Vulnerabilities & Patches
PHP Critical Vulnerabilities Leaked Before Patch
Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team released the fix on October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code execution.…
Read MoreNextcloud Collabora Vulnerability Exploited
A Nextcloud Collabora vulnerability in the optional Built-in CODE Server app has let attackers plant web shells on Nextcloud servers since September 10. Collabora fixed it on September 11 without a security notice, and the CVE (CVE-2026-110447) followed only on October 14. Disabling the app does not close the hole: update it or remove it.…
Read MoreCisco Secure Email Gateway Zero-Day Exploited Again
A Cisco Secure Email Gateway zero-day is under attack: one email with a crafted attachment lets an unauthenticated attacker write files and run commands as root. Cisco tracks it as CVE-2026-76519 (CVSS 9.8), and CISA added it to the Known Exploited Vulnerabilities catalog on October 14. It is the second Secure Email Gateway flaw exploited…
Read MoreIvanti Connect Secure Zero-Day Chain Reaches Root
Volexity found an Ivanti Connect Secure zero-day chain that gave one attacker unauthenticated root on a VPN appliance running the latest build at the time. Ivanti has fixed two of the three flaws. As of October 14, the third, the privilege escalation that turns a web-server foothold into root, has no fix. Ivanti’s own Integrity…
Read MoreAhsayCBS Backup Server Vulnerability Exploited
An AhsayCBS backup server vulnerability is being exploited, and the version everyone was told to install did not fix it. Huntress saw attackers chain two flaws from October 7 to run code as SYSTEM on exposed Ahsay Cloud Backup Servers. On October 8 it found that 10.3.4, the release the public CVE entries call fixed,…
Read More