Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• Privoce Vocechat Query Parameter widget.html cross site scriptingA vulnerabil... ↗ (opens in a new tab)

  CVE: New · Published 2026-10-25 · First collected 2026-10-25

• Node2Shell flaw embedded in apps and dev tools far beyond Node.js ↗ (opens in a new tab)

  iTnews · Published 2026-10-25 · First collected 2026-10-25

• Technology News Recorded Future Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits ↗ (opens in a new tab)

  NCSC Finland Daily Security News · Published 2026-10-25 · First collected 2026-10-25

• CVE-2026–111497: The Node.js Brotli Bug That Turns Your Server’s fetch() Into an Attack Surface ↗ (opens in a new tab)

  System Weakness - Medium · Published 2026-10-24 · First collected 2026-10-24

• Pierluigi Paganini answers questions about the PHP2Shell flaws ↗ (opens in a new tab)

  Security Affairs · Published 2026-10-24 · First collected 2026-10-24

• BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot ↗ (opens in a new tab)

  BleepingComputer · Published 2026-10-24 · First collected 2026-10-24

• Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software ↗ (opens in a new tab)

  The Hacker News · Published 2026-10-24 · First collected 2026-10-24

• How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944) ↗ (opens in a new tab)

  Qualys Security Blog · Published 2026-10-24 · First collected 2026-10-24

• CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH) ↗ (opens in a new tab)

  Palo Alto Security Advisories · Published 2026-10-24 · First collected 2026-10-24

• DSA-6583-1 libheif - security update ↗ (opens in a new tab)

  Debian security · Published 2026-10-24 · First collected 2026-10-24

• Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE ↗ (opens in a new tab)

  Sysdig Blog · Published 2026-10-24 · First collected 2026-10-24

• Vulnerabilities in PHP Affecting Cisco Products: October 2026 ↗ (opens in a new tab)

  Cisco Security Advisories · Published 2026-10-23 · First collected 2026-10-24

• Diplomatic entities in Central Asia targeted by new BlackX UEFI bootkit ↗ (opens in a new tab)

  SC Media · Published 2026-10-23 · First collected 2026-10-24

• PHP2Shell and the Case for Exploitability Validation ↗ (opens in a new tab)

  Synack · Published 2026-10-23 · First collected 2026-10-24

• (Reliable)? php2shell exploitability, (Fri, Oct 23rd) ↗ (opens in a new tab)

  SANS Internet Storm Center · Published 2026-10-23 · First collected 2026-10-24

• Reconstructing Broadcom's 2018 WPS Patch ↗ (opens in a new tab)

  QTNKSR · Published 2026-10-23 · First collected 2026-10-24

• RHSA-2026:88779: Critical: ca-certificates security update ↗ (opens in a new tab)

  Red Hat Security Advisories · Published 2026-10-23 · First collected 2026-10-24

• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) ↗ (opens in a new tab)

  Unit 42 · Published 2026-10-23 · First collected 2026-10-24

• Arista Networks security advisory (AV26-1080) – Update 1 ↗ (opens in a new tab)

  Canadian Centre for Cyber Security advisories · Source updated 2026-10-23 · First collected 2026-10-24

• Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0 ↗ (opens in a new tab)

  CSO Online · Published 2026-10-23 · First collected 2026-10-24

• “PoC Yes. RCE No.”: What the Underground Actually Thinks of the Public PHP2Shell Exploits ↗ (opens in a new tab)

  Blog Archives - Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime · Published 2026-10-23 · First collected 2026-10-24

• PHP exploitation moves at slower-than-expected pace, but millions remain at risk ↗ (opens in a new tab)

  Cybersecurity Dive - Latest News · Published 2026-10-23 · First collected 2026-10-24

• What Companies House's New 'Verified' Label Proves, And What It Doesn't ↗ (opens in a new tab)

  Secjuice · Published 2026-10-23 · First collected 2026-10-24

• 2026-018: Critical Vulnerabilities in PHP ↗ (opens in a new tab)

  CERT-EU Security Advisories · Published 2026-10-23 · First collected 2026-10-24

• Below the Threshold: Why Britain’s Smallest Power Generators Face a Four-Year Cyber Security Gap ↗ (opens in a new tab)

  IOActive · Published 2026-10-23 · First collected 2026-10-24

• Risolte vulnerabilità in prodotti Mozilla ↗ (opens in a new tab)

  CSIRT Italia news · Published 2026-10-23 · First collected 2026-10-24

• Update: PHP-kwetsbaarheden nog steeds reden om direct te patchen ↗ (opens in a new tab)

  NCSC NL news · Published 2026-10-23 · First collected 2026-10-24

• CC-4881 - Node.js Releases Security Updates Addressing Multiple Vulnerabilities ↗ (opens in a new tab)

  Cyber Alert Feed · Published 2026-10-23 · First collected 2026-10-24

• Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge ↗ (opens in a new tab)

  SecurityWeek · Published 2026-10-23 · First collected 2026-10-24

• CVE-2026-20079: Cisco’s Secure Firewall Management Centre ↗ (opens in a new tab)

  Archives - SecureLayer7 - Offensive Security, API Scanner & Attack Surface Management · Published 2026-10-23 · First collected 2026-10-24