Vulnerability intelligence

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-108142 is an authorization bypass vulnerability in Veeam Backup & Replication, disclosed by Veeam on October 27, 2026, in its security advisory KB4948. Reported through HackerOne, the flaw allows an unauthenticated attacker to bypass access checks on the CDP Coordinator Service. The vulnerability affects both Windows-based deployments and the Veeam Software Appliance. The issue impacts Veeam Backup & Replication version 13.1.1.18 and earlier builds in the 13.1 branch, as well as version 13.0.2.29 and earlier builds in the 13.0 branch, while version 12.x is unaffected. Veeam has resolved the vulnerability in Backup & Replication versions 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63).

CVE-2026-46300, dubbed "Fragnesia," is a local privilege escalation (LPE) vulnerability found in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows an unprivileged local attacker to perform arbitrary byte writes into the kernel page cache of read-only files. The vulnerability arises from a logic error where `skb_try_coalesce()` fails to propagate the `SKBFL_SHARED_FRAG` marker, causing the kernel to lose track of externally backed fragments. This page-cache corruption can be exploited to modify the in-memory cached copies of read-only files, such as `/usr/bin/su`, enabling an unprivileged process to gain root privileges. Fragnesia is the third LPE vulnerability discovered by William Bowling of the V12 security team in the same general area of the Linux kernel (IPsec ESP / rxrpc), following "Copy Fail" and "Dirty Frag." A public proof-of-concept exploit for CVE-2026-46300 is available.

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

CVE-2026-48356 is an unrestricted file upload vulnerability affecting Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe I/O Events connector for Commerce. The flaw arises from insufficient validation of uploaded file types, allowing attackers to upload files without adequate restrictions on their extension or MIME classification. This enables attackers to place content on the system that a web server interprets as an executable script. Successful exploitation requires user interaction—such as a victim visiting a maliciously crafted URL or interacting with a compromised page—and can lead to arbitrary code execution in the context of the current user, potentially granting the attacker elevated access or control over the victim's session. Also known as "PolyShell," the vulnerability has been actively exploited in the wild, with activity traced back to at least July 2025. Security researchers have observed attackers leveraging the flaw to breach hundreds of e-commerce stores, injecting malicious loaders via Magento CMS blocks to fetch and execute attacker-controlled payloads. Due to this active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog in October 2026. Adobe addressed the issue in its July 2026 security updates (APSB26-73), and organizations are advised to apply the patches and inspect their systems for unauthorized file uploads.