Vulnerabilities & CVEs articles

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

Oracle Security Alert Advisory – CVE-2026-91403

There's always a patient zero: Defending the NetScaler front door before the patch

CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], Author: Johannes Ullrich

[Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619 · Issue #1148 · amazonlinux/amazon-linux-2023

PHP is releasing a CRITICAL security update today (21.10.2026): https://www.php.net/archive/2026.php#2026-10-20-1 This update will fix two critical CVE: CVE 2026-109618 CVE-2026-109619 Both rated CVSS v4.0 9.2. Please update the AmazonLi...

Do minor curl vulnerabilities in the open

The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in our GitHub repository. Only vulnerabilities deemed to be HIGH or CRITICAL will be … Continue reading Do minor curl vulnerabilities in the open →

Possible new Cellebrite iPhone Radio Zero-Day - Schneier on Security

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026. […] According to Cellebrite, AU: is a “next-generation AFU vector that is more resilient to Apple’s OS changes” works with Stolen Device Protection enabled, which tightens USB restrictions is enabled by a dedicated appliance with a stated range (!) of about 8 meters...

Microsoft Patches More Than 1,400 Security Flaws – Krebs on Security

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

oss-security - CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes