All news with #vulnerability disclosure tag

🔒 Drupal has released fixes for two critical remote code execution flaws affecting all supported core versions and a contributed module. Administrators are urged to update to core 10.6.19, 11.3.19, or 11.4.10 and Entity List 3.0.10, or uninstall the field_ui module as a mitigation. The project warned that exploits could appear within hours or days of disclosure.

🛡️ Researchers warn of a maximum-severity vulnerability, CVE-2026-103849, impacting Adobe Commerce and Magento Open Source that could allow arbitrary PHP code execution on store servers. Sansec found four potential attack paths within 24 hours and cautions that threat actors may rapidly weaponize the flaw, especially with AI assistance. Adobe rated the issue as priority 2, but Sansec urges quicker patching and warns administrators to apply the October 2026 release or the isolated fix while retaining prior hotfixes.

🧊Censys telemetry shows a 71% drop in internet-exposed Danfoss StoreView controllers in France within three days of the October 11 cyber-attack on supermarket refrigeration systems. Danfoss confirmed many affected units were older or running outdated firmware. Rather than applying patches, operators appear to be taking controllers offline to remove internet exposure. Researchers note widespread unpatched StoreView installations remain globally.

🛡️ NGINX on October 14 released 1.30.6 and 1.31.7 to address five vulnerabilities, including one present since May 2005. Three memory-corruption flaws could crash a worker or allow code execution when specific features are enabled, a TLS ticket bug can let forged sessions bypass client-cert checks, and an HTTP/3 issue can inject extra bytes into proxied requests. NGINX and F5 rate most as medium to critical; upgrades or configuration workarounds are recommended.

🔒 Palo Alto Networks disclosed CVE-2026-0322, a high-severity PAN-OS vulnerability that allows an authenticated attacker with network access to execute arbitrary code with root privileges on PA-Series, VM-Series and Panorama firewalls. The company and CISA report limited active exploitation and have issued urgent fixes and mitigation guidance; CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered forensic triage under BOD 26-04.

🔒 Cybersecurity researchers have disclosed two high-severity vulnerabilities in the widely used LiteLLM gateway tool that could allow any user to gain administrative access. Check Point reported CVE-2026-35029 and CVE-2026-59823, affecting versions older than 1.83.9, and detailed how attackers could achieve full system takeover, steal API keys and execute code. LiteLLM has released version 1.83.9 with fixes, and organizations are urged to update and audit gateway access, rotate keys and include LLM gateways in security testing.

🔒 Researchers demonstrated running attacker-controlled code inside a Windows VBS enclave used by Defender SmartScreen. The exploit, tracked as CVE-2026-83498, abused a four-byte write and a timing flaw to bypass enclave checks and replace its dispatch table, enabling code execution in Isolated User Mode. Microsoft patched the issue in the September 8, 2026 update and rated it Critical, noting it was not seen in the wild.

🛡️ Microsoft issued an unprecedented October Patch Tuesday with 1,407 CVEs, including three zero-days and one actively exploited flaw. The release was delayed by hours due to the volume, prompting urgent action from administrators. Key fixes affect Windows Shell, SharePoint, .NET, Exchange, and on-premises Atlassian and GitLab instances. Vendors including IBM, SAP, and Adobe also released critical updates that require immediate attention.

🛡️ Microsoft released its October 2026 security update addressing 1,415 vulnerabilities across Windows, Office, Azure, and other products, including 85 marked as critical. One vulnerability has confirmed exploitation in the wild: CVE-2026-96951, a Windows Shell security feature bypass with a CVSS of 8.8. Numerous high-scoring RCEs and elevation-of-privilege issues affect components such as Message Queuing, QUIC, Office apps, Remote Desktop, and virtualization.

🔒 Docker patched a critical Docker Hub flaw (CVE-2026-105445) that allowed personal access tokens (PATs) to be transferred when converting a personal account into an organization, potentially letting one user act as another in the registry. The bug, open from August 26, 2024, until the fix on September 30, 2026, was found by researchers Peter Molnar and Krisztian Hozak and named GhostPat. Docker says it found no evidence of exploitation and has reviewed conversions, deactivated affected tokens, and now requires consent and notification for ownership changes.

⚠️ Docker disclosed CVE-2026-105445, a critical Docker Hub vulnerability where personal access tokens (PATs) could be reassigned during account-to-organization conversion, letting attackers impersonate owners. An attacker-created account and PAT could be converted and named the target owner without changing the secret or obtaining consent, enabling pull, push, or delete actions depending on token scope. Docker patched the issue within hours of report, deactivated transferred PATs, and now requires consent and no longer transfers tokens during conversion.

🛡️ Check Point Research discovered two high-risk vulnerabilities in LiteLLM, tracked as CVE-2026-35029 and CVE-2026-59823, that allowed low-privileged users to reach administrative functions and to redirect gateway requests to attacker-controlled servers. The flaws enabled full system takeover, file access, credential theft and remote code execution in tests. Both issues are fixed in LiteLLM v1.83.9 and above; organizations should update immediately and audit access and API keys.

⚠️ This week's recap highlights how quickly attackers weaponized newly disclosed flaws, often testing exploits within hours of technical disclosures. It covers active in-the-wild exploitation of an Atlassian Data Center vulnerability, evolving malware like MATCHBOIL and DarkSword, high-profile arrests, DNS hijacks to obtain Google certificates, and a critical GoBalance flaw used to seize .onion sites. Technical and strategic trends underscore urgency for patching and improved operational defenses.

🔒 GitLab warned users to immediately patch a maximum-severity remote code execution flaw in its CI/CD Regular Expression Compiler, tracked as CVE-2026-97229. Discovered by researcher 'joaxcar' via GitLab's HackerOne program, the issue is an integer overflow during regex parsing that could enable unauthenticated arbitrary code execution. Fixed releases for CE and EE span versions before 19.2.8, 19.3.4, and 19.4.2, and GitLab urges immediate upgrades while noting GitLab.com is already patched.

🛡️ CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog after a China-linked actor called Flax Typhoon abused them to gain access and exfiltrate data. The flaws span ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND with CVSS scores from 7.2 to 10.0. A joint advisory from multiple nations links the activity to a China-based company, and federal agencies must patch or discontinue affected systems by October 11, 2026.

🛡️ A critical bug in GoBalance, a Go rewrite of Onionbalance used by many dark-web sites, leaks the private key that controls an .onion address by signing descriptors with only half of the Tor private key. The flaw lets anyone derive the site's long-term master key from a single public descriptor and then replace the address with a copy they control. Searchlight Cyber disclosed the issue after Dread experienced two address takeovers; vulnerable sites must generate new addresses and migrate users to remain safe.

🔒 SonicWall disclosed CVE-2026-102255, a pre-authentication SSRF vulnerability in the SMA1000 Appliance Workplace interface rated CVSS 10.0, allowing attackers to make the appliance issue requests and reach internal functions without credentials. The company also reported three additional, lower-severity flaws and strongly urges customers to upgrade to fixed releases. SonicWall says there's no evidence of active exploitation yet, but experts warn the attack is trivial to execute and could enable remote compromise.

🔒 SonicWall released hotfixes addressing four vulnerabilities in SMA1000 appliances, including a CVSS 10.0 SSRF in the WorkPlace portal that can be reached before authentication. The vendor says there is no evidence the flaws are being exploited, and affected firmware builds are listed with fixed and vulnerable versions. The hotfix is available via MySonicWall and requires an appliance restart; no workaround is provided.

🛡️ A critical vulnerability in LMCache lets unauthenticated attackers execute code on the cache server when it is configured to listen on a routable address. The flaw resides in multiprocess mode where ZeroMQ messages are unpickled before type checks, enabling crafted messages to run with the LMCache process's privileges. JFrog disclosed the issue (CVE-2026-105192) on October 7 and rated it 9.8/10; no patched release is available, and operators are advised to keep the server bound to localhost or restrict network access.

🔒 SonicWall issued hotfixes to address a maximum-severity server-side request forgery (SSRF) vulnerability in SMA1000 series appliances, including the 6210, 7210, and 8200v models. This flaw enables remote, unauthenticated attackers to abuse an unintended alternate access path to make the appliance issue requests on their behalf and reach internal functionality. SonicWall recommends applying the Tuesday hotfixes immediately; there is currently no evidence of active exploitation, though over 400 exposed appliances are tracked by Shadowserver.