Saturday, October 24, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Linux 203
- WordPress 1 critical 21
- Microsoft 1 critical 20
- Zimbra 16
- CGM 11
- Apple 11
- Unknown 11
- intranda 3 critical 10
- Eclipse Foundation 9
- Google 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell . PHP RCE Vulnerabilities Both flaws involve PHP’s…
Also in Cisco Security Advisories Palo Alto Unit 42 CCCS Alerts & Advisories +3
-
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may compound — not contain — the risk.
Also in Bleeping Computer Bleeping Computer Infosecurity Magazine +3
-
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
Also in Cyber Security News SecurityWeek Bleeping Computer +2
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were “now being broadly exploited in the wild.” Read full article Comments
Also in Bleeping Computer The Register Security Infosecurity Magazine +3
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Also in The Hacker News The Register Security CCCS Alerts & Advisories +2
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as "Linus Torvalds Turns to Slop." In the podcast Pivot to AI, podcaster David Gerard agreed: "Linux kernel goes full AI slop code." Meanwhile, in the Tom's Hardware comments section, commenter "LordVile" wrote: "This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage." They followed this by saying this is the "same reason he's flipped-flopped on AI." I've…
Also in The Hacker News CISA Alerts & Advisories CISA Alerts & Advisories +2
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Also in Microsoft Security Microsoft Security The Hacker News +2
CVE-2026-102208 ↗CVE-2026-61359 ↗CVE-2026-83862 ↗View on Security Feed
-
Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values. An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an…
Also in Wiz Research
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
-
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our tale comes courtesy of red team and pen testing specialist Dahvid Schloss, who currently serves as COO of Suzu Labs, a cybersecurity company that boasts “we break your systems before adversaries do.” Over a…
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-53942 | infrastructureconda | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isConda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/u… Attack
Exploitation
|
|||||||||
| CVE-2026-115889 | wasmtimebytecodealliance | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isWasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wa… Attack
Exploitation
|
|||||||||
| CVE-2026-115893 | wasmtimebytecodealliance | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isWasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditio… Attack
Exploitation
|
|||||||||
| CVE-2026-115931 | postiz-appGitroomHQ | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isPostiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be rea… Attack
Exploitation
|
|||||||||
| CVE-2026-63244 | Learning Management SystemWizLearn Technologies Pte. Ltd. | Critical | 9.8 | 0.5% | — | None linked | — | EPSS 0.5%CVSS 9.8No fix linked | |
What it isAn authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially craf… Attack
Exploitation
|
|||||||||
| CVE-2026-112862 | Participants Databasexnau webdesign | Critical | 9.8 | 0.3% | — | None linked | — | EPSS 0.3%CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5. Attack
Exploitation
|
|||||||||
| CVE-2026-25784 | BlueSpiceHallo Welt! GmbH | Critical | 9.8 | 0.3% | — | None linked | — | EPSS 0.3%CVSS 9.8No fix linked | |
What it isInitialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's Local… Attack
Exploitation
|
|||||||||
| CVE-2026-112846 | Save LifeThemeREX Group | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. Attack
Exploitation
|
|||||||||
| CVE-2026-112847 | ZenSoulThemeREX | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. Attack
Exploitation
|
|||||||||
| CVE-2026-112848 | Hostme v2AivahThemes | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.