Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• CISA Adds One Known Exploited Vulnerability to Catalog ↗ (opens in a new tab)

  CISA current activity · Published 2026-10-23 · First collected 2026-10-24

• CVE-2026-111497: Node.js Brotli Decoder Flaw Enables Remote Code Execution ↗ (opens in a new tab)

  SOC Prime Blog · Published 2026-10-23 · First collected 2026-10-24

• Vulnerabilities in CGM CLININET software ↗ (opens in a new tab)

  CERT.PL news · Published 2026-10-23 · First collected 2026-10-24

• ALERTĂ: Vulnerabilități critice în GitLab ↗ (opens in a new tab)

  CERT.RO news · Published 2026-10-23 · First collected 2026-10-24

• NCSC-2026-0453 [1.00] [M/H] Kwetsbaarheid in Google Brotli-decoder ↗ (opens in a new tab)

  NCSC NL advisories · Published 2026-10-23 · First collected 2026-10-24

• Criminal IP Emergency Security Patch Notice (October 23) ↗ (opens in a new tab)

  CIP Blog · Published 2026-10-23 · First collected 2026-10-24

• CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access ↗ (opens in a new tab)

  SOCRadar® Cyber Intelligence Inc. · Published 2026-10-23 · First collected 2026-10-24

• PHP2Shell Remote Code Execution Vulnerabilities ↗ (opens in a new tab)

  FortiGuard Labs | FortiGuard Center - Threat Signal Report · Published 2026-10-23 · First collected 2026-10-24

• Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ↗ (opens in a new tab)

  CrowdStrike Blog · Published 2026-10-23 · First collected 2026-10-24

• Security Alert (A26-10-47): Multiple Vulnerabilities in Ivanti Endpoint Manager ↗ (opens in a new tab)

  GovCERT.HK news · Published 2026-10-23 · First collected 2026-10-24

• Fortinet Products Multiple Vulnerabilities ↗ (opens in a new tab)

  HKCERT news · Published 2026-10-23 · First collected 2026-10-24

• Bridging the Patch Gap: Stopping PHP2Shell and Zero-Days Before WAF Signatures Exist ↗ (opens in a new tab)

  Salt Security Blog · Published 2026-10-23 · First collected 2026-10-24

• libkcapi: CVSS (Max): 7.3 ↗ (opens in a new tab)

  AusCERT advisories · Published 2026-10-23 · First collected 2026-10-24

• Vulnérabilité dans Mattermost Server (23 octobre 2026) ↗ (opens in a new tab)

  CERT-FR advisories · Published 2026-10-23 · First collected 2026-10-24

• CVE-2026-9256 & CVE-2026-42945: Chaining Two NGINX Rewrite-Engine Vulnerabilities into Remote Code Execution ↗ (opens in a new tab)

  OPSWAT Blog · Published 2026-10-23 · First collected 2026-10-24

• PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions ↗ (opens in a new tab)

  Security - SiliconANGLE · Published 2026-10-22 · First collected 2026-10-24

• 2026-10-16: Coruna-like iOS exploit kit traffic ↗ (opens in a new tab)

  Malware-Traffic-Analysis.net (Blog Entries) · Published 2026-10-22 · First collected 2026-10-24

• VU#763488: Memory corruption vulnerabilities in PHP ↗ (opens in a new tab)

  CERT/CC Vulnerability Notes · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell exploit bypasses protections designed to stop remote code execution ↗ (opens in a new tab)

  www.theregister.com - Articles · Published 2026-10-22 · First collected 2026-10-24

• USN-8954-1: zlib vulnerability ↗ (opens in a new tab)

  Ubuntu security notices · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell Exploitation Attempts Observed ↗ (opens in a new tab)

  F5 Labs All · Published 2026-10-22 · First collected 2026-10-24

• PHP2Shell – Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619) ↗ (opens in a new tab)

  OffSec RSS Feed · Published 2026-10-22 · First collected 2026-10-24

• The race to fix huge PHP code flaw at the heart of the internet - The Latest ↗ (opens in a new tab)

  Data and computer security | The Guardian · Published 2026-10-22 · First collected 2026-10-24

• Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React ↗ (opens in a new tab)

  IT Security Guru · Published 2026-10-22 · First collected 2026-10-24

• Warning: Critical Unauthenticated Remote Code Execution in GitLab, Patch Immediately! ↗ (opens in a new tab)

  CERT.BE advisories · Published 2026-10-22 · First collected 2026-10-24

• Hackers got a four-day head start on epic PHP2Shell vulnerability ↗ (opens in a new tab)

  Security - Ars Technica · Published 2026-10-22 · First collected 2026-10-24

• php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution ↗ (opens in a new tab)

  Sygnia · Published 2026-10-22 · First collected 2026-10-24

• PHP Issues Patches for Two Critical Flaws, Security Leaders Discuss ↗ (opens in a new tab)

  Security Magazine · Published 2026-10-22 · First collected 2026-10-24

• PHP vulnerabilities spark global scramble as websites taken down ↗ (opens in a new tab)

  Latest from ITPro in Security · Published 2026-10-22 · First collected 2026-10-24

• [tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner ↗ (opens in a new tab)

  tl;dr sec · Published 2026-10-22 · First collected 2026-10-24