Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: This Security Alert addresses CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as PHP2Shell, allow for unauthenticated remote code execution in PHP. Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become…
Recently, I had to extract embedded files from a set of OneNote files (extension .one). My onedump.py tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to my onedump.py tool: producing JSON data. Several of my tools already have such a feature: they produce JSON data with the content of their analysis results. onedump's option --jsonoutput produces JSON output with the content of each embedded file found inside the OneNote file. And…
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts. [...]
Wireshark Release Candidate 5.0.0 was published: soon we can expect a new major version of Wireshark. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
YARA-X's 1.22.1 is a bugfix version, it brings 2 bugfixes. Notice that there was also a release of YARA: 4.6.0, and that this release does not include the YARA-X improvement that adds built-in functions to read 64-bit integers: int64, int64be, uint64, and uint64be. This shows that YARA-X has replaced YARA. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Une vulnérabilité a été découverte dans Stormshield Management Center. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads. Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad. The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. As a courtesy, the security fixes were backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in…
On October 29, 2026, we released versions 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. This patch release does not include any security fixes. GitLab Community Edition and Enterprise Edition 19.5.3 [Backport 19.5] Distrust compromised eMudhra CA certificates Bump Go to 1.27.3 [19.5] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3 Backport of ‘Stop jobs…
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]
On October 27, Google issued a new Stable channel update for Chrome. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. The update includes 52 security fixes, including four rated Critical. On the same day, Mozilla issued Security Advisory 2026-118, which fixes 167 vulnerabilities. Firefox 159 also introduces several new features. Both updates will roll out over the coming days and weeks. How…
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 52 nuove vulnerabilità di sicurezza, di cui 4 con gravità “critica” e 46 con gravità “alta”.
Aikido launches external network pentesting: AI agents attack your internet-facing systems from the outside and report only findings they actually exploit. Category: Company Updates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]
Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio Mon, 10/26/2026 - 13:03 Aviso Affected Resources Gym Management Software, versions prior to v6.0.85. Description INCIBE has coordinated the publication of a medium severity vulnerability affecting Gym Management Software IsMyGym by Zuinq Studio, software for managing sports centers, gyms, and trainers. The vulnerability was discovered by Gonzalo Aguilar García (6h4ack). This vulnerability has been assigned the following code,…
Microsoft is building a way for EDR products to run outside the Windows kernel. It is called the Windows Endpoint Security Platform, and two of its binaries already ship in Windows Insider build. One is the kernel driver wesp.sys, the other the user-mode API espclient.dll. Microsoft wants one kernel driver it maintains itself, in place of the one every security vendor currently ships, after the July 2024 CrowdStrike update crashed 8.5 million machines. WESP is undocumented, but the binaries…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: Fortinet has released a coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer following recent releases from FortiMail and FortiAuthenticator. They strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices. These releases include fixes to address vulnerabilities…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073, Summary: This security release includes the following dependency updates to address public vulnerabilities: c-ares on 26.x, 24.x, 22.x ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x OpenSSL on 24.x, 22.x SQLite on 22.x Undici…
Serial Number: AV26-1075 Date: October 22, 2026 As of October 19, 2026, Roundcube is affected by vulnerabilities in the following product: Roundcube Webmail Prior to 1.6.20 Prior to 1.7.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security updates 1.6.20 and 1.7.5 released Roundcube Open Source Webmail Software
Serial Number: AV26-1074 Date: October 22, 2026 As of October 21, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Community Edition (CE) and Enterprise Edition (EE) Prior to 18.11.13 Prior to 19.0.10 Prior to 19.1.9 Prior to 19.2.9 Prior to 19.3.6 Prior to 19.4.3 Prior to 19.5.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GitLab Critical Patch Release: 19.5.1, 19.4.3,…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-97206, CVE-2026-50106, CVE-2026-96405, CVE-2026-109125, CVE-2026-35501, Summary: Several vulnerabilities were found in Unbound. We are releasing 1.26.2 as a security release today (October 21) including the relevant fixes. The overview of the vulnerabilities with a brief description is: CVE-2026-97206 - severity: HIGH DoQ path-migration can lead to use-after-free on multi-threaded…
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. [...]
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787. As part of…
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.
Splunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.
Splunk addressed multiple vulnerabilities in Splunk SOAR version 8.7.0. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Build identity resilience with Identity Posture Assessment, an on-demand Microsoft 365 report that scores your identity defenses and shows how fast you can fix the gaps.
Attackers may be in your tenant before you connect it. Huntress Managed ITDR Lookback reviews 180 days of Microsoft 365 logins & our SOC acts on active incidents.
Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes. Category: Company Updates
Agents are rapidly becoming part of how work gets done. They can support a range of activities from writing code and researching products to analyzing revenue, processing expenses, and acting across the systems that run the business. To be most useful, they often need access to company data, applications, tools, and other agents. That access is what makes agents more capable. With that capability can come insider risk. This does not mean agents are inherently malicious. It means they are…
Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: Compliance
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-110151, CVE-2026-110922, CVE-2026-110144, CVE-2026-110159, CVE-2026-110166, CVE-2026-110172, CVE-2026-110913, CVE-2026-110918, CVE-2026-110919, CVE-2026-110921, Summary: The Extended Stable channel has been updated to 152.0.7977.169 for Windows and Mac which will roll out over the coming days/weeks. There are 10 security fixes.
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-110922, CVE-2026-110913, CVE-2026-110919, CVE-2026-110918, CVE-2026-110917, CVE-2026-110921, CVE-2026-110920, CVE-2026-110916, CVE-2026-110915, CVE-2026-110914, Summary: The Stable channel has been updated to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 to Linux which will roll out over the coming days/weeks. This update includes 10 security fixes.
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 10 nuove vulnerabilità di sicurezza, di cui 1 con gravità “critica” e 6 con gravità “alta”.
On October 13 and 14, Google issued several Chrome updates. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The update includes 37 security fixes, including seven rated Critical. On the same day, Google released version 155.0.8059.79 for Android. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it also includes stability and performance…
Maybe it’s a text saying your package couldn’t be delivered, with a link to reschedule. Or an email from your bank asking you to verify your account. Or perhaps it’s an invitation from someone you know to view a document. The message looks real enough, but something about the link feels fishy. Do you click it? Malwarebytes Scam Link Check is a new free tool that lets you check a suspicious link before you click. Simply paste the link into Scam Link Check, and Malwarebytes will scan it for signs…
TruConfidence: The AI-Powered Remediation Intelligence & Orchestration engine powering TruRisk Eliminate 2.0 delivers autonomous remediation at scale with proof at every step. Executive Summary Vulnerabilities are now discovered faster than enterprises can remediate them. Patch automation has been around for years, but vulnerability backlogs are still growing. Automation isn’t the bottleneck. Confidence is: without evidence of how a change will behave, Security and IT teams hold back, and the…