Latest security alerts, resolved alerts and available patches. Selected topics are covered in detailed analyses on Dr. DSGVO. Last updated: October 31, 2026.
Pinned
GitLab: critical regex flaws, CVE-2026-97229 actively exploited, added to CISA KEV
Reported on October 22, 2026. Status: In progress. Update October 30, 2026: Since October 29, CISA has listed the GitLab flaw CVE-2026-97229 as actively exploited; Omnibus installations get the fixed Ruby with the GitLab update, custom Ruby applications need Ruby 3.3.13, 3.4.12 or 4.0.9.
CVE: CVE-2026-110264, CVE-2026-97229
Using crafted regular expressions in CI/CD configurations, attackers can execute code on GitLab CE/EE without authentication; the cause is bugs in Ruby's bundled regex engine (CVE-2026-97229 and CVE-2026-110264, each CVSS 10). CISA has listed CVE-2026-97229 as actively exploited since October 29, and an attack attempt on Alpine Linux's GitLab instance narrowly failed. Bring self-managed instances up to the October 21 release immediately (including 19.5.1, 19.4.3, 19.3.6, 18.11.13), which closes both flaws.
Source: https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
Linux kernel: privilege escalation “Fragnesia” CVE-2026-46300 exploited, added to CISA KEV
Reported on October 28, 2026. Status: In progress
CVE: CVE-2026-46300
CISA has newly added the local privilege escalation in the Linux kernel (CVSS 7.8) to its catalog of known exploited vulnerabilities (KEV); attackers use it after breaking in via PHP2Shell to gain root privileges. Kernel updates have been available for months: bring servers, especially those running PHP exposed to the internet, to a current kernel and reboot.
Source: https://www.heise.de/news/Angriffe-auf-Linux-und-VMware-ESX-Schwachstellen-11503947.html
Cisco ASA and FTD: SSL VPN flaw CVE-2026-76418 exploited to cause crashes, added to CISA KEV
Reported on October 28, 2026. Status: In progress
CVE: CVE-2026-76418
Without authentication, a Cisco Secure Firewall ASA or FTD can be forced to reload via a crafted SSL VPN request, provided secondary authentication is configured in a tunnel group (CVSS 8.6). Cisco confirms attacks, and CISA has listed the flaw in its catalog of known exploited vulnerabilities (KEV) since October 29. Update to the fixed versions from the Cisco advisory (e.g. ASA 9.22.3.200, FTD 7.6.7) and apply the mitigation described there until then.
Adobe Commerce/Magento: PolyShell flaw CVE-2026-48356 exploited, added to CISA KEV
Reported on October 27, 2026. Status: In progress
CVE: CVE-2026-48356
On October 27, 2026, CISA added the upload flaw CVE-2026-48356 (PolyShell, CVSS 9.3) in Adobe Commerce and Magento to its KEV catalog of known exploited vulnerabilities; attackers use it to upload web shells, and Sansec counts hundreds of compromised stores. Check whether the store is at least at the APSB26-73 level, and inspect it for web shells, unknown uploaded files and injected scripts, especially if it went unpatched for a long time.
PHP2Shell: critical PHP flaws actively exploited, apply updates
Reported on October 21, 2026. Status: In progress. Update October 31, 2026: According to The Hacker News, attackers took over 25 servers with root privileges between October 23 and 25 by combining PHP2Shell with the kernel flaw CVE-2026-46300; update PHP and the kernel together.
CVE: CVE-2026-109618, CVE-2026-109619
Emergency patches for the PHP flaws PHP2Shell (CVE-2026-109618/-109619) were released on October 21, 2026; on October 26, 2026, the first successful exploitation in the wild was reported (honeypot with Apache mod_php and PHP 8.4.26, incident dated October 24 according to the source). Admins should update PHP to the patched version immediately and handle internet-facing servers first.
Source: https://security.paloaltonetworks.com/CVE-2026-109618
Nextcloud: Collabora CODE flaw exploited, added to CISA KEV, update the app
Reported on October 23, 2026. Status: In progress. Update October 27, 2026: The fix is in app version 26.4.303 or later and requires Nextcloud 30 or later; older instances must remove the app, disabling it does not protect them. According to the issue tracker, attacks with web shells have been documented since at least September 11; affected servers should be checked for compromise.
CVE: CVE-2026-110447
CISA added CVE-2026-110447 (command injection in the built-in CODE server, CVSS 9.2) to the KEV catalog (list of known exploited vulnerabilities) on October 23, 2026; attackers install web shells on Nextcloud servers, and the attack only works while the built-in CODE server is not running (for example after a restart, update or crash). Update the richdocumentscode app to version 26.4.303 or later (requires Nextcloud 30 or later) and check the server for web shells.
Ivanti Connect Secure: authentication bypass CVE-2026-104935 actively exploited
Reported on October 13, 2026. Status: In progress. Update October 31, 2026: Since October 30, CISA has also listed the privilege escalation flaws CVE-2026-111357 and CVE-2026-118527 as actively exploited; according to reports, only 25.1.1.3 and 22.8R2.6 respectively close the entire chain (Ivanti advisory not checked directly), so update again.
CVE: CVE-2026-104935, CVE-2026-111357, CVE-2026-118527
Attackers chain the flaw with other vulnerabilities to achieve root code execution, according to reports since at least October 1 (Volexity names October 3); since October 30, CISA has also listed the privilege escalation flaws CVE-2026-111357 and CVE-2026-118527 as actively exploited. According to reports, only 25.1.1.3 and 22.8R2.6 respectively close the entire chain (Ivanti advisory not checked directly), so update systems again even if they are already patched. Check logs for tampering and do not rely on the Integrity Checker as the sole evidence.
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Current alerts
Cisco: 15 advisories, three critical, including Expressway CVE-2026-76466 (CVSS 9.8)
Reported on October 23, 2026. Status: Patch available or all-clear (October 31, 2026). Update October 31, 2026: The Cisco advisory has been unchanged since October 21, and Cisco is still not aware of any attacks; it names X15.5.20 as the fixed version for Expressway.
CVE: CVE-2026-76466
Cisco fixes unauthenticated root code execution in Expressway (CVSS 9.8); in addition, there are critical flaws in Unified Communications and Snort 3. Update Expressway to X15.5.20 or later and Unified Communications to 15SU5, and migrate older branches. According to Cisco, no attacks are known.
Tailworm: Tailscale 1.104.4 and headscale 0.29.7 fix SSH flaws
Reported on October 25, 2026. Status: Patch available or all-clear (October 31, 2026). Update October 31, 2026: headscale 0.29.7 from October 30 fixes the Tailworm findings on the server side; devices are only protected once they also run Tailscale 1.104.4.
An already compromised device could gain root privileges on reachable servers via Tailscale SSH with port forwarding. Tailscale fixed the findings in version 1.104.4, and no CVEs have been assigned so far; headscale follows with 0.29.7, but also requires Tailscale 1.104.4 on the devices. Update clients and, if used, headscale, narrow ACLs to individual source-destination pairs and enable device key expiry.
Source: https://github.com/juanfont/headscale/releases
Microsoft Authenticator for Android: malicious apps could steal access tokens for corporate accounts
Reported on October 28, 2026. Status: Patch available or all-clear (October 31, 2026). Update October 31, 2026: The fix has been rolled out since September, no attacks are known as of October 31 and the flaw is not in the KEV catalog; all that remains is to enforce the minimum version via MDM.
CVE: CVE-2026-80097
An app without special permissions could impersonate another app, such as Teams, and obtain tokens via the Authenticator with access to mailbox, files and calendar (CVSS 8.6); whether user consent is required for this is disputed. Microsoft already shipped a fix in September, and the source does not report any attacks. Use MDM to ensure that at least version 6.2606.4246 runs on company devices.
HPE Aruba: eight critical flaws in AOS-8 and AOS-10 allow unauthenticated code execution
Reported on October 23, 2026. Status: Patch available or all-clear (October 31, 2026). Update October 31, 2026: As of October 31, neither attacks nor public exploit code are known, and none of the eight flaws is in the KEV catalog; fixed versions are available.
CVE: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851
HPE has closed 72 flaws in the operating system of Aruba controllers, gateways and access points; eight of them allow remote code execution or authentication bypass without authentication. According to HPE, no attacks are known. Update to the fixed versions from the HPE advisory and isolate the management interfaces with a firewall or a dedicated VLAN until then.
Node.js: Brotli flaw CVE-2026-111497 allows anything from crashes to code execution
Reported on October 21, 2026. Status: Patch available or all-clear (October 30, 2026). Update October 30, 2026: Node.js 22.23.4, 24.22.1 and 26.12.1 fix the flaw in all supported lines; there is no fix for older lines such as Node.js 20, which are no longer supported.
CVE: CVE-2026-111497
On October 21, 2026, Node.js 22.23.4, 24.22.1 and 26.12.1 were released to fix a memory write flaw in the Brotli decoder; Node 20 and older are end-of-life and receive no fix. Update services that decompress untrusted Brotli data immediately. Other software with embedded Brotli may also be affected; this is not confirmed for Python packages, Bun, Envoy and Istio. The Brotli library itself is fixed in versions 1.2.1, 1.1.1 and 1.0.10.
Source: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Cursor: tampered Claude Code extension 2.1.313 installed SSH backdoor
Reported on October 30, 2026. Status: In progress
A tampered version 2.1.313 of the Claude Code extension was available in the marketplace of the Cursor editor for about eleven hours on October 29. It added an SSH key named “svc-telemetry”, attempted to set up a reverse tunnel and established persistence; according to BleepingComputer, the VS Code Marketplace, Open VSX and npm were not affected. Cursor users should check authorized_keys for this key and the logs for connections to 134.209.82.225; isolate affected machines, reinstall them and rotate all secrets used on them.
Android: crafted SMS crashes smartphones, patch not expected until November
Reported on October 30, 2026. Status: Open
CVE: CVE-2026-58882
A single manipulated WAP push SMS silently crashes the telephony service on Android 12 to 17 and can interrupt ongoing calls, including emergency calls; repeated messages make the device practically unusable (CVE-2026-58882 according to heise). No public exploit is known, nor are any attacks; according to heise, Google has the fix for Android 14 to 17 ready and it is due with the November bulletin, while none is expected for Android 12 and 13. Update company devices promptly once it is out, replace devices running Android 12/13, and do not rush into a factory reset if a reboot loop occurs.
LiteLLM: release pipeline compromised, PyPI 1.107.0 and Docker images with infostealer
Reported on October 21, 2026. Status: Patch available or all-clear (October 29, 2026). Update October 29, 2026: The completed root cause analysis names an admin key that had been publicly exposed since May and was never revoked as the entry point; version 1.107.0 is frozen, and the affected Docker tags have been removed or point to verified images.
On October 21, litellm 1.107.0 on PyPI (around 11:39 to 13:23 UTC) and the Docker tags v1.107.0, latest, main-latest and main-stable (Docker Hub, GHCR, until around 14:20 UTC) were shipped with malicious code that steals credentials. The packages have been removed; anyone who installed or pulled during that window should pin to 1.106.2, rebuild the environment and rotate all reachable secrets. According to the project, the incident is contained; the sequence of events is described in the investigation report.
Source: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
DreamHost: email and FTP access was locked, reset passwords
Reported on October 26, 2026. Status: In progress. Update October 31, 2026: According to the status page, email hosting, webmail and File Manager are running normally again; DreamHost has still not disclosed anything about the cause or possible data leakage.
After problems with the File Manager, DreamHost had locked email and FTP/SFTP access as a precaution since October 23; according to the status page, the services are running again. The cause and possible data leakage remain unclear. Customers should set new passwords, check forwarding rules for unknown destinations and, if they reused passwords, change them on other services too.
Source: https://www.helpnetsecurity.com/?p=389210
WatchGuard Fireware: 18 flaws, seven of them critical
Reported on October 29, 2026. Status: In progress
WatchGuard closes 17 flaws in Fireware OS and one in the VPN client for Windows; seven reach CVSS 9.1 to 9.5, and CERT-Bund rates the advisory WID-SEC-2026-4209 at 10.0 overall. No attacks are known yet. Update Firebox to Fireware OS 2026.4 or 12.12.4 (T15/T35: 12.5.22) and the VPN client to 2026.4, with priority if Access Portal, SIP proxy or FireCluster is active.
Source: https://www.heise.de/news/Diverse-kritische-Schwachstellen-in-WatchGuard-Fireware-OS-11504873.html
Linux kernel: critical TCP flaw CVE-2026-98432, Ubuntu and RHEL still unpatched
Reported on October 29, 2026. Status: Open. Update October 31, 2026: Since October 30, Red Hat has listed RHEL 8, 9 and 10 as affected (critical, bulletin RHSB-2026-016) instead of deferring the fix; kernel updates are still missing there, as they are for Ubuntu 22.04/24.04.
CVE: CVE-2026-98432
A race condition when establishing IPv4 TCP connections leads to a use-after-free; according to Anthropic, this enabled a root exploit, and no attacks are known. The upstream kernel as well as Debian and Oracle UEK are patched; Red Hat rates RHEL 8 to 10 as affected and critical, but there are no kernel updates yet for RHEL and Ubuntu 22.04/24.04. Monitor your distribution's patch status and apply kernel updates immediately.
Source: https://access.redhat.com/security/cve/CVE-2026-98432
VMware ESX: logging flaw CVE-2026-41709 exploited as a zero-day, added to CISA KEV
Reported on October 28, 2026. Status: In progress
CVE: CVE-2026-41709
The flaw allows administrators to perform certain actions without them appearing in the log; according to CrowdStrike, the group “Warp Panda” used this to cover its tracks in vCenter environments. Broadcom rates the flaw at only CVSS 2.7, while CISA has listed it in its catalog of known exploited vulnerabilities (KEV) since October 28. Apply the ESX updates available since late July and check vCenter for unknown accounts and software.
Source: https://www.heise.de/news/Angriffe-auf-Linux-und-VMware-ESX-Schwachstellen-11503947.html
UEFI firmware: old PXE flaw CVE-2026-97631 in EDK II, firmware updates still missing
Reported on October 28, 2026. Status: Open
CVE: CVE-2026-97631
A buffer overflow in the network boot code of EDK II, the basis of many UEFI firmwares, allows crashes from the local network and, with considerable effort, code execution even before Secure Boot (CVSS 9.5). No attacks are known; a stable EDK II release with a fix is still missing, and vendor firmware updates are pending. Disable PXE boot where it is not needed and watch for BIOS/UEFI updates from vendors.
Source: https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html
Drupal Commerce: access check flaw CVE-2026-118539 actively exploited
Reported on October 28, 2026. Status: In progress
CVE: CVE-2026-118539
In the Commerce Core module, certain routes and fields are not sufficiently protected; Drupal rates the flaw as “Highly critical”, it is already being exploited and can cause financial damage to store operators. Update to Commerce Core 3.3.13 or 8.x-2.41 and check orders for inconsistencies.
Source: https://www.drupal.org/sa-contrib-2026-254
WordPress 7.1.4: race condition in core update allows malicious code, update immediately
Reported on October 28, 2026. Status: In progress
WordPress 7.1.4 from October 28 closes a race condition during core updates that can be used to execute arbitrary code, plus several XSS flaws; according to reports, the bug lies in the working folder wp-content/upgrade, and attacks are not confirmed. Update to 7.1.4 or the security release of your branch (older branches such as 6.8 have their own releases). If you update late, check wp-content/upgrade for unfamiliar PHP files and review the admin accounts.
Source: https://wordpress.org/news/2026/10/wordpress-7-1-4/
Apple: iOS and macOS 27.2 close more than 150 flaws, updates for older systems too
Reported on October 27, 2026. Status: Patch available or all-clear. Update October 28, 2026: iOS/iPadOS 18.7.11 contains the backported fix for CVE-2026-86950 (CoreGraphics), which according to Apple was exploited in a sophisticated attack on individuals; newer devices have had it since iOS 26.7.1 in September.
CVE: CVE-2026-86950
With version 27.2, Apple fixes numerous bugs, including in WebKit, the kernel and font processing, some of them remotely exploitable. Older devices receive iOS/iPadOS 26.7.2 and 18.7.11 as well as macOS 26.7.2 and 15.8.2; 18.7.11 also brings the fix for the CoreGraphics flaw CVE-2026-86950, already exploited in targeted attacks, to older devices such as iPhone XS and XR. Update company devices promptly; for the other flaws closed with 27.2, no exploitation is confirmed.
Veeam Backup & Replication: critical unauthenticated flaw in CDP service fixed
Reported on October 27, 2026. Status: Patch available or all-clear. Update October 28, 2026: Added: CVE-2026-107671 in Veeam ONE (High) allows disabling MFA with admin credentials, fixed in 13.1.0.7940.
CVE: CVE-2026-108142, CVE-2026-108140, CVE-2026-108141, CVE-2026-105477, CVE-2026-107671
Veeam closed five flaws on October 27, 2026. The critical CVE-2026-108142 (CVSS v4 9.1) allows unauthenticated attackers to bypass authorization in the CDP service of Backup & Replication, on Windows servers and on the Veeam Software Appliance. Other flaws affect B&R, the Agent for Linux and Veeam ONE, where MFA can be disabled with admin credentials; according to Veeam, no attacks are known. Update B&R to 13.1.2.57 or 13.0.3.63, Agent for Linux to 13.1.2.11 and Veeam ONE to 13.1.0.7940 (B&R 12.x is not affected), because backup servers are a preferred target of ransomware.
Source: https://www.veeam.com/kb4948
Warp: breach at service provider exposes AI agent logs and telemetry
Reported on October 27, 2026. Status: In progress
The provider of the Warp terminal and agent platform reports an attack via a service provider in which agent decision logs and telemetry data of around 1 percent of users were exposed. Warp has not disclosed whether they contained source code, prompts or credentials. Affected teams should rotate secrets and tokens that appeared in agent sessions with Warp and assess the incident under data protection law.
TeamViewer 15.83: flaws allow code execution when connecting to a malicious host
Reported on October 27, 2026. Status: In progress
CVE: CVE-2026-111585, CVE-2026-92372, CVE-2026-92374
A malicious or compromised host can execute code on the connecting client's machine when the connection is established (CVE-2026-111585, CVSS 8.8); on Linux and macOS, a crafted .tvs recording also leads to code execution (CVE-2026-92372), and on macOS local privilege escalation to root is possible (CVE-2026-92374). According to TeamViewer, no attacks are known. Update to 15.83, on Windows 7/8 to 15.64.10; for older branches, bulletin TV-2026-1011 lists separate builds.
Source: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/
Arista VeloCloud Orchestrator: SQL injection CVE-2026-114625 exploited, updates available
Reported on October 26, 2026. Status: In progress
CVE: CVE-2026-114625
The critical flaw (CVSS4 9.4) in self-hosted VeloCloud Orchestrator allows attackers to impersonate a superuser operator; attacks are already underway, and CISA has listed it in the KEV catalog since October 23. Update to 5.2.3.18, 6.1.3.10 or 6.4.2.12, restrict access via firewall or VPN until then, and search the logs for the IOCs named by Arista.
ARTEX: South Korean police link AI pentest framework to attacks on more than 90 organizations
Reported on October 26, 2026. Status: Open
According to South Korean police (via BleepingComputer, citing Yonhap), seven suspects allegedly stole 8.2 million records and demanded ransom in 38 cases (360 million won, around 270,000 US dollars); the leader is a former pentester. The same framework was previously used in attacks on South Korean banks attributed to a Chinese-speaking actor. For SMEs, patches, MFA and log analysis remain crucial, as AI lowers the barrier to entry.
“Gheist” campaign: stolen GitHub tokens, secrets harvested via Actions logs
Reported on October 25, 2026. Status: Open
Wiz describes an ongoing campaign that uses stolen GitHub tokens to create workflows in repositories and writes encoded secrets to the log. Mainly private repositories and GitHub Enterprise Server are affected. Admins should search for branches named ci-sync-* and the file sync-check.yml, rotate secrets and tokens, and check self-hosted runners.
Source: https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
Malicious AGENTS.md in the Downloads folder can hijack AI coding agents
Reported on October 25, 2026. Status: Open
Researchers showed that agents such as Codex or Claude Code load instruction files from the starting directory and can thus be made to execute code. According to the report, no patch is planned. Only start agents in the project directory, never in the Downloads or home folder, and keep confirmations and the sandbox enabled.
New PHP flaw CVE-2026-115560 without a patch: disable upload progress in sessions
Reported on October 23, 2026. Status: Open
CVE: CVE-2026-115560
On October 23, 2026, PHP warned of another code execution flaw for which no patch exists yet. It is only exploitable with an unusual combination (session.serialize_handler changed at runtime, upload progress enabled); as a workaround, set session.upload_progress.enabled=0.
ConnectWise Cloud Backup: supply chain attack, Microsoft attributes it to Storm-0940 using AI framework ARTEX
Reported on October 21, 2026. Status: In progress. Update October 31, 2026: According to ConnectWise (October 30), backups, restore, the self-service portal and backup monitoring are running again, with reporting, export and billing to follow; partners still need to reauthorize every M365 tenant and check new snapshots.
According to reports, the China-linked group Storm-0940 used a compromise of ConnectWise Cloud Backup to get into customer environments, deploying the AI pentest framework ARTEX. Backups and restore are working again, but every M365 tenant has to be reauthorized. MSP customers should also review application credentials and permissions in Entra ID and remove additionally created credentials in OAuth apps.
Source: https://www.connectwise.com/company/trust/advisories
Railway: possible access to environment variables, rotate secrets
Reported on October 21, 2026. Status: In progress. Update October 30, 2026: Railway still lists the incident as “Monitoring” on its status page (last updated October 29); new sign-ups remain disabled, and there is no date for reopening.
Railway reports unusual activity in systems holding customer environment variables; a third party may have gained access to them. Probably only a subset of users is affected. Rotate all secrets stored at Railway (API keys, database and registry credentials) and check logs.
Source: https://status.railway.com/
Python library Pillow: critical flaws in EPS, TIFF and JPEG processing, update to 13.0.0
Reported on October 23, 2026. Status: Patch available or all-clear
CVE: CVE-2026-112900, CVE-2026-112403, CVE-2026-112393
Pillow 13.0.0 from October 16, 2026 closes several flaws, including CVE-2026-112900 (code execution with EPS files via Ghostscript) and CVE-2026-112393 (buffer overflow when saving TIFFs, public PoC); GitHub rates them at CVSS 9.2, the maintainers partly lower. No attacks are known. Update applications that process uploaded images with Pillow to 13.0.0 (requires Python 3.11 or later) and also check container images and bundled dependencies.
Source: https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
Microsoft 365: token replay and device code phishing bypass MFA, Huntress warns
Reported on October 22, 2026. Status: Open
Huntress observed a campaign against 79 organizations that steals session tokens via AiTM and device code phishing and establishes persistence through fake Entra devices and swapped MFA methods. A password reset alone is not enough. Revoke sessions, check devices, MFA methods and mailbox rules, and restrict the device code flow via Conditional Access.
Source: https://www.huntress.com/blog/token-replay-spray
Fortinet: emergency updates for FortiOS & co., parallel campaign with more than 70,000 credentials
Reported on October 22, 2026. Status: In progress
CVE: CVE-2025-64446, CVE-2026-0257
Fortinet announced out-of-band updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with details not following until November 10, 2026. Separately, according to Group-IB and NyxLab, the actor k0t is using more than 70,000 stolen credentials for firewalls and VPNs (including FortiGate, GlobalProtect); this report names CVE-2025-64446 (FortiWeb) and CVE-2026-0257 (PAN-OS), which are not part of the announced updates. Apply updates, restrict admin access to trusted IPs, rotate VPN credentials and check for unknown remote access tools.
eMudhra: Chrome withdraws root trust from October 27, Firefox already since October 20
Reported on October 22, 2026. Status: In progress. Update October 29, 2026: In macOS 27.2, Apple did not clean up the file /etc/ssl/cert.pem; curl, git, python3 and openssl continue to trust the affected certificates until they are removed manually following Apple's instructions. A later update has been announced.
CVE: CVE-2026-115557
Eight eMudhra intermediate certificate keys were easy to guess; Mozilla withdrew trust from the root emSign ECC G3 on October 20, and Chrome follows on October 27. According to Chrome, around 30,800 certificates are affected, almost all via InCommon. Check your own TLS certificates and, for chains under this root, obtain a certificate from another CA without delay.
Linux KSMBD: two unpatched flaws with CVSS 9.0, possible code execution
Reported on October 22, 2026. Status: Open. Update October 30, 2026: A fix for one of the two flaws is in the KSMBD maintainer's development branch, but according to Sysdig (October 28), none of the fixes is in a released kernel yet, and CVE numbers are still missing.
Zero Day Initiative reported two KSMBD flaws (ZDI-CAN-33549, ZDI-CAN-33774); there are no CVE numbers yet, and according to the report, the fixes are not yet in any released kernel. Public exploits so far show a memory leak and crashes; code execution has not been demonstrated. Use systemctl status ksmbd or lsmod to check whether KSMBD is running, and disable services that are not needed.
Source: https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws
BlackX: UEFI bootkit bypasses Secure Boot via CVE-2022-21894
Reported on October 22, 2026. Status: In progress
CVE: CVE-2022-21894
Kaspersky describes BlackX, a BlackLotus-like bootkit that also works on patched systems because the Windows Production PCA 2011 certificate is only revoked after manual activation. Enable the revocation via the registry flag and the scheduled task Secure-Boot-Update; according to the report, automatic enforcement was still missing. Targeted attacks on diplomatic entities were observed; for SMEs, the risk is low but real.
Source: https://securelist.com/uefi-bootkit-blackx/121539/
BIND 9: four flaws, including possible RCE via GSS-TSIG (CVE-2026-94300)
Reported on October 21, 2026. Status: Patch available or all-clear
CVE: CVE-2026-94300, CVE-2026-19630, CVE-2026-97313, CVE-2026-96888
ISC reports no exploitation and names no workarounds. Update to BIND 9.20.30 or 9.21.27; according to the source, no fix was named for the 9.18 branch, so plan a migration.
Source: https://securityonline.info/bind-9-vulnerabilities-october-2026/
Archive
Palo Alto PAN-OS: root code execution via management interface (CVE-2026-0322) exploited
Reported on October 14, 2026. Status: Patch available or all-clear
CVE: CVE-2026-0322
Attackers with valid credentials and network access to the management interface can execute code as root; Palo Alto reports very limited attacks. Apply the fixes and restrict the management interface to trusted internal addresses.
Microsoft Patch Tuesday October 2026: exploited Mark of the Web bypass in Windows Shell
Reported on October 13, 2026. Status: Patch available or all-clear
CVE: CVE-2026-96951, CVE-2026-108398, CVE-2026-92707
CVE-2026-96951 is actively exploited and bypasses the warning for files from the internet. In addition, two publicly known flaws are patched, including a WDAC bypass in .NET (CVE-2026-108398). Roll out the October updates promptly.
Atlassian Data Center: unauthenticated file access (CVE-2026-21589) in seven products
Reported on October 5, 2026. Status: Patch available or all-clear
CVE: CVE-2026-21589
Self-hosted Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye allow reading known files in the web root. Atlassian did not report active exploitation; reports of attacks on Bamboo are unconfirmed. Update to the fixed versions and check all cluster nodes and access logs.
Citrix NetScaler: SAML memory flaw CVE-2026-88779 exploited, patches available
Reported on October 4, 2026. Status: Patch available or all-clear
CVE: CVE-2026-88779
Self-managed NetScaler ADC and Gateway with SAML configuration are affected; Citrix reports attacks, and CISA lists the flaw in the KEV catalog. Update to 14.1-73.41 or 13.1-64.28; anyone who patched after the September 27 updates must update again.