1. Executive summary Two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, were leaked ahead of a coordinated disclosure
1. Executive summary Kaspersky has documented Operation FlashHole, a Lazarus Group (MITRE G0032) espionage campaign that uses the mandatory South Korean financial security client INISAFE CrossWeb
1. Executive summary On 19 October 2026 an attacker used a compromised GitHub account belonging to an OVHcloud contributor to replace the download archives on five
1. Executive summary BSI's Warn- und Informationsdienst published WID-SEC-2026-4056 on 2026-10-21, rating a set of vulnerabilities across Atlassian Bamboo,
1. Executive summary Between October 2 and 5, 2026, an unidentified actor compromised more than 330 Tor relays, infected them with the Ebury Linux malware and
1. Executive summary Eight intermediate CA private keys operated by Indian certificate authority eMudhra were found to be compromised, and the keys are weak enough to
1. Executive summary A new Pillow vulnerability, tracked as CVE-2026-42310 at CVSS 5.1 MEDIUM (NVD), allows a crafted PDF to drive two recursive
1. Executive summary An incomplete fix for CVE-2025-66035 in @angular/common leaves the xsrfInterceptorFn in the Angular HTTP Client attaching the X-XSRF-TOKEN
1. Executive summary CVE-2026-106931 is an OS command injection flaw in EG Secure Solutions SiteGuard Server Edition that lets an attacker run arbitrary operating-
1. Executive summary CVE-2026-110936 is a DLL sideloading flaw in Siemens Software Center, rated CVSS 8.4 HIGH (CWE-427, uncontrolled search path element)
1. Executive summary CERT-FR published an advisory on 20 October 2026 covering multiple vulnerabilities in Mattermost Server, fixed in 11.7.12, 11.8.6,
1. Executive summary Ransomware crews tracked as Qilin and Inc are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals