Vulnerabilities & CVEs

HPE has released security updates addressing 72 vulnerabilities in ArubaOS, the operating system powering its Aruba networking gear. Among the fixes are eight maximum-severity flaws that could allow authentication bypass and remote code execution. The most critical issues fall into two categories: authentication bypass vulnerabilities that could let attackers sidestep login controls, and RCE flaws that could enable arbitrary code execution on affected systems. Given the maximum severity rating, these should be treated as high-priority patching targets for anyone running ArubaOS in their environment. Administrators running ArubaOS should review HPE's advisory and apply the available updates as soon as possible. As always, prioritize internet-facing and edge devices first, and check whether any of the addressed flaws impact hardware models or software branches currently deployed in your network. Source: BleepingComputer Are any of your ArubaOS devices exposed to these flaws, and have you scheduled the patch yet?

Researchers have disclosed and remotely mitigated a serious flaw in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, that put millions of computers at risk of remote code execution. The vulnerable component was the app's updater, which could have been abused by attackers to run malicious code with elevated privileges on affected systems. Because the project is no longer maintained and the updater remained active, the research team took the unusual step of remotely disabling it themselves, effectively closing the attack vector for the entire install base rather than waiting on a patch that would never come. This is a notable case of abandoned software continuing to carry risk long after development stops, since update mechanisms often run with high privileges and can serve as a foothold if they fall into the wrong hands. The affected application is the discontinued Time4Popcorn client. The vulnerable component is its auto-updater, which could enable code execution with elevated privileges. Researchers remotely disabled the updater to neutralize the flaw for existing users. If you or anyone you know still has this client installed, uninstalling it entirely is the safest path, as no official fixes will be coming. Source: Unknown Have you come across abandoned applications still running privileged updaters in your environment, and how are you handling them?

The PHP security team has published mitigation guidance for a new remote code execution vulnerability that currently has no patch available. Exploitation is only possible on systems running non-default configurations, which limits the exposure surface but does not eliminate the risk for affected deployments. Key points from the advisory: The flaw allows remote code execution under specific, non-default configuration setups No official patch has been released at this time The PHP team has provided mitigation measures to reduce exposure until a fix is available Administrators running PHP in production should review their configurations against the reported conditions and apply the recommended mitigations as soon as possible. Since a patch is not yet available, configuration-level defenses are the primary recourse for vulnerable environments. Source: Unknown Does your organization run PHP with any non-default configurations that could fall within the scope of this advisory?

The PHP project has disclosed another remote code execution risk just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, only affects web applications that are configured in an unusual way, and the PHP team assesses it as an unlikely risk. Because of that limited exposure, PHP is not shipping an emergency fix for CVE-2026-115560. Instead, the project recommends disabling a specific feature as the primary mitigation step. Administrators running PHP in non-standard configurations should review their setups and turn off that feature where it is not required. Key points: A new RCE vector, CVE-2026-115560, follows the emergency PHP2Shell patches by two days. Exploitation depends on an unusual web application configuration, so PHP rates the risk as unlikely. No emergency patch is planned; the recommended action is to disable the affected feature. Given that this arrives so soon after the PHP2Shell fixes, teams should confirm which PHP configurations they actually run and apply the recommended setting change rather than waiting for a patch. Source: The Hacker News Does your organization rely on the feature PHP is recommending to disable, and if so, how are you handling the trade-off?

Pillow, the widely used image processing library for Python, has a serious security issue that could allow attackers to execute operating system commands on a server. The vulnerability is tracked as CVE-2026-112900 and stems from how Pillow handles EPS image files. When opening an EPS image, Pillow passes the file name to Ghostscript, a separate program it invokes to convert the image into pixels. The problem is that Pillow does this without validating or checking the file name first, which opens the door to command injection. An attacker who can supply a crafted image could abuse this behavior to run arbitrary OS commands on the affected server. Key points: Affected component: Pillow EPS image handling Root cause: file names passed to Ghostscript without validation Impact: potential operating system command execution Attack vector: a crafted image supplied to the application If your applications accept user-uploaded images and use Pillow to process them, this is worth prioritizing. Review any code paths that open EPS files, and consider restricting EPS processing or isolating image conversion from the host environment until a fix is available. Source: The Hacker News Does your organization process user-supplied images with Pillow, and if so, how are you planning to mitigate this?

Threat actors have been attempting to exploit the newly disclosed PHP2Shell vulnerabilities in an effort to recruit infected systems into a Mirai botnet variant known as Potassium. According to reporting, these attempts have so far been unsuccessful, and it appears that weaponizing the flaws may be more difficult than initially assumed. The attacks target CVE-2026-109618 and CVE-2026-109619, both of which carry a CVSS score of 9.2. These vulnerabilities can result in unauthenticated remote exploitation, which explains the high volume of exploit attempts observed against exposed systems. Key points for defenders: The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS scale. Exploitation attempts are widespread, but current efforts to deploy the Potassium Mirai variant have not succeeded. The difficulty of reliably weaponizing the flaws may be limiting attackers' success for now. Despite failed attempts, the high severity rating and automated scanning activity mean exposed systems should still be treated as at risk. Organizations running affected PHP deployments should prioritize patching and monitor for exploit attempts targeting these vulnerabilities, as botnet operators continue to probe for weaknesses at scale. Source: [email protected] (The Hacker News) Has your organization seen scanning or exploitation attempts targeting these PHP2Shell flaws, and how are you handling mitigation?

This week has been a busy one for security teams, with a cluster of critical vulnerabilities and supply chain incidents demanding attention. Among the most significant are serious remote code execution flaws in PHP and GitLab, alongside notable Linux security bugs and a Node.js RCE issue. Certificate trust also took a hit, with eMudhra certificates reported as compromised. On the software supply chain side, a LiteLLM release was found to have been hacked, and hundreds of Tor relays were hijacked. Separately, an authentication bypass affecting Laravel applications has been flagged, and a flaw in Signal related to call handling was also disclosed. The reporting also touches on leaked AI secrets and source code theft involving PingCAP, underscoring that credential and data exposure incidents are continuing alongside traditional vulnerability disclosures. The source notes that these items are only part of a larger roundup, with many more stories covered beyond the headline issues. Review exposure to the PHP and GitLab RCE flaws and patch where applicable Audit reliance on eMudhra certificates Verify the integrity of any LiteLLM deployments Check Laravel authentication configurations and Node.js dependencies Treat leaked secrets as compromised and rotate them promptly Source: [email protected] (The Hacker News) Has your organization already started patching the PHP or GitLab flaws, or are you still assessing exposure?

Arista has disclosed a critical zero-day vulnerability in VeloCloud Orchestrator (VCO), the central management system used to administer VeloCloud SD-WAN networks. According to the company's advisory published on October 22, the SQL injection flaw is already being exploited in real-world attacks. The most concerning aspect of this vulnerability is how little access an attacker needs to abuse it. Anyone who can authenticate to the orchestrator — including a user holding only a read-only customer account — can exploit the flaw to escalate their privileges to operator level, which is the highest tier of control over the system. Key points to be aware of: The vulnerability is a SQL injection issue in VeloCloud Orchestrator (VCO). Exploitation requires only a valid login; a low-privileged read-only account is sufficient. Successful exploitation grants operator privileges, the top level of control over the orchestrator. The flaw is a zero-day and has been observed exploited in active attacks. Arista published its advisory on October 22. If your organization runs VeloCloud SD-WAN, review the advisory directly and apply any guidance or fixes Arista has issued. Given that a read-only account is enough to weaponize this flaw, auditing orchestrator accounts and their access levels should be a priority while remediation is underway. Source: [email protected] (The Hacker News) Does your organization run VeloCloud Orchestrator, and if so, how are you approaching mitigation?

Arista Networks has released security updates to address an actively exploited zero-day vulnerability impacting VeloCloud Orchestrator (VCO) On-Prem deployments. The company confirmed the flaw is being exploited in the wild, making patching a priority for organizations running the on-premises version of the orchestrator. The affected product is VeloCloud Orchestrator On-Prem, and administrators are urged to apply the available updates as soon as possible. Arista has not disclosed specific technical details about the exploitation activity in the advisory. Identify any VeloCloud Orchestrator On-Prem instances in your environment Apply the latest security updates from Arista without delay Monitor for signs of compromise and review access logs on exposed VCO deployments Given that the vulnerability is under active exploitation, delaying patching leaves on-prem orchestrators exposed to potential attack. Organizations should treat this with urgency and verify that all VCO instances are running the fixed release. Source: BleepingComputer Does your organization run VeloCloud Orchestrator on-prem, and have you already scheduled the update?

Researchers at Amazon Threat Intelligence report that attackers started exploiting the PHP2Shell vulnerabilities four days before patches for the flaws became available on Wednesday. The exploitation activity predates the public fix, indicating that threat actors were already active against vulnerable systems while defenders had no vendor patch to apply. At this stage, the source material does not provide specific identifiers, affected version lists, or indicators of compromise beyond the exploitation timeline, so details beyond what has been published should be treated cautiously. Organizations running PHP-based services should prioritize reviewing their exposure and apply the vendor patches as soon as possible, while monitoring for signs of compromise that may date back to the pre-patch exploitation window. Given that attacks began before fixes existed, a patching-only response may not be sufficient. Teams should also review logs from the days preceding the patch release and consider whether any suspicious activity occurred during that period. Source: Unknown Has your organization checked for signs of PHP2Shell exploitation dating back to before the patches were released?

GitLab has released security patches addressing a maximum-severity vulnerability in its Regular Expression Compiler that could allow remote attackers to execute arbitrary code on vulnerable servers, the company has warned. The flaw carries the highest possible severity rating, meaning organizations running affected GitLab deployments should treat patching as an urgent priority. Successful exploitation could give an unauthenticated attacker a path to run their own code on the server, which in a source-code management platform like GitLab is a serious exposure given the sensitive repositories and CI/CD pipelines it typically hosts. Affected administrators are advised to: Apply the latest security patches from GitLab without delay Review their GitLab instance version against the vendor's patched releases Monitor for signs of unexpected or unauthorized activity on exposed instances Restrict public exposure of GitLab servers where operationally feasible The advisory does not provide a specific CVE identifier in the details available, so teams should refer directly to GitLab's official security release announcement to confirm which versions are affected and which builds contain the fix. As with any critical remote code execution issue, delaying the update leaves the instance open to potential exploitation, and self-managed installations that face the internet carry the greatest risk. Source: Unknown Have you already patched your GitLab instance, or are you still mapping out the upgrade window?

The PHP security team has pushed out emergency patches addressing two critical remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed PHP2Shell. Because these vulnerabilities allow remote code execution, successful exploitation could let an attacker run arbitrary code on affected systems, making them a high-priority fix for anyone running PHP in production. Details on the exact affected versions and exploitation conditions are limited in the initial advisory, so administrators should treat this as urgent and apply the available patches as soon as possible rather than waiting for further clarification. Given the severity classification, delaying updates leaves systems exposed to potential compromise. Recommended actions: Apply the emergency patches released by the PHP security team immediately. Review your exposure to PHP-based services and prioritize internet-facing deployments. Monitor vendor channels for updated guidance on affected versions. Source: Unknown Has your organization already patched, or are you still assessing which systems are running affected PHP versions?

A researcher has disclosed an unpatched vulnerability in Broadcom's Wi-Fi setup software that allows an attacker within radio range to execute code as root on affected routers. The disclosure comes from security researcher Quentin Kaiser, who published details on October 16. The most concerning aspect of this flaw is that exploitation requires no network password and no pairing step. An attacker only needs to be within Wi-Fi range of a vulnerable device to attempt the attack. Kaiser demonstrated the attack working against home gateways provided by three Belgian internet providers. In one of those cases, he was able to read the Wi-Fi password directly off the device. The flaw remains unpatched, meaning Broadcom-based routers that rely on the affected setup software may still be exposed. At the time of reporting, no specific CVE identifier, advisory number, or patch version was provided. Affected users should monitor vendor advisories from Broadcom and their router or ISP provider for updates, and consider restricting Wi-Fi setup or WPS-style functionality where possible until a fix is available. Source: The Hacker News Is your organization running Broadcom-based routers or ISP-supplied gateways that could be exposed to this flaw?

A critical flaw in Docker Hub, the registry used to publish and download container images, allowed one user to push, pull, or delete images while authenticated as another user. Docker fixed the flaw on September 30 and stated that it found no evidence of exploitation in the wild. According to a security advisory published on October 12, the issue resided in the feature that converts a personal account into an organization. The vulnerability had reportedly existed for roughly two years before being addressed. Key points: Docker Hub users could potentially act on images under another user's identity due to the flaw. The vulnerability was tied to the personal-to-organization account conversion feature. Docker patched the issue on September 30. A security advisory was published on October 12. Docker says it has no evidence that the flaw was exploited. No specific CVE ID or advisory identifier was provided in the source article. Administrators and users who rely on Docker Hub for image distribution should review the advisory and ensure their workflows align with Docker's current guidance. Source: The Hacker News Has your organization reviewed its Docker Hub account and organization conversion settings since this advisory was published?

Microsoft has released its largest Patch Tuesday update to date, addressing 1,413 vulnerabilities in a single rollout. Among the fixes is a Windows Shell flaw that Microsoft says is already being exploited in the wild. The update breakdown by product is substantial: 1,102 flaws in Windows 134 in Office 61 in Developer Tools 36 in SharePoint Server 22 in SQL Server By vulnerability type, more than 670 relate to privilege escalation, followed by over 300 remote code execution issues. With a volume this large and at least one flaw under active exploitation, patching should be treated as a priority rather than a routine monthly task. Organizations should review their exposure to the affected products and expedite deployment where feasible, particularly for internet-facing systems and anything covered by the actively exploited Windows Shell bug. Source: The Hacker News Has your organization started rolling out this month's patches, and are you prioritizing any product group first?

Researchers at ThreatFabric have disclosed a new Android banking trojan dubbed Hirudo that takes a different approach from typical overlay or accessibility-based malware. Instead of injecting fake screens on top of legitimate apps, Hirudo replaces genuine banking applications with purpose-built patched versions that disable the apps' own built-in security checks from the inside. The Dutch mobile security firm found that the trojan targets the financial sector in Indonesia, with replacements identified for eight Indonesian banking applications. By running a modified version of the actual banking app, Hirudo can bypass protections that would normally detect tampering or hostile environments, making the fraud harder for both users and the banks' own defenses to spot. This technique represents a notable escalation in financial fraud on Android, since the malicious app inherits the trust and functionality of the real one while the security mechanisms are stripped away. Key points: Hirudo is an Android banking trojan analyzed by ThreatFabric. It swaps legitimate banking apps for patched versions that bypass the apps' internal security checks. Replacements were found for eight Indonesian banking applications. The approach differs from overlay-based trojans by operating from within a modified legitimate app. Source: The Hacker News Does your organization have controls in place to detect repackaged or tampered banking apps on user devices?

A team at security firm XBOW has demonstrated a full-chain Google Chrome exploit built with the help of a publicly available OpenAI model, chaining three previously unknown Chrome bugs into a single attack that executes code on a Windows machine when the victim simply loads a web page. The researchers assembled the exploit in six days by directing AI agents running OpenAI's public GPT-5.6 Sol model. According to the company, the resulting chain was valued at $250,000. Google has since confirmed all three vulnerabilities, fixed them, and paid XBOW its top bounty for the report. Key points: Three then-unknown Chrome bugs were chained into one full exploit The attack achieves code execution on Windows from mere page load, with no additional user interaction described The exploit was developed in six days using AI agents driven by GPT-5.6 Sol Google confirmed and patched all three issues and paid the top bounty The disclosure highlights how quickly AI-assisted tooling can be applied to vulnerability research, and why keeping Chrome updated matters even when individual bug details are not public. Source: The Hacker News Has your organization adjusted patch timelines for browsers in light of AI-accelerated exploit development?

Attackers are actively exploiting an OS command injection flaw in SiteGuard Server Edition, a web application firewall, to execute commands with root or SYSTEM privileges on affected servers. Successful exploitation gives an attacker the highest level of access on the host, making this a serious risk for any organization running the product. The vulnerability stems from improper handling of input that allows injected operating system commands to run on the underlying server. Because the flaw can be triggered remotely, exposed SiteGuard instances should be treated as potentially compromised until patched and reviewed. Key points: Affected product: SiteGuard Server Edition Impact: arbitrary command execution as root (Linux) or SYSTEM (Windows) Attack status: exploitation has been observed in the wild Recommended actions for administrators: Apply the vendor's latest security update as soon as possible Restrict management interface access to trusted networks only Review server logs for suspicious command execution or unexpected processes Consider isolating or rebuilding any instance showing signs of compromise If you run SiteGuard in your environment, prioritize patching and check for signs of unauthorized access before assuming the system is clean. Source: Unknown Is your organization running SiteGuard Server Edition, and have you already applied the vendor's fix?

The curl project has patched a memory corruption issue affecting how the tool handles HTTP/2 uploads. The flaw allows a malicious server receiving an upload to corrupt the uploading client's memory, and the researcher who reported it was able to turn that corruption into code execution on the client machine. The fix landed on October 14 in curl 8.23.0. Exploiting this in the wild is not straightforward. Taking over a client requires exact knowledge of its specific build and memory layout, which significantly narrows the pool of practical targets. According to the curl project, a real-world attack is expected to result in a crash rather than reliable compromise. Update to curl 8.23.0 or later to address the flaw. Treat uploads to untrusted or attacker-controlled HTTP/2 servers as a potential risk until patched. Note: The project has not published a specific advisory identifier for this issue in the available reporting. Source: The Hacker News Has your organization already rolled out curl 8.23.0, or are you still assessing exposure across your build pipelines?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent call for organizations to update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version. The advisory follows the disclosure of a vulnerability that is being actively exploited in the wild. The flaw, tracked as CVE-2026-104935, carries a CVSS score of 8.6 and is an authentication bypass affecting ICS. Given the active exploitation, CISA is recommending immediate patching rather than waiting for a scheduled maintenance window. Adding to the urgency, honeypots have logged 105 exploit attempts targeting the vulnerability, indicating that attackers are already scanning for and attempting to leverage exposed appliances. Key points for defenders: Update Ivanti Connect Secure appliances and deployments to the latest version as soon as possible. Treat internet-facing ICS appliances as high-priority assets given the active exploitation and honeypot activity. Review your exposure and confirm patch status across all ICS instances. Source: The Hacker News Has your organization already patched its Ivanti Connect Secure appliances, or are you still working through the update?