Vulnerability intelligence

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-84496 is an out-of-bounds write vulnerability affecting the Apple File System (APFS) in macOS. The issue occurs when the operating system attempts to mount a maliciously crafted disk image. If triggered, this flaw can cause unexpected system termination or corrupt the system's kernel memory. The vulnerability was discovered and reported to Apple by a collaborative group of security researchers, including Maher Azzouzi, Jonathan Bar Or, and several others. Apple resolved the issue by implementing improved bounds checking to prevent unauthorized out-of-bounds writes. The security patch was released on October 26, 2026, and is included in the macOS Golden Gate 27.2 and macOS Tahoe 26.7.2 software updates.

CVE-2026-48356 is an unrestricted file upload vulnerability affecting Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe I/O Events connector for Commerce. The flaw arises from insufficient validation of uploaded file types, allowing attackers to upload files without adequate restrictions on their extension or MIME classification. This enables attackers to place content on the system that a web server interprets as an executable script. Successful exploitation requires user interaction—such as a victim visiting a maliciously crafted URL or interacting with a compromised page—and can lead to arbitrary code execution in the context of the current user, potentially granting the attacker elevated access or control over the victim's session. Also known as "PolyShell," the vulnerability has been actively exploited in the wild, with activity traced back to at least July 2025. Security researchers have observed attackers leveraging the flaw to breach hundreds of e-commerce stores, injecting malicious loaders via Magento CMS blocks to fetch and execute attacker-controlled payloads. Due to this active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog in October 2026. Adobe addressed the issue in its July 2026 security updates (APSB26-73), and organizations are advised to apply the patches and inspect their systems for unauthorized file uploads.

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.