnQG7nYku04cWbIaHwkQmuDVghCeJBx5xJcbtozsyD3Genw4wyxFtgWIVD-rRGRLMBKoq2/s1600/litellm-breach.jpg","description":"LiteLLM on Wednesday disclosed that threat actors compromised \"multiple independent security controls\" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.","related":[{"title":"LiteLLM Compromised in Fresh Supply Chain Attack","link":"https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/","source":"SecurityWeek","date_rel":"4h ago"},{"title":"Machine speed attacks require machine speed detection and response","link":"https://www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors","link":"https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-compromise-glassworm-threat-actors","source":"Dark Reading","date_rel":"21 Oct"}]},{"title":"Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability","link":"https://cybersecuritynews.com/emergency-java-update/","reason":"Oracle","category":"News","sources":["CCCS Alerts & Advisories","Cyber Security News","Tenable Blog"],"coverage":3,"cve_ids":["CVE-2026-91403"],"summary":"Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Java-Security-Update.webp","description":"Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM. The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle\u2019s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component. Oracle rates exploitation as low complexity, with no authentication or user interaction required\u2026","related":[{"title":"Oracle Corporation security advisory (AV26-1071)","link":"https://cyber.gc.ca/en/alerts-advisories/oracle-corporation-security-advisory-av26-1071","source":"CCCS Alerts & Advisories","date_rel":"21 Oct"},{"title":"Oracle October 2026 Critical Patch Update Addresses 1209 CVEs","link":"https://www.tenable.com/blog/oracle-october-2026-critical-patch-update-addresses-1209-cves","source":"Tenable Blog","date_rel":"20 Oct"}]},{"title":"ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More","link":"https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html","reason":"Gitlab","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of\u2026","source":"The Hacker News","date_rel":"19h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjt9NuQgzmDAqircHtb2OEO9jXuNXIfpmc6cywt44gLVoKRSyrTtwqh2DaQkZ_BCrux5hLbZ9-uU9fR7Q6oFE7cjYOJB6aF1zqIJrrgT9A5RVRZguNYHZCk7-LBEAY7GxyR9KoCwwdPF9UowRvnZBvSN4X24RJXEQBRg3F1Mi5ktvXfNWWsUXlVnHLUmYd6/s1600/threatsday-oct-main.jpg","description":"This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed","related":[{"title":"Max-severity GitLab bug allows remote code execution over 12 years of releases","link":"https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854","source":"The Register Security","date_rel":"19h ago"},{"title":"GitLab security advisory (AV26-1074)","link":"https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1074","source":"CCCS Alerts & Advisories","date_rel":"22 Oct"},{"title":"GitLab warns of new max severity code execution vulnerability","link":"https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/","source":"Bleeping Computer","date_rel":"22 Oct"},{"title":"Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases","link":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","source":"The Hacker News","date_rel":"21 Oct"}]},{"title":"CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws","link":"https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html","reason":"Siemens","category":"News","sources":["CCCS Alerts & Advisories","CISA Alerts & Advisories","CISA ICS Advisories","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server\u2026","source":"The Hacker News","date_rel":"21 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNWLuogjq0EVRQo6oTMUucF21anDW9Jpvs5w98qm-I6hOqH4fU1ZeHA1DqNilI_drxE548BnZD4vkXfB3KmWXAm4xfU3KU3j38LI-ZXhB03kZy4rWc9qiQqSED6vVjxihA1-uM_46qlXjjDchlvKmtgFG-ym3oosqXFEED6w2mG_Zb-yHjq4IIPcFDeX13/s1600/cisa-patch.jpg","description":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)","related":[{"title":"Siemens SIMATIC S7 Webserver API","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens APOGEE, TALON and Desigo PXC/PXM Products","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens RUGGEDCOM CROSSBOW","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens Industrial Edge App Publisher","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02","source":"CISA ICS Advisories","date_rel":"22 Oct"},{"title":"Siemens Software Center","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03","source":"CISA ICS Advisories","date_rel":"22 Oct"},{"title":"Siemens Capital Embedded AR Classic","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04","source":"CISA ICS Advisories","date_rel":"22 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-101809","vendor":"Oracle","product":"Workflow","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netw\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-101809"},{"id":"CVE-2026-81212","vendor":"IBM","product":"DataStage on Cloud Pak for Data","severity":"CRITICAL","score":10.0,"description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poi\u2026","cwe":"CWE-285","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7289603"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-81212"},{"id":"CVE-2026-87337","vendor":"Oracle","product":"Oracle Access Manager","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-87337"},{"id":"CVE-2026-91216","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91216"},{"id":"CVE-2026-91221","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91221"},{"id":"CVE-2026-91231","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with net\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91231"},{"id":"CVE-2026-91299","vendor":"Oracle","product":"JD Edwards EnterpriseOne Orchestrator","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthent\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91299"},{"id":"CVE-2026-113744","vendor":"Tenda","product":"AC19","severity":"CRITICAL","score":10.0,"description":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argumen\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/henrythekingofuk/TendaCVE","https://vuldb.com/cve/CVE-2026-113744","https://vuldb.com/submit/1018542"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-113744"},{"id":"CVE-2026-105312","vendor":"Red Hat","product":"StreamsHub Console for Apache Kafka\u00ae","severity":"CRITICAL","score":9.9,"description":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding t\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://access.redhat.com/security/cve/CVE-2026-105312","https://bugzilla.redhat.com/show_bug.cgi?id=2510863"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-105312"},{"id":"CVE-2026-113389","vendor":"DrayTek","product":"Vigor2960","severity":"CRITICAL","score":9.9,"description":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectionty\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection","https://vuldb.com/cve/CVE-2026-113389","https://vuldb.com/submit/992223"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-113389"}],"vendor_spikes":[{"vendor":"Oracle","count":1080,"critical_count":64},{"vendor":"Google","count":359,"critical_count":29},{"vendor":"WordPress","count":58,"critical_count":0},{"vendor":"apostrophecms","count":31,"critical_count":0},{"vendor":"totolink","count":30,"critical_count":30},{"vendor":"Eclipse Foundation","count":29,"critical_count":1},{"vendor":"triggerdotdev","count":28,"critical_count":0},{"vendor":"Advantech","count":24,"critical_count":0},{"vendor":"Unknown","count":23,"critical_count":1},{"vendor":"curl","count":23,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":18,"new_cve_count":1997,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-109618":{"anchor":"#dev-1","rank":1,"coverage":15},"CVE-2026-109619":{"anchor":"#dev-1","rank":1,"coverage":15},"CVE-2026-102204":{"anchor":"#dev-4","rank":4,"coverage":5},"CVE-2026-61359":{"anchor":"#dev-5","rank":5,"coverage":4},"CVE-2026-69902":{"anchor":"#dev-5","rank":5,"coverage":4},"CVE-2026-83709":{"anchor":"#dev-5","rank":5,"coverage":4},"CVE-2026-76466":{"anchor":"#dev-6","rank":6,"coverage":4},"CVE-2026-91403":{"anchor":"#dev-8","rank":8,"coverage":3}}}