Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• PHP releases emergency fixes for 2 critical vulnerabilities ↗ (opens in a new tab)

  CyberScoop · Published 2026-10-21 · First collected 2026-10-24

• Appknox MCP: Find, Fix and Verify Mobile App Vulnerabilities Without Leaving Your IDE ↗ (opens in a new tab)

  Appknox Blog · Published 2026-10-21 · First collected 2026-10-24

• Critical security issue affecting PHP ↗ (opens in a new tab)

  UK NCSC News · Published 2026-10-21 · First collected 2026-10-24

• php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities ↗ (opens in a new tab)

  Tenable Cyber Exposure Alerts · Published 2026-10-21 · First collected 2026-10-24

• Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) ↗ (opens in a new tab)

  Huntress Blog · Published 2026-10-21 · First collected 2026-10-24

• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation ↗ (opens in a new tab)

  Datadog Security Labs · Published 2026-10-21 · First collected 2026-10-24

• FreeBSD-SA-26:73.caroot ↗ (opens in a new tab)

  FreeBSD security · Published 2026-10-21 · First collected 2026-10-24

• GLSA 202610-02: PHP: Multiple Vulnerabilities ↗ (opens in a new tab)

  Gentoo security · Published 2026-10-21 · First collected 2026-10-24

• Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection ↗ (opens in a new tab)

  Nebula Security · Published 2026-10-21 · First collected 2026-10-24

• PHP2Shell Exploitation: Two Critical PHP Flaws Explained ↗ (opens in a new tab)

  Recorded Future – Main Feed · Published 2026-10-21 · First collected 2026-10-24

• Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) ↗ (opens in a new tab)

  Sophos Blogs · Published 2026-10-21 · First collected 2026-10-24

• PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 ↗ (opens in a new tab)

  VulnCheck Blog · Published 2026-10-21 · First collected 2026-10-24

• Critical RCE vulnerability in PHP: Find impacted assets ↗ (opens in a new tab)

  runZero Blog · Published 2026-10-20 · First collected 2026-10-24

• Oracle Critical Security Patch Update Advisory - October 2026 ↗ (opens in a new tab)

  Oracle security alerts · Published 2026-10-20 · First collected 2026-10-24

• Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds ↗ (opens in a new tab)

  Scott Helme · Published 2026-10-20 · First collected 2026-10-24

• [0day-rubbish] TRENDnet TV-IP302PI firmware 1.02.38 authenticated NTP server-address OS command injection to root command execution via a shell-form system() call (7.2 High, PR:H) ↗ (opens in a new tab)

  Full Disclosure · Published 2026-10-20 · First collected 2026-10-24

• There's only so much code: the rise in vulnerability numbers ↗ (opens in a new tab)

  Cisco Talos Blog · Published 2026-10-20 · First collected 2026-10-24

• FuzzingLabs joins the Cyber Booster 2026-2027 cohort ↗ (opens in a new tab)

  FuzzingLabs · Published 2026-10-20 · First collected 2026-10-24

• Supply Chain Zero Days: Closing the Gap Between Publication and Detection ↗ (opens in a new tab)

  Wiz Blog | RSS feed · Published 2026-10-19 · First collected 2026-10-24

• Risky Bulletin: Linux patches PwnEscape KVM vulnerability ↗ (opens in a new tab)

  Risky Bulletin · Published 2026-10-19 · First collected 2026-10-24

• A patch only reduces risk when it runs in production ↗ (opens in a new tab)

  Red Hat Security · Published 2026-10-19 · First collected 2026-10-24

• Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool ↗ (opens in a new tab)

  Chocapikk's Cybersecurity Blog · Published 2026-10-17 · First collected 2026-10-24

• iPhone ↗ (opens in a new tab)

  Calif · Published 2026-10-16 · First collected 2026-10-24

• ARMORY CASTLE Exploits BeyondTrust ↗ (opens in a new tab)

  Threat Intelligence · Published 2026-10-15 · First collected 2026-10-24

• Pass the Passkey: When Passwordless Authentication Meets Its Achilles' Heel ↗ (opens in a new tab)

  SySS Tech Blog · Published 2026-10-15 · First collected 2026-10-24

• Breaking open a propAMM ↗ (opens in a new tab)

  OtterSec · Published 2026-10-15 · First collected 2026-10-24

• The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws ↗ (opens in a new tab)

  Cyble · Published 2026-10-14 · First collected 2026-10-24

• Prioritize what's actually exploitable: Vulnerability reachability is now available in SonarQube Advanced Security ↗ (opens in a new tab)

  Sonar Blog · Published 2026-10-14 · First collected 2026-10-24

• You don’t need a nation state to warm up a fridge ↗ (opens in a new tab)

  Pen Test Partners · Published 2026-10-14 · First collected 2026-10-24

• Package managers have an integrity problem ↗ (opens in a new tab)

  The Trail of Bits Blog · Published 2026-10-14 · First collected 2026-10-24