Please be sure you don’t take your eye off the big node.js/brotli vulnerability while php2shell was sucking all the air from the room. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

RE: https://fosstodon.org/@keepassxc/117320648185069600

🚨Attention! Yesterday, we published new 2.8.0-1 binaries for macOS (DMG) and Linux (AppImage) to fix three separate upstream Qt bugs on macOS and to ship an updated version of Brotli that fixes CVE-2026-111497.

The new version will not show up as an update automatically, but we recommend everyone to install it from https://keepassxc.org/download/ until the release of 2.8.1.

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

some light reading for people who think this only happens to php.

https://atlasum.net/blog/cve-2026-111497-nodejs-brotli-decoder

CVE-2026-111497 is classified as CWE-787. Can *anyone* confirm that it works with ASLR enabled, or was that *completely omitted* from all reports?

#Node2shell CVE-2026-111497-POC
https://github.com/dimasma0305/CVE-2026-111497-POC

Uh oh: ⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.

ht @jerry
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

...yes https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

2/3 Also done today:

Checked the Node.js October security release (Brotli CVE-2026-111497). Our streaming server never decompresses untrusted Brotli data, so the risk is low. We'll update as soon as the FreeBSD package is out.

The streaming server now properly verifies the database's TLS certificate.

Rewrote our rc.d scripts the way rc.subr intends: supervisor pidfile, automatic restart after a crash, and "service restart" works on the first try. Background: https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/

Package updates on the host and in all jails

nginx: separate cache directories, a nearby DNS resolver (thousands of DNS errors gone) and a catch-all for unknown hostnames

We retired our Tor onion service

Lots of small cleanups after a deep health check

Node2Shell CVE-2026-111497: Brotli Out-of-Bounds Write

https://thecybersecguru.com/exploits/node2shell-cve-2026-111497-nodejs-brotli-rce/

CVE-2026-111497 is a memory-corruption flaw in Google’s Brotli decoder, used by software including Bun, Python Brotli and brotlicffi, Envoy, Istio, Node.js and cdxgen.

Crafted compressed data can corrupt program memory and potentially lead to code execution.

Imperva researchers demonstrated code execution on an unpatched Node.js build; similar execution has not been shown on the other affected software, and no real-world attacks have be…

https://en.hacks.gr/sovaro-provlima-asfaleias-ston-kodika-tis-google-epireazei-node-js-kai-alles-efarmoges/

#Brotli #NodeJS #Python #Envoy

Möchte nicht wissen, wie viele Firmen diese Woche keine Updates für PHP (CVE-2026-109618, CVE-2026-109619), Node.js (CVE-2026-111497), ca-certificate (eMudhra) etc. installiert haben, weil Patchday nur 1x pro Quartal oder so.

🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560

The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
⠀
PHP says exploitation requires an unusual configuration where an application:

• Uses php_binary or php_serialize as its session serializer
• Changes the serializer to php at runtime before session_start()
• Has session upload progress enabled
⠀
PHP considers the risk unlikely and plans to release a fix during its next regular update cycle.

Until then, administrators with affected configurations should set:

session.upload_progress.enabled=0

Applications that do not change the session serializer at runtime are not exposed through this path.

No exploitation has been reported.

Source:
https://www.php.net/

PHP signale une nouvelle faille RCE (CVE-2026-115560) : appliquez le même réglage que PHP2Shell https://www.it-connect.fr/php-cve-2026-115560-session-upload-progress/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #PHP

Nouvelle faille pour php

https://www.it-connect.fr/php-cve-2026-115560-session-upload-progress/

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws, The Hacker News reports. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way; PHP considers it an unlikely risk, is not issuing an emergency fix, and recommends a configuration change instead. https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

A New PHP Risk Needs a Workaround, Plus 2 Stories https://raymondtec.com/2026/10/php-session-upload-progress-vulnerability-plus-2-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

PHP disclosed a new session upload progress vulnerability with no fixed release yet. Here’s the temporary mitigation, plus AWS capacity pressure and PwC’s vendor incident.

#TechNews #AmazonWebServices #CloudComputing #CVE2026115560 #databreach #PHP #PwC

🚨 CRITICITÀ PHP: PHP2Shell (CVE-2026-109618/19)

Due RCE remote critiche in PHP (CVSS 9.2) permettono l'esecuzione codice arbitrario senza autenticazione. Colpisce PHP 5.4+ in configurazione default.

Versioni patched:
8.5.12/8.4.27/8.3.36/8.2.35
⚠️ PHP 8.1 e precedenti: NO PATCH

🐀Cosa fare subito:
Inventory sistemi PHP
Aggiorna priorità web-facing
Versioni EOL: togli offline o migra
WAF come protezione temporanea
Exploit PoC già pubblici.

#PHP #CyberSecurity #PHP2Shell #nextred
@sicurezza

"Black October" marks a cybersecurity alarm, with experts warning of expanding AI-enabled hacking following a severe PHP vulnerability discovered this week. Millions of PHP2Shell exploit attempts are deploying Mirai malware via RCE flaws (CVE-2026-109618/19). Additionally, China-linked APT41 is suspected in BlackX UEFI bootkit attacks targeting Central Asian diplomats. Geopolitically, Moscow agreed to resume peace talks with Ukraine but ruled out a ceasefire (Oct 23, 2026).

#AnonNews_irc #Cybersecurity #News

⚠️ PHP2Shell (CVE-2026-109618/619, CVSS 9.2): a supply chain perspective.

Everyone says "patch fast." But fast patching creates a blind spot.

In December 2025, 10 months before PHP2Shell, I simulated exactly this on Drupal: MITM + rogue SSL, fake update server, admin installs "the patch", RCE + persistence.

PHP2Shell makes this worse: urgency = less verification of update sources.

Full analysis + hardening guide:
https://dev.to/privlabs/php2shell-supply-chain-why-patching-fast-could-make-things-worse-51h6

@SymfonyStation this may be relevant for the Drupal community.

#Drupal #PHP #PHP2Shell #SupplyChain #CyberSecurity #InfoSec

Півчетвертої ночі закінчили термінові правки на нашому сервері. Причина в тому, що в світі знайшли дві критичні вразливості в самій мові PHP. Їх назвали PHP2Shell, це CVE-2026-109618 і CVE-2026-109619. Оцінка 9.2 з 10, а для експлуатації не потрібна авторизація.

Основна наша система написана іншою мовою, але кілька окремих сервісів працювали на PHP. Ми несемо відповідальність за все, що крутиться на нашому сервері, тому закрили всі.

Що відомо станом на зараз.

Виправлення вийшли 21 жовтня у версіях 8.5.12, 8.4.27, 8.3.36 та 8.2.35. Старші гілки офіційних патчів не отримали.

Знайшли діри дослідники з допомогою моделей ШІ: першу версію компанія Calif ще в серпні, а Wiz незалежно виявила обидві. Дослідники кажуть, що вада існувала роками, але ШІ зробив її експлуатацію практичною.

Інформація витекла за день до виходу патчу. Спроби атак фіксували ще 17 жовтня, за кілька днів до публічного розкриття. Деякі уряди, за повідомленнями, на час відключили свої сайти.

Масштаб. PHP стоїть на близько 70% сайтів, де відома серверна мова. Це не означає, що стільки зламано: надійних цифр підтверджених зломів поки немає, і дослідники пишуть, що експлуатація складніша, ніж здавалось у перший день. Але ризик реальний, а старих версій без підтримки в мережі дуже багато.

Що зробити вам.

Перевірте, чи є PHP на сервері та в контейнерах: php -v, docker images.
Оновіть PHP і перезапустіть php-fpm або веб-сервер.
Якщо оновитись не можете одразу, вимкніть session.upload_progress.enabled.
Подивіться на дивні дочірні процеси від користувача веб-сервера і нові php файли.
Якщо сервіси були відкриті в мережі з 17 жовтня, змініть ключі та токени.

Бережіть себе і свої сервери 🙏

#PHP #PHP2Shell #Security #InfoSec #CVE #Fediverse #Linux #DevOps #SelfHosting

To complicate things, major shared hosting providers have patched #PHP against #php2shell using a backport — without incrementing the version number displayed by phpinfo.

On the plus side – and it's a massive plus – this means that for many sites, versions as old as 5.2 are protected, even though the PHP Team only released official patches for 8.2 and newer.

On the minus side, if you run a website there's no obvious way to tell whether you're using the new or old version.

This explains why, across the various websites I manage, even really old versions of PHP have build dates of Wednesday afternoon a few hours after the official fixes. It seems almost too good to be true.

CloudLinux explained: "PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions […] Our alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). These packages contain the fix for both CVEs, even though the PHP version number is lower."

Then today, CloudLinux released builds to bring the version numbers in line with the official ones.

Information from #cPanel and #CloudLinux here:

https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619

https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5

🚨 Palo Alto Networks warns PAN-OS is affected by PHP2Shell remote code execution flaws

CVE-2026-109618 and CVE-2026-109619 affect the PAN-OS management web interface, including the HTTPS interface and XML API service.
⠀
Affected products include:

• PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 release trains
• All Panorama versions
• All WildFire WF-500 and WF-500-B appliances
⠀
No special configuration is required, but the risk is highest when the management interface is exposed to the internet.

Palo Alto Networks rates the product impact at CVSS 8.7. PAN-OS hotfixes are expected between October 26 and 30, while dates for Panorama and WildFire appliance fixes remain unconfirmed.

The company is not aware of malicious exploitation targeting its products.

GlobalProtect and Captive Portal are not affected.

Source:
https://security.paloaltonetworks.com/CVE-2026-109618

⚠️ Critical Security Alert for all EPY Host dedicated server clients!

Highly critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) require immediate patching to prevent remote code execution. Please SSH into your servers, update your OS packages, and restart your web server and PHP daemons.

Discover why dedicated server isolation keeps you safer than shared hosting. Read more: https://www.epyhost.com/blogs/php-vulnerability-dedicated-server-isolation/

#ServerSecurity #DedicatedServers #CyberSecurity #PHPUpdate #SysAdmin #WebHosting

Rad Web Hosting Completes Critical Security Updates Across All Managed cPanel Servers

October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.

Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting prioritized the ...
Continued 👉 https://blog.radwebhosting.com/rad-web-hosting-completes-critical-security-updates-across-all-managed-cpanel-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social

PHP2Shell: guía completa de verificación, mitigación y respuesta (CVE-2026-109618 y CVE-2026-109619)

Vía: @seguinfo

https://blog.segu-info.com.ar/2026/10/php2shell-guia-completa-de-verificacion.html

🚨 URGENT SECURITY ADVISORY: Critical "PHP2Shell" Updates Required 🚨

Two critical RCE vulnerabilities (CVE-2026-109618 & CVE-2026-109619) are actively exploited in the wild.

Dedicated server clients: Update OS packages to the latest PHP releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) via SSH immediately.

Crucially, restart your web server and PHP-FPM services after patching to load the secure binaries. Need help? Open a high-priority ticket.

#ServerSecurity #CyberSecurity #PHPUpdate #InfoSec

Critical 9.2 RCE vulnerabilities CVE-2026-109618 & CVE-2026-109619 are active in PHP environments. WordPress updates alone won't protect you. Full emergency guide at klytron.com.

#klytron #cybersecurity #infosec #vulnerability #cve #phpexploit #klytron

PHP2Shell: PAN-OS und Panorama von PHP-Lücken betroffen

Palo Alto Networks hat bestätigt, dass die PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619 seine Firewall- und Management-Produkte betreffen. Das Risiko liegt vor allem in der Web-Verwaltungsschnittstelle. Hotfixes werden derzeit bereitgestellt, Signaturen zur Bedrohungsabwehr stehen bereits zur Verfügung.

https://www.all-about-security.de/php2shell-pan-os-und-panorama-von-php-luecken-betroffen/

#paloalto #php #cybersecurity #itsicherheit

Möchte nicht wissen, wie viele Firmen diese Woche keine Updates für PHP (CVE-2026-109618, CVE-2026-109619), Node.js (CVE-2026-111497), ca-certificate (eMudhra) etc. installiert haben, weil Patchday nur 1x pro Quartal oder so.

Півчетвертої ночі закінчили термінові правки на нашому сервері. Причина в тому, що в світі знайшли дві критичні вразливості в самій мові PHP. Їх назвали PHP2Shell, це CVE-2026-109618 і CVE-2026-109619. Оцінка 9.2 з 10, а для експлуатації не потрібна авторизація.

Основна наша система написана іншою мовою, але кілька окремих сервісів працювали на PHP. Ми несемо відповідальність за все, що крутиться на нашому сервері, тому закрили всі.

Що відомо станом на зараз.

Виправлення вийшли 21 жовтня у версіях 8.5.12, 8.4.27, 8.3.36 та 8.2.35. Старші гілки офіційних патчів не отримали.

Знайшли діри дослідники з допомогою моделей ШІ: першу версію компанія Calif ще в серпні, а Wiz незалежно виявила обидві. Дослідники кажуть, що вада існувала роками, але ШІ зробив її експлуатацію практичною.

Інформація витекла за день до виходу патчу. Спроби атак фіксували ще 17 жовтня, за кілька днів до публічного розкриття. Деякі уряди, за повідомленнями, на час відключили свої сайти.

Масштаб. PHP стоїть на близько 70% сайтів, де відома серверна мова. Це не означає, що стільки зламано: надійних цифр підтверджених зломів поки немає, і дослідники пишуть, що експлуатація складніша, ніж здавалось у перший день. Але ризик реальний, а старих версій без підтримки в мережі дуже багато.

Що зробити вам.

Перевірте, чи є PHP на сервері та в контейнерах: php -v, docker images.
Оновіть PHP і перезапустіть php-fpm або веб-сервер.
Якщо оновитись не можете одразу, вимкніть session.upload_progress.enabled.
Подивіться на дивні дочірні процеси від користувача веб-сервера і нові php файли.
Якщо сервіси були відкриті в мережі з 17 жовтня, змініть ключі та токени.

Бережіть себе і свої сервери 🙏

#PHP #PHP2Shell #Security #InfoSec #CVE #Fediverse #Linux #DevOps #SelfHosting

To complicate things, major shared hosting providers have patched #PHP against #php2shell using a backport — without incrementing the version number displayed by phpinfo.

On the plus side – and it's a massive plus – this means that for many sites, versions as old as 5.2 are protected, even though the PHP Team only released official patches for 8.2 and newer.

On the minus side, if you run a website there's no obvious way to tell whether you're using the new or old version.

This explains why, across the various websites I manage, even really old versions of PHP have build dates of Wednesday afternoon a few hours after the official fixes. It seems almost too good to be true.

CloudLinux explained: "PHP.net fixed CVE-2026-109618 and CVE-2026-109619 in new PHP versions […] Our alt-php and ea-php packages carry the same fix applied to the PHP version they already shipped (a backport). These packages contain the fix for both CVEs, even though the PHP version number is lower."

Then today, CloudLinux released builds to bring the version numbers in line with the official ones.

Information from #cPanel and #CloudLinux here:

https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619

https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5

🚨 Palo Alto Networks warns PAN-OS is affected by PHP2Shell remote code execution flaws

CVE-2026-109618 and CVE-2026-109619 affect the PAN-OS management web interface, including the HTTPS interface and XML API service.
⠀
Affected products include:

• PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 release trains
• All Panorama versions
• All WildFire WF-500 and WF-500-B appliances
⠀
No special configuration is required, but the risk is highest when the management interface is exposed to the internet.

Palo Alto Networks rates the product impact at CVSS 8.7. PAN-OS hotfixes are expected between October 26 and 30, while dates for Panorama and WildFire appliance fixes remain unconfirmed.

The company is not aware of malicious exploitation targeting its products.

GlobalProtect and Captive Portal are not affected.

Source:
https://security.paloaltonetworks.com/CVE-2026-109618

⚠️ Critical Security Alert for all EPY Host dedicated server clients!

Highly critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) require immediate patching to prevent remote code execution. Please SSH into your servers, update your OS packages, and restart your web server and PHP daemons.

Discover why dedicated server isolation keeps you safer than shared hosting. Read more: https://www.epyhost.com/blogs/php-vulnerability-dedicated-server-isolation/

#ServerSecurity #DedicatedServers #CyberSecurity #PHPUpdate #SysAdmin #WebHosting

Rad Web Hosting Completes Critical Security Updates Across All Managed cPanel Servers

October 23, 2026 — Rad Web Hosting is pleased to announce the successful deployment of critical security patches addressing CVE-2026-109618 and CVE-2026-109619 across its entire fleet of managed cPanel & WHM servers.

Following the disclosure of two critical vulnerabilities affecting the PHP scripting engine on October 21, 2026, Rad Web Hosting prioritized the ...
Continued 👉 https://blog.radwebhosting.com/rad-web-hosting-completes-critical-security-updates-across-all-managed-cpanel-servers/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social

PHP2Shell: guía completa de verificación, mitigación y respuesta (CVE-2026-109618 y CVE-2026-109619)

Vía: @seguinfo

https://blog.segu-info.com.ar/2026/10/php2shell-guia-completa-de-verificacion.html

🚨 URGENT SECURITY ADVISORY: Critical "PHP2Shell" Updates Required 🚨

Two critical RCE vulnerabilities (CVE-2026-109618 & CVE-2026-109619) are actively exploited in the wild.

Dedicated server clients: Update OS packages to the latest PHP releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) via SSH immediately.

Crucially, restart your web server and PHP-FPM services after patching to load the secure binaries. Need help? Open a high-priority ticket.

#ServerSecurity #CyberSecurity #PHPUpdate #InfoSec

Critical 9.2 RCE vulnerabilities CVE-2026-109618 & CVE-2026-109619 are active in PHP environments. WordPress updates alone won't protect you. Full emergency guide at klytron.com.

#klytron #cybersecurity #infosec #vulnerability #cve #phpexploit #klytron

PHP2Shell: PAN-OS und Panorama von PHP-Lücken betroffen

Palo Alto Networks hat bestätigt, dass die PHP-Schwachstellen CVE-2026-109618 und CVE-2026-109619 seine Firewall- und Management-Produkte betreffen. Das Risiko liegt vor allem in der Web-Verwaltungsschnittstelle. Hotfixes werden derzeit bereitgestellt, Signaturen zur Bedrohungsabwehr stehen bereits zur Verfügung.

https://www.all-about-security.de/php2shell-pan-os-und-panorama-von-php-luecken-betroffen/

#paloalto #php #cybersecurity #itsicherheit

Möchte nicht wissen, wie viele Firmen diese Woche keine Updates für PHP (CVE-2026-109618, CVE-2026-109619), Node.js (CVE-2026-111497), ca-certificate (eMudhra) etc. installiert haben, weil Patchday nur 1x pro Quartal oder so.

CVE-2026-110447 (9.2 critical) Collabora Online – Built-in CODE Server OS Command Injection Vulnerability was just added to the CISA KEV Catalog. TGIF

#CISA #KEV #CollaboraOnline

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild, The Hacker News reports. The flaws are CVE-2026-110447 (CVSS 9.2) in Collabora Online’s Built-in CODE Server and a SQL injection flaw in Arista’s VeloCloud Orchestrator. https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog.

The first is CVE-2026-110447, a CVSS 9.2 command injection in the Nextcloud Collabora Online Built-in CODE Server allowing remote code execution via proxy.php, with fixes in version 26.4.303.

The second is CVE-2026-114625, a CVSS 9.9 SQL injection in on-premise Arista VeloCloud Orchestrator requiring authentication, with fixes in versions 5.2.3.18, 6…

https://en.hacks.gr/i-cisa-prosthetei-dyo-nea-kena-asfaleias-poy-axiopoioyntai-se-pragmatikes-epitheseis/

#Nextcloud #Arista #Vulnerability #CISA

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog.

The first is CVE-2026-110447, a CVSS 9.2 command injection in the Nextcloud Collabora Online Built-in CODE Server allowing remote code execution via proxy.php, with fixes in version 26.4.303.

The second is CVE-2026-114625, a CVSS 9.9 SQL injection in on-premise Arista VeloCloud Orchestrator requiring authentication, with fixes in versions 5.2.3.18, 6…

https://en.hacks.gr/i-cisa-prosthetei-dyo-nea-kena-asfaleias-poy-axiopoioyntai-se-pragmatikes-epitheseis/

#Nextcloud #Arista #Vulnerability #CISA

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

PwnEscape (CVE-2026-99999): a guest VM can attack its host kernel to leak memory, crash it, or gain root. Rated Critical.

AlmaLinux 8, 9, and 10 are affected. Patched kernels are available now. https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/

Oracle Security Alert Advisory
CVE-2026-91403 (eMudhra)
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

CVE-2026-91403: How eMudhra’s Weak CA Keys Broke Java TLS Trust

https://thecybersecguru.com/news/cve-2026-91403-java-tls-vulnerability/

In early 2026, diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan were targeted by a UEFI bootkit named BlackX.

Kaspersky attributes the campaign to APT41, noting it leverages the CVE-2022-21894 Secure Boot bypass vulnerability when systems lack manual DBX updates.

The bootkit tampers with security software and deploys espionage payloads communicating via cloud storage.

https://en.hacks.gr/diplomatikes-ypiresies-se-treis-chores-dechthikan-psifiaki-epithesi-apo-omada-syndedemeni-me-tin-kina/

#Malware #APT41 #UEFI #CVE202221894