Reporting Period: October 17, 2026 – October 23, 2026

Threat Landscape

1. PHP Critical Remote Code Execution Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)

Overview

• Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, have been announced with a CVSS v4.0 score of 9.2.
• The vulnerabilities affect PHP versions from PHP 5 onwards.
• Full technical details and patches are scheduled for public disclosure on 21 October 2026.
• No active exploitation reported at the time of advisory.

Impact

• Remote code execution potential due to critical flaws in widely deployed PHP runtimes.
• Risks to internet-facing and internal systems running vulnerable PHP versions.
• Possible unauthorized access and compromise of business-critical applications.

Affected / Fixed Versions

• Specific affected and fixed versions will be confirmed upon official release on 21 October 2026.

Recommendations

• Conduct comprehensive inventory of PHP installations and dependent applications across the organization.
• Prioritize identification of internet-facing systems and business-critical applications.
• Prepare for emergency patching: create backups, test environments, and deployment plans.
• Monitor official PHP releases for validated fixes and detailed technical advisories.
• Apply security patches immediately after official release, verifying via version checks and vulnerability scanning.
• Restart or reload PHP services and rebuild container images where applicable.
• Implement temporary mitigations if immediate patching is not possible, including restricting access, reducing system exposure, enforcing strict access controls, updating WAF and proxy configurations, and increasing monitoring.
• Enhance SOC and incident response monitoring for unusual activity, including log review, process monitoring, network connections, file integrity, and authentication anomalies.
• Preserve forensic evidence if suspicious behaviour is detected.

Reference link: https://www.php.net/index.php#2026-10-20-1

2. Siemens Software Center DLL Sideloading Vulnerability CVE-2026-110936 Actively Exploited

Overview

• Siemens Software Center contains an uncontrolled search path (DLL sideloading) vulnerability.
• Authenticated local attackers can place a crafted DLL in a directory searched by the application.
• When loaded, the attacker gains code execution with the application’s privileges.
• CVE-2026-110936, severity High, CVSS v4.0 score 8.4.
• Actively exploited in the wild.

Impact

• Arbitrary code execution with application privileges.
• Possible compromise of system confidentiality, integrity, and availability.

Affected / Fixed Versions

• Affected: Siemens Software Center versions earlier than 4.0.9.8.
• Fixed: Siemens Software Center version 4.0.9.8 or later.

Recommendations

• Update all Siemens Software Center installations to version 4.0.9.8 or later immediately.
• Investigate indicators of compromise including unusual startup entries, Task Scheduler tasks, and suspicious files or folders related to SiemensSoftwareCenter.exe.
• Hunt for suspicious network connections to IP 96.62.218[.]59 and domain wizardexpensive[.]com, and review endpoint and network logs for related IoCs.
• Isolate affected systems if compromise is suspected and conduct incident response actions, removing persistence and resetting credentials as necessary.
• Use trusted sources for Siemens software downloads, avoid executing untrusted commands, and strengthen endpoint protection with least-privilege and EDR monitoring for anomalous DLL loads.

Reference link: https://cert-portal.siemens.com/productcert/html/ssa-580366.html

3. Google Chrome Multiple Memory Corruption and Use-After-Free Vulnerabilities, including CVE-2026-113341 (critical)

Overview

• Google released Chrome 156 updates for Windows, macOS, Linux, Android, and iOS addressing 353 security vulnerabilities.
• Vulnerabilities include memory corruption, use-after-free, improper input validation, and out-of-bounds reads across multiple browser components such as Skia, Accessibility, CSS, Paint, WebRTC, V8, ANGLE, SiteIsolation, GPU, and Bluetooth.
• Exploitation could lead to browser crashes, arbitrary code execution, or compromise of browser security depending on the specific flaw and execution context.

Impact

• Critical vulnerabilities include CVE-2026-113341 (memory corruption in Skia), CVE-2026-113279 (Accessibility), CVE-2026-113072 (CSS), CVE-2026-113280 (Paint), CVE-2026-113271 (use-after-free in Accessibility), and CVE-2026-113303 (WebRTC).
• High severity vulnerabilities affect V8 engine, ANGLE graphics library, SiteIsolation, GPU, WebRTC, and Bluetooth components, involving memory corruption, use-after-free, and out-of-bounds read issues.

Affected / Fixed Versions

• Fixed in Chrome Stable Channel Desktop updates: 156.0.8078.47 for Linux, 156.0.8078.47/.48 for Windows and macOS.
• Chrome 156.0.8078.47 for Android.
• Chrome 156.0.8078.46 for iOS.

Recommendations

• Update Google Chrome to the latest stable version immediately to mitigate risks from these vulnerabilities.

Reference links:

• https://chromereleases.googleblog.com/
• https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

4. MariaDB Server Multiple Critical Vulnerabilities Including Use After Free and Out-of-Bounds Write (CVE-2026-92262, CVE-2026-85746, CVE-2026-85748)

Overview

• MariaDB disclosed seven security vulnerabilities affecting several supported release branches.
• Three vulnerabilities rated critical with CVSS 9.9: incorrect name resolution (CWE-706), out-of-bounds write (CWE-787), and use after free (CWE-416).
• Other vulnerabilities include high severity unverified password change (CWE-620), SQL injection (CWE-89), medium severity missing authorization (CWE-862), and buffer over-read (CWE-126).

Impact

• Exploitation can lead to unauthorized access, data corruption, or server compromise.
• Critical issues pose significant risk for production, cloud, and multi-tenant environments.

Affected / Fixed Versions

• Upgrade recommended versions:
• 10.6 to 10.6.28
• 10.11 to 10.11.19
• 11.4 to 11.4.13
• 11.8 to 11.8.9
• 12.3 to 12.3.3
• 13.0 to 13.0.2

Recommendations

• Apply corresponding security patches to affected MariaDB versions immediately.
• Validate the chosen release is supported for the specific deployment.
• If patching cannot be done promptly, implement compensating controls with assigned oversight.

Reference links:

• https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
• https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
• https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
• https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
• https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
• https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
• https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h

5. F5 and Red Hat HTTP Method Override Abuse Enables WAF Bypass (CVE-2026-37236)

Overview

• Threat actors exploit inconsistencies between HTTP method inspection at perimeter security devices (WAFs, proxies, API gateways) and backend applications by abusing the ‘X-HTTP-Method-Override’ header.
• This technique allows bypassing method-based access controls when perimeter devices evaluate the original HTTP method (typically allowed methods like POST) but backend services rewrite and process the request using the overridden method (e.g., DELETE, PATCH).
• Documented in deployments using grpc-gateway, where request routing decisions occur after method rewriting.
• Multiple frameworks and proxies support HTTP method tunneling headers originally designed for HTTP method limitations, but attackers leverage these for defense evasion.

Impact

• Bypass of method restrictions enforced by perimeter security tools.
• Unauthorized access to restricted backend functionality.
• Execution of operations blocked by security controls based on HTTP method filtering.
• Potential circumvention of defenses such as WAFs and reverse proxies that rely solely on request line method inspection.

Affected / Fixed Versions

• Specific versions are not detailed; however, Red Hat documentation references CVE-2026-37236 related to HTTP method rewriting vulnerabilities.

Recommendations

• Detect and monitor requests containing method override headers such as ‘X-HTTP-Method-Override’, ‘X-Method-Override’, and related variants.
• Prioritize detection of POST requests employing override headers with restricted methods (DELETE, PATCH, PUT, OPTIONS).
• Correlate WAF/proxy logs with backend application logs to identify mismatches between observed and effective HTTP methods.
• Detect form-urlencoded POST requests combined with override headers and monitor OPTIONS requests using override headers for tunneling attempts.
• Monitor for 403-to-200 response patterns indicating access control bypass via method override.
• Instrument applications to log both original HTTP methods and effective methods after override processing.
• Review applications and APIs for dependence on HTTP method override functionality and disable it where not required.
• In F5 environments, remove ‘X-HTTP-Method-Override’ header before requests reach backends using iRules or equivalent mechanisms.
• Ensure consistent enforcement of method-based access controls across all security components and backend services.
• Validate any configuration changes in testing environments before production deployment.
• Review and implement vendor guidance from F5, Red Hat, and related advisories to mitigate risks.

Reference links:

https://my.f5.com/manage/s/article/K000163578

https://access.redhat.com/security/cve/cve-2026-37236

https://blakeellis.dev/blog/X-HTTP-Method-Override-WAF-Bypass

6. ASUS Router Firmware Denial-of-Service and Information Exposure Vulnerabilities CVE-2026-17518 (CVSS 8.2) and CVE-2026-75753

Overview

• Two vulnerabilities affect certain ASUS router firmware versions.
• Exploitation requires adjacent network access.
• Successful attacks may cause denial-of-service (DoS), disrupt router operations, and potentially allow limited device information disclosure or alteration of the device’s operating state.

Impact

• High severity DoS and operational disruption (CVE-2026-17518, CVSS 8.2).
• Medium severity information exposure and device state alteration (CVE-2026-75753, CVSS 5.3).

Affected / Fixed Versions

• Firmware series 3.0.0.4_386 and 3.0.0.4_388 are affected.

Recommendations

• Immediately update router firmware to the latest version available from the official ASUS support portal.

Reference link: https://www.asus.com/security-advisory

7. Drupal Core Field UI Remote Code Execution Vulnerability CVE-2026-108097 (Critical)

Overview

• A critical remote code execution vulnerability affecting the Field UI module in Drupal Core allows arbitrary code execution under certain conditions.
• Exploitation requires vulnerable contributed modules or custom code exposing the flaw; at least one unauthenticated attack path exists.
• No public exploit code or development documentation was available at the time of disclosure.

Impact

• Unauthorized remote code execution.
• Potential full website compromise, including data and functionality.

Affected / Fixed Versions

• Affected:
• Drupal >= 8.9.0 < 10.6.19
• Drupal >= 11.0.0 < 11.3.19
• Drupal >= 11.4.0 < 11.4.10
• Drupal >= 12.0.0-alpha1 < 12.0.0-beta2
• Fixed:
• Drupal 10.6.19 and later supported releases
• Drupal 11.3.19 and later supported releases
• Drupal 11.4.10 and later supported releases

Recommendations

• Immediately apply the relevant security updates to mitigate the vulnerability.
• Review contributed modules and custom code for exposure to the vulnerable Field UI functionality.

Reference link: https://www.drupal.org/sa-core-2026-014

8. Apache Kylin SQL Injection CVE-2026-64959 and Apache Airflow SSH Host-Key Verification CVE-2026-94134

Overview

• Apache Kylin contains a critical SQL injection vulnerability due to a backend cache API lacking required authentication, enabling execution of injected SQL statements.
• Apache Airflow SSH provider packages have a critical weakness in SSH host-key verification.
• Additional issues include code injection via JDBC connection parameters, OS command injection through Spark jobs, unsafe Java deserialization, and insufficient access controls in these projects.

Impact

• Successful exploitation of Apache Kylin CVE-2026-64959 could lead to remote SQL injection attacks, compromising data integrity and confidentiality.
• Apache Airflow SSH provider vulnerability CVE-2026-94134 allows attackers to bypass SSH host-key verification, increasing risk of man-in-the-middle attacks.

Affected / Fixed Versions

• Apache Kylin 5.0.0 through 5.0.4 are affected by CVE-2026-64959; fixed in 5.0.5.
• Airflow SSH and SFTP providers before 7.0.0 are affected; fixed in 7.0.0.
• Airflow Keycloak provider before 0.11.1 is affected; fixed in 0.11.1.

Recommendations

• Patch Apache Kylin to version 5.0.5 and restrict access to vulnerable APIs until patched.
• Upgrade Airflow SSH and SFTP providers to 7.0.0 and enforce strict host-key verification for secure credential workflows.
• Upgrade Airflow Keycloak provider to 0.11.1 and ensure proper session termination validation.

Reference links:

• https://nvd.nist.gov/vuln/detail/cve-2026-64959
• https://nvd.nist.gov/vuln/detail/cve-2026-94134

9. Dell Wyse Management Suite Cross-Site Scripting Vulnerabilities Including Critical CVE-2026-82158 (CVSS 9.0)

Overview

• Multiple cross-site scripting (XSS) vulnerabilities identified in Dell Wyse Management Suite.
• Vulnerabilities allow low-privileged attackers with remote access to inject scripts.
• Potential impact includes compromise of confidentiality, integrity, and availability of affected systems.

Impact

• CVE-2026-82158: Critical severity, CVSS 9.0, remote attacker can inject scripts and impact system security.
• CVE-2026-82159: High severity, CVSS 8.8, remote script injection risk.
• CVE-2026-82161: Medium severity, CVSS 6.8, remote script injection risk.
• CVE-2026-82160: Low severity, CVSS 3.3, local attacker can inject scripts with limited confidentiality impact.

Affected / Fixed Versions

• Affected: Dell Wyse Management Suite versions prior to 2609.0.0.155.
• Fixed: Version 2609.0.0.155 or later.

Recommendations

• Update Dell Wyse Management Suite to version 2609.0.0.155 or later to mitigate the vulnerabilities.

Reference link: https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities

10. Linux Kernel Networking Vulnerability PwnEscape CVE-2026-99999 Critical (CVSS 9.3)

Overview

• CVE-2026-99999, known as PwnEscape, is a critical vulnerability in the Linux kernel networking stack due to improper validation of checksum metadata.
• Exploitable by attackers inside virtual machines sending crafted packets to the host kernel network code.

Impact

• Disclosure of host memory from a guest VM.
• Host-level denial of service causing crashes and disruption of VM workloads.
• Potential virtual machine escape leading to code execution on the host and compromise of workload isolation.

Affected / Fixed Versions

• Fixed in: Linux kernel versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, and 7.2.11.

Recommendations

• Apply available security updates to upgrade host kernel versions to those listed above or vendor-patched releases.
• Reboot hosts after patching to ensure updated kernels are running.
• Prioritize patching virtualization infrastructure, including cloud hosts and hypervisors with vulnerable kernels.
• Confirm patch status with respective Linux distribution and cloud providers.
• Disable nested virtualization if not needed and enforce least-privilege policies on VM processes to reduce risk.
• Monitor host kernel logs and virtualization telemetry for signs of exploitation or abnormal guest-to-host activity.

Reference links:

https://nvd.nist.gov/vuln/detail/cve-2026-99999

https://pwn.ai/blog/pwnescape

11. BeyondTrust Remote Support unauthenticated remote file operation vulnerability CVE-2026-102764 actively exploited

Overview

• CVE-2026-102764 is a zero-day vulnerability in BeyondTrust Remote Support appliances allowing unauthenticated remote attackers to perform arbitrary file operations.
• The vulnerability enables host-level compromise, privilege escalation, credential theft, persistent access, and lateral movement within networks.
• The ARMORY CASTLE threat actor actively exploited this vulnerability using the SAWFLY PHP webshell and BARECLAW tunneler.
• Attackers modified appliance configuration files, harvested credentials from the BeyondTrust secrets vault, altered administrative permissions, and deleted logs to evade detection.

Impact

• Full host compromise and control of BeyondTrust Remote Support appliances.
• Credential theft leading to potential compromise of downstream systems.
• Persistent unauthorized access and network lateral movement.

Affected / Fixed Versions

• Affected: All supported BeyondTrust Remote Support versions up to and including version 26.2.3.
• Remote Support SaaS tenants patched as of October 9, 2026.
• Self-hosted deployments running version 24.3.1 or later: apply BT26-05-RS patch via appliance interface.
• Self-hosted deployments older than version 24.3.1: upgrade to supported version then apply the patch.
• Fixed by BT26-05-RS patch for versions 24.3.1 through 26.2.3.

Recommendations

• Apply the BT26-05 security patch immediately.
• Identify and assess all exposed appliances; treat potentially compromised systems as compromised until thoroughly investigated.
• Restrict external access by blocking unnecessary inbound connections, especially to administrative interfaces.
• Restrict outbound traffic to approved services only.
• Preserve forensic evidence-appliance snapshots, memory, disk, logs, and configuration data-before remediation or reboot.
• Coordinate with BeyondTrust Support for forensic preservation on hardware and SaaS deployments.

Reference link: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05

12. Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks

Overview

• Cisco disclosed a critical remote code execution vulnerability affecting Cisco Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) configured in clusters.
• The flaw resides in the database service and improper handling of persistent cookies and client certificates under TLS Verify Mode in clustering.
• An attacker with the required cookies and network access could execute operating system commands as root.

Impact

• Successful exploitation could give attackers root-level control over vulnerable Expressway devices.
• The flaw only affects clustered deployments; unclustered devices are not exposed by this specific issue.
• No public exploitation or malicious use has been reported as of the advisory date.

Affected / Fixed Versions

• Affected: Expressway X15.5.3 and earlier versions with clustering enabled.
• Fixed: Starting with Expressway X15.5.20; customers on X14 or earlier must upgrade to a fixed release.

Recommendations

• Confirm if devices are running vulnerable Expressway versions and configured as clusters.
• Apply security updates including Expressway X15.5.20 or later according to Cisco’s compatibility guidance.
• There are no known workarounds; patching is essential to mitigate risk.

Reference link: https://cybersecuritynews.com/critical-cisco-expressway-vulnerability/

13. Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR

Overview

• Splunk released security updates addressing 24 vulnerabilities in Splunk Enterprise and Splunk SOAR.
• Four critical flaws have CVSS scores ranging from 9.3 to 9.9, involving issues such as improper access control, improper neutralization, exposed files/directories, and remote code execution risks.
• Vulnerabilities affect access control, input handling, exposed files, denial of service, weak authorization, REST API authorization, field extraction, and more.

Impact

• Exploits could lead to unauthorized access, remote code execution, denial of service, information exposure, and disruption of security monitoring operations.
• Unauthenticated denial-of-service vulnerabilities can impact internet-facing systems.
• Compromised Splunk instances can weaken detection mechanisms and disrupt incident investigations.

Affected / Fixed Versions

• Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 and Splunk SOAR version 8.7.0 or later.
• Splunk Secure Gateway versions 3.10.12, 3.9.26, or 3.8.73.

Recommendations

• Apply the security updates promptly.
• Review exposed interfaces, user roles, and permissions.
• Disable unused Splunk Web, Pipeline Builders, Secure Gateway, or PostgreSQL sidecar features if patching cannot be immediate, after assessing dependencies.

Reference link: https://cybersecuritynews.com/splunk-fixes-24-security-flaws/

14. Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List

Overview

• Several unpatched security flaws in the Linux kernel related to the KSMBD SMB file server were accidentally disclosed on public mailing lists.
• Two critical remote code execution vulnerabilities with CVSS score 9.0 involve a race condition and an integer underflow in KSMBD.
• Additional vulnerabilities impact other kernel components, including local privilege escalation and information disclosure risks.
• The disclosures have raised concerns about premature public exposure of technical details before patches are available.

Impact

• Remote attackers could execute code on systems with KSMBD enabled.
• Local users may gain elevated privileges.
• Sensitive information could be exposed through uninitialized resources.
• Exposure depends on server configuration, particularly for SMB Direct and RDMA networking.

Recommendations

• Verify if KSMBD is enabled; disable it if not required to reduce risk.
• Restrict file-sharing services from untrusted networks and carefully manage share access.
• Monitor Linux vendor security advisories and apply patches as soon as they become available.
• Update malware defenses promptly and integrate threat intelligence feeds to enhance security operations.

Reference link: https://cybersecuritynews.com/linux-kernel-flaws-accidentally-disclosed/

15. Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Overview

• Arista Networks issued security updates addressing a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments.
• The vulnerability is actively exploited in the wild.

Impact

• Potential compromise of affected VCO On-Prem systems due to exploitation.

Recommendations

• Apply the latest security updates from Arista to mitigate the vulnerability.

Reference link: https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/

16. Multiple Cisco Products Snort 3 Security Hardening Release: October 2026

Overview

• Cisco’s Open Source Snort 3 Software team conducted a comprehensive internal security review.
• Multiple internally discovered vulnerabilities were identified, primarily involving out-of-bounds write issues categorized under CWE-787.
• These vulnerabilities have been grouped and assigned CVE identifiers, including CVE-2026-20043 and others.
• The vulnerabilities were found during internal testing and are not known to be actively exploited.

Impact

• The vulnerabilities are rated as critical security issues affecting Snort 3.
• There are no known workarounds for these vulnerabilities.

Affected / Fixed Versions

• Cisco has released software updates to address these vulnerabilities.

Recommendations

• Customers should apply the provided software updates promptly to mitigate risks.
• Monitor Cisco advisories for any additional information or follow-up advisories.

Reference link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Security%20Hardening%20Release:%20October%202026%26vs_k=1

17. Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities

Overview

• Multiple Cisco products using the Snort 3 Detection Engine are affected by vulnerabilities that allow an unauthenticated, remote attacker to trigger unexpected restarts of the detection engine.
• This causes a denial of service (DoS) condition impacting the affected systems.
• Cisco has released software updates addressing these issues.
• No workarounds are available to mitigate the vulnerabilities.

Impact

• Denial of service due to Snort 3 Detection Engine unexpected restarts.

Affected / Fixed Versions

• Specific product versions are not detailed in the advisory, but updates are available from Cisco.

Recommendations

• Apply Cisco’s released software updates promptly to mitigate the vulnerabilities.
• Monitor Cisco advisories for additional information and updates.

Reference link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Denial%20of%20Service%20Vulnerabilities%26vs_k=1

18. CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability

Overview

• A command injection vulnerability in Azure Pipelines allows unauthorized remote code execution due to improper neutralization of special elements used in commands.

Impact

• Enables attackers to execute arbitrary code over the network, compromising affected systems.

Recommendations

• Apply relevant security updates from Microsoft to mitigate the vulnerability.

Reference link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014

19. CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability

Overview

• Improper authentication vulnerability in Azure Active Directory (AAD) Application Proxy.
• Allows an unauthorized attacker to elevate privileges remotely over a network.

Impact

• Attackers can gain elevated privileges, potentially compromising affected systems.

Recommendations

• Apply security updates and patches provided by the vendor to mitigate the vulnerability.

Reference link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785

20. USN-8952-1: Tornado vulnerabilities

Overview

• Tornado web server improperly handles specific HTTP requests and network inputs.
• These issues could be exploited to cause denial of service, leak sensitive information, or bypass access controls.

Impact

• Potential denial of service.
• Exposure of sensitive data.
• Access control bypass.

Affected / Fixed Versions

• Not specified.

Recommendations

• Apply available security updates from Ubuntu as soon as possible.
• Monitor Tornado deployments and restrict access where feasible until patched.

Reference link: https://ubuntu.com/security/notices/USN-8952-1

21. GitLab warns of new max severity code execution vulnerability

Overview

• GitLab disclosed and patched a critical Regular Expression Compiler vulnerability.
• The flaw allows remote attackers to execute arbitrary code on vulnerable GitLab servers.

Impact

• Successful exploitation enables remote code execution, posing severe risk to affected systems.

Recommendations

• Apply the released security patches from GitLab immediately to mitigate the issue.

Reference link: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/

22. Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Overview

• Node.js released security updates for supported versions 22.x, 24.x, and 26.x addressing 10 vulnerabilities.
• The most critical flaw is a bug in the bundled Brotli decompression code.
• This vulnerability could enable remote code execution, allowing attackers to execute arbitrary code on affected systems.

Impact

• Potential for remote code execution on systems running vulnerable Node.js versions.

Affected / Fixed Versions

• Fixed versions are available for each supported release line: 22.x, 24.x, and 26.x.

Recommendations

• Update Node.js installations to the fixed versions immediately to mitigate the risk of exploitation.

Reference link: https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html

23. Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Overview

• Amazon’s Threat Intelligence team detected an exploit attempt targeting the newly disclosed PHP2Shell vulnerabilities on October 17, 2026.
• This attempt preceded the public disclosure and patch release for the PHP2Shell flaws.
• The exploit originated from an IP address linked to a commercial anonymization network.
• Following patch release, these PHP2Shell vulnerabilities have been broadly exploited in the wild.

Impact

• The vulnerabilities allow remote exploitation impacting PHP environments, enabling attackers to potentially execute arbitrary code.

Recommendations

• Apply the released patches immediately to mitigate exploitation.
• Monitor honeypot and network activity for exploitation attempts, especially from anonymized IP sources.

Reference link: https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html

24. USN-8890-2: libsoup vulnerabilities

Overview

• Multiple vulnerabilities were discovered in libsoup affecting Ubuntu operating systems, related to incorrect handling of HTTP/2 requests, HTTPS proxy connections, chunked HTTP requests, proxy authentication credentials, HTTP Range headers, and HTTP/2 transfers.
• These flaws could lead to denial of service, information disclosure, security control bypass, or arbitrary code execution by remote attackers.

Impact

• Denial of service attacks.
• Possible exposure of sensitive information.
• Potential bypass of security controls.
• Risk of arbitrary code execution.

Affected / Fixed Versions

• Issues affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
• The update provides fixes specifically for libsoup3 on Ubuntu 26.10.

Recommendations

• Apply the latest security updates to libsoup3 on Ubuntu 26.10.
• Ensure all affected Ubuntu versions are updated according to official advisories.

Reference link: https://ubuntu.com/security/notices/USN-8890-2

25. ‘PHP2Shell’ Bugs Signal Red Alert for Security Industry

Overview

• Two critical vulnerabilities in PHP have been leaked, prompting urgent remediation efforts by security teams.
• Exploitation attempts for these vulnerabilities have been reported in the wild.

Impact

• The vulnerabilities pose a significant risk to systems running PHP, potentially allowing attackers to execute malicious actions.

Recommendations

• Security teams should prioritize patching affected PHP systems immediately.
• Monitor for exploitation attempts and apply mitigations as advised by official PHP security bulletins.

Reference link: https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry

26. CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

Overview

• CISA warns of active exploitation of four vulnerabilities in Plex Media Server.
• Attackers chain these flaws in so-called Plex2Shell attacks to breach servers.

Impact

• Successful exploitation can lead to server compromise.

Recommendations

• Apply security patches from Plex as soon as possible.
• Monitor for suspicious activity related to Plex Media Server.

Reference link: https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/

27. USN-8951-1: c-ares vulnerabilities

Overview

• Multiple vulnerabilities in c-ares were discovered affecting various Ubuntu LTS versions.
• Issues include improper parsing of SOA replies, incorrect handling of sortlist strings, and inadequate validation of DNS compression pointers and record count fields.
• These flaws could allow remote attackers to cause crashes, denial of service, or potentially execute arbitrary code.

Impact

• Denial of service via crashes or resource exhaustion.
• Possible arbitrary code execution in Ubuntu 16.04 LTS due to sortlist string handling flaw.

Affected / Fixed Versions

• Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.

Recommendations

• Apply the security updates provided by Ubuntu to patch c-ares and mitigate these vulnerabilities.

Reference link: https://ubuntu.com/security/notices/USN-8951-1

28. The Science of Exploitability: Decoding BlueHammer

Overview

• BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011.
• The exploit requires an attacker to have standard-user code execution first; it does not provide initial access.
• It involves a sequence of techniques including CloudFilter callbacks, batch oplocks, symbolic links, Defender update RPC, offline SAM parsing, and SAMR operations.
• The exploit reached SYSTEM privileges, extracted domain administrator credentials from LSASS, and moved laterally via pass-the-hash in the lab environment.
• Exploitability depends on runtime factors such as Defender state, filter drivers, pending signature updates, and CloudFilter reachability, meaning an affected version does not guarantee exploitability.
• Qualys TruConfirm validates exploitability in customer environments using non-destructive testing that avoids harmful post-exploitation actions.

Impact

• Successful exploitation leads from standard user to NT AUTHORITY\SYSTEM privileges.
• Enables retrieval of sensitive credential material from LSASS.
• Allows domain controller access and potential domain compromise through credential abuse and lateral movement.

Affected / Fixed Versions

• Affected are Defender Antimalware Platform versions prior to 4.18.26030.3011.

Recommendations

• Validate system environments for exploitability conditions beyond version checks.
• Apply security patches that update the Defender platform to fixed versions.
• Utilize solutions capable of safe exploit validation to assess risk without destructive testing.

Reference link: https://blog.qualys.com/product-tech/2026/10/21/bluehammer-cve-2026-33825-windows-defender-privilege-escalation

29. Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days

Overview

• Rapid7 reports attackers exploit high-severity vulnerabilities on average within three days of public disclosure.
• 71% of exploitation occurs within seven days, and 90% within 30 days, highlighting a shrinking exploitation window.
• Q3 tracked 43 newly exploited high- and critical-severity vulnerabilities, 79% of which require no authentication or user interaction.
• AI was cited as an operational component in 8% of tracked threat activity, assisting with tactic selection and attack adaptation while humans retain control.
• The report stresses the need for prioritizing exposure, focusing on externally accessible assets and vulnerabilities actively exploited.

Impact

• Accelerated exploitation timelines challenge fixed remediation schedules and vulnerability management.
• Unaithenticated exploit paths increase risk for internet-facing services.
• AI-assisted attack tactics complicate detection and response strategies.

Recommendations

• Prioritize patching for vulnerabilities that are externally accessible and actively exploited.
• Assess compensating controls and detection coverage where immediate remediation is not possible.
• Monitor behavior changes in attacker tactics, emphasizing adaptive detection over signature reliance.
• Incorporate underground forum monitoring for access sales indicators.

Reference link: https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days

30. PHP2Shell: Two Unpatched Critical PHP RCE Flaws Trigger Emergency Security Alert

Overview

• PHP scheduled an out-of-cycle security release on October 21 to address two critical remote code execution vulnerabilities.
• Both vulnerabilities have a CVSS score of 9.2 under version 4.0.
• Details about the vulnerabilities and affected versions were pending official disclosure at the time of reporting.

Impact

• These are critical RCE flaws in PHP, a widely used server-side scripting language, posing severe security risks to affected systems.

Recommendations

• Apply the official PHP security update released on October 21 as soon as it becomes available.
• Monitor official PHP advisories for detailed information and mitigation instructions.

Reference link: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

31. Oracle October 2026 Critical Patch Update Addresses 1209 CVEs

Overview

• Oracle released its final quarterly Critical Patch Update (CPU) for October 2026, addressing 1209 unique CVEs across 1295 security updates in 33 product families.
• The update includes 112 critical patches covering 95 CVEs, with medium severity patches constituting the majority.
• Oracle Fusion Middleware received the highest number of patches (206), followed by Oracle E-Business Suite (194).
• Several issues can be exploited remotely without authentication, notably 134 in Fusion Middleware.

Impact

• The vulnerabilities affect a wide range of Oracle products, some allowing unauthenticated remote exploitation, posing significant security risks.

Recommendations

• Customers are strongly advised to apply all relevant patches from this CPU promptly to mitigate exposure.
• Utilize Tenable plugins as they become available to identify vulnerable systems.

Reference link: https://www.tenable.com/blog/oracle-october-2026-critical-patch-update-addresses-1209-cves

32. ConnectWise customers hit by supply-chain attack linked to compromised API secret

Overview

• ConnectWise Cloud Backup customers suffered a supply-chain attack due to a compromised API secret.
• The attacker gained unauthorized access to Microsoft 365 environments connected via the vendor’s application.
• Services including Exchange Online, Microsoft Teams, SharePoint Online, MS Graph, and Partner Center were affected.
• The breach allowed automated malicious sign-ins across nearly 1,000 Microsoft Entra tenants, with over 300 successful logins confirmed.
• Attackers used the compromised API secret to bypass multi-factor authentication and escalate privileges within tenants.
• ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services during ongoing investigation and remediation.
• No threat actor attribution or timeline for restoration has been provided.

Impact

• Hundreds of ConnectWise customers have been compromised with unauthorized access to their Microsoft 365 data and applications.
• Attackers could read and write mail and files and maintain backdoor persistence across affected tenants.

Recommendations

• Customers are advised to review and monitor their Microsoft 365 tenants for suspicious activity.
• Disable any affected applications immediately, even if no anomalies are currently detected.
• Implement thorough tenant-level audits to identify unauthorized changes and new credentials.
• Follow shared indicators of compromise from ConnectWise and security researchers to detect malicious activity.

Reference link: https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/

33. Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Overview

• Rapid7 discovered three vulnerabilities in Eptura Archibus during red teaming exercises.
• A legacy API allows authentication bypass to run various workflow rules without credentials.
• Vulnerabilities include performing full database reads and insecure file uploads leading to remote code execution.
• Archibus is widely used for managing physical buildings, equipment, and real estate, including by 40% of Fortune 500 companies.

Impact

• An attacker with network access to the server via HTTP can read sensitive data such as passwords from the database.
• Attackers can execute system commands as ‘NT AUTHORITY/Local Service’, gaining control of the server.
• These flaws enable unauthorized execution of privileged workflow rules, data exfiltration, and full compromise.

Recommendations

• Apply available patches and fixes from Eptura to remediate these vulnerabilities.
• Restrict network access to the Archibus server to trusted sources.
• Monitor network and application logs for suspicious DWR API activity, especially multiple method call requests.
• Conduct thorough security reviews of API endpoints exposed by web applications.

Reference link: https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed

34. Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Overview

• Rapid7 investigated a compromise of a Citrix NetScaler ADC appliance exploiting two chained zero-day vulnerabilities affecting authentication and SAML parsing.
• Attackers achieved root code execution, deployed PHP web shells with root privileges, and established multi-layer persistence mechanisms including cron jobs, crash-handler re-executions, HA synchronization, and watchdog loops.
• The intrusion included extensive internal reconnaissance using a Go-based scanning tool targeting DNS, LDAP, management services, and VMware vCenter from the compromised appliance.
• Multiple tunneling and command and control channels were set up, including a Perl TCP proxy, a Python HTTP tunnel, and an outbound reverse agent polling commands every 15 seconds.
• The persistent implant framework maintained access even after reboots and failovers with repeated staged execution via the appliance’s crash handling and failover processes.

Impact

• Full root compromise of NetScaler ADC appliances.
• Reconnaissance and credential/material exfiltration targeting key infrastructure components.
• Ability to pivot internally to sensitive services including Active Directory and VMware vCenter.
• Highly resilient persistence across device reboots and HA cluster failovers.

Recommendations

• Immediate patching against CVE-2026-88771 and CVE-2026-88779.
• Monitor for indicators of compromise, including abnormal NetScaler crashes, unexpected reboots, presence of PHP web shells, and suspicious network tunnels.
• Conduct deep internal network scans to detect reconnaissance and lateral movement activities stemming from compromised NetScaler devices.
• Review and harden HA failover processes to prevent propagation of compromise to peer appliances.

Reference link: https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779

35. A patch only reduces risk when it runs in production

Overview

• The article discusses the critical gap between patch release and actual deployment in production environments.
• It highlights how organizations often experience significant delays, sometimes 40 to 90 days, before patches are fully applied to all exposed applications.
• The acceleration of exploit timelines by AI technologies makes these delays increasingly risky.

Impact

• Prolonged delay in applying patches leaves organizations vulnerable during the exploit window.
• The mismatch between fast-moving threats and slow patch deployment increases enterprise risk.

Recommendations

• Prioritize reducing the time between patch release and full deployment in production.
• Improve processes for rebuilding and validating systems to accelerate patch rollout.

Reference link: https://www.redhat.com/en/blog/patch-only-reduces-risk-when-it-runs-production

36. CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)

Overview

• This advisory covers local privilege escalation vulnerabilities found in the GlobalProtect App.
• The vulnerabilities allow a local attacker to elevate privileges on the affected system.

Impact

• Exploitation could enable attackers to gain higher-level access than intended, potentially compromising system integrity.

Recommendations

• Users and administrators should apply the vendor’s recommended patches or mitigations to address these vulnerabilities.

Reference link: https://security.paloaltonetworks.com/CVE-2026-0307

AI SOC

1. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Overview

• Storm-0940, a China-state aligned actor, has used the agentic AI penetration testing framework ARTEX since September 2026 to automate attacks targeting hundreds of organizations across various industries.
• ARTEX automates offensive security workflows including reconnaissance, password spraying, and OAuth application abuse, enabling rapid escalation from initial targeting to privileged cloud access in under 3 hours in some cases.
• Storm-0940 used ARTEX in the ConnectWise supply chain compromise to obtain privileged access and accelerate abuse of the compromised applications to operate within Microsoft 365 environments without user sign-in.

Impact

• The use of agentic AI enabled Storm-0940 to scale operations exponentially, increasing attack speed and complexity.
• Privileged access granted through compromised applications allowed continued reconnaissance, credential modifications, and privilege escalations, potentially leading to persistent access.
• The accelerated attack tempo generates a high volume of alerts, leaving little time for defenders to respond effectively.

Recommendations

• Monitor for suspicious Microsoft Graph activity and unusual service principal sign-ins.
• Investigate unexpected application credential or privilege changes.
• Follow ConnectWise’s containment guidance and preserve evidence for incident response.
• Use Microsoft Defender XDR detections and hunting queries tailored for these AI-driven activities.

Reference link: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/

2. How Tenable brought multi-language support to security detectors with agentic translation

Overview

• Tenable enhanced its AI Exposure threat detectors from English-only to support nine additional languages natively without relying on costly and slow translation models.
• Developed an agentic translation pipeline that uses a frontier LLM to create label-preserving transcreations, scored and refined by independent judges to maintain security context and label integrity.
• The pipeline handles model refusals via a fallback open-source model and includes refinement loops to ensure quality.
• Fine-tuned a pretrained multilingual model to detect threats directly in multiple languages, leveraging cross-lingual transfer learning and reducing the need for extensive translation data.

Impact

• Detection latency reduced from seconds to tens of milliseconds, approximately 20-800 times faster per item.
• Memory footprint decreased roughly 12-14 times, enabling efficient production use.
• The solution incurs a one-time cost that does not scale with usage, unlike always-on translators.
• Achieved equal or better recall at low false positive rates compared to previous translate-then-detect methods across supported languages.
• Extended potential coverage to thousands of languages beyond the nine validated ones without additional data or cost.

Recommendations

• Security operations should consider native multilingual AI threat detectors to reduce latency, cost, and translation-induced signal loss.
• Employ agentic translation pipelines that preserve malicious intent and label integrity when expanding language coverage in AI security tools.
• Validate multilingual models with extensive benchmark data by using quality gates and human-in-the-loop judging.

Reference link: https://www.tenable.com/blog/how-tenable-brought-multi-language-support-to-security-detectors-with-agentic-translation

3. Agents are your newest insiders. Security must move at their speed.

Overview

• Agents are increasingly integrated into business workflows, requiring access to sensitive systems which introduces insider risk.
• Microsoft emphasizes separating intelligence supply (the AI model) from authority controls, which must be external and untamperable by the model.
• Project Perception and Microsoft’s cyber stack provide continuous, adaptive security controls to manage agent risk in real-time.
• The system implements four continuous responsibilities for agents: discovery and identity assignment, pre-action containment, protection of data and resources, and dynamic risk-based adaptation.
• Agent identities are distinct from their users to enable precise accountability, permissions, and policy enforcement.
• Agents run in controlled environments like Microsoft Execution Container with least privilege, and have dynamic, scoped permissions that can be adjusted or removed as tasks complete.
• Continuous monitoring of agent behavior and context changes allows security to adapt protections dynamically, mitigating risks like prompt injection or unauthorized actions.
• Microsoft is extending capabilities to discover numerous agent types and unify agent risk visibility, improving operational control over AI-driven agents operating at machine speed and scale.

Impact

• Enables enterprises to securely adopt agentic AI tools without overprovisioning access or blindly trusting model outputs.
• Reduces insider risk posed by compromised, manipulated, or erroneous agent behavior.
• Allows security teams to operate continuously and at machine scale, preventing damage from rapid agent actions.

Recommendations

• Employ agent discovery tools and unify agent visibility with distinct agent identity frameworks.
• Enforce containment boundaries including sandboxed runtimes and controlled action spaces.
• Apply Zero Trust and least privilege principles rigorously to agent permissions.
• Implement continuous risk assessment and dynamic conditional access mechanisms for AI agents.
• Require human approval for high-impact actions and automatically adjust permissions based on agent behavior and risk signals.

Reference link: https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/

AI Threat Landscape

1. Langflow Remote Code Execution Vulnerability via MCP Server Configuration – CVE-2026-105740 (CVSS 9.9)

Overview

• A critical remote code execution (RCE) vulnerability affects Langflow versions earlier than 1.9.0.
• The flaw arises from unsafe handling of user-controlled command strings and environment variables in the MCP (Model Context Protocol) server when using the Stdio transport.
• An authenticated user, including non-administrator accounts, can execute arbitrary OS commands without further privilege escalation or user interaction.
• Execution can occur when retrieving the MCP server list, enabling exploitation without running a workflow.

Impact

• Allows remote authenticated users to execute arbitrary commands on the host OS, potentially leading to full system compromise.

Affected / Fixed Versions

• Affected: Langflow versions earlier than 1.9.0
• Fixed: Langflow 1.9.0

Recommendations

• Upgrade all Langflow deployments to version 1.9.0 or later to remediate the RCE vulnerability.

Reference link: https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2

2. How to contain shadow AI, as it takes on multiple forms and spreads throughout your environment

Overview

• Shadow AI has expanded beyond simple chatbots to include local AI models, coding assistants, autonomous agents, and other forms, creating extensive detection and control challenges.
• Employees often use unvetted or unsanctioned AI tools, resulting in security blind spots and increased risk of data exposure.
• Shadow AI-related security incidents have more than doubled to 43%, with an average breach cost of $5.39 million, exceeding the global average.
• The Cloud Security Alliance warns of an "invisible layer of AI infrastructure" lacking governance, policy enforcement, access controls, and audits.
• The article outlines best practices to reduce shadow AI risk, focusing on employee and leadership education, clear AI governance policies, and integrating shadow AI management into broader exposure management.

Impact

• Nearly half of shadow AI incidents cause data loss or compromise.
• 42% cause operational disruptions.
• 21% lead to regulatory fines.
• Unauthorized AI use risks data privacy, compliance, and company IP through uncontrolled data sharing with third parties and public AI models.

Recommendations

• Increase workforce awareness of shadow AI risks through training and open communication.
• Develop and maintain an AI acceptable use policy detailing approved tools, usage rules, and accountability.
• Continuously assess AI tools for compliance, data security, and vendor practices.
• Address shadow AI within unified exposure management programs to identify and mitigate AI-related exposures enterprise-wide.

Reference link: https://www.tenable.com/blog/how-to-contain-shadow-ai-as-it-takes-on-multiple-forms-and-spreads-throughout-your-environment

3. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Overview

• Core PHP engine vulnerabilities have been discovered that enable remote code execution (RCE) and memory disclosure akin to Heartbleed.
• These flaws impact a large portion of web servers using PHP, estimated at 70% of the Internet.

Impact

• Attackers can execute arbitrary code remotely on vulnerable PHP installations.
• Memory disclosure could lead to leakage of sensitive information.

Recommendations

• Review and apply security patches from PHP maintainers addressing these critical vulnerabilities as soon as they become available.
• Monitor PHP environments for indicators of compromise related to these RCE and memory disclosure issues.
• Employ defense-in-depth controls such as web application firewalls and intrusion detection systems to mitigate exploitation risk.

Reference link: https://www.wiz.io/blog/php2shell-php-rce

4. CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability

Overview

• A server-side request forgery (SSRF) vulnerability exists in Azure AI Foundry.
• An authorized attacker can exploit this flaw to elevate privileges over a network.

Impact

• Privilege escalation within Azure AI Foundry environment could lead to unauthorized access or control.

Recommendations

• Apply security updates and mitigations provided by Microsoft for Azure AI Foundry to address the SSRF vulnerability.

Reference link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108456