Vulnerability intelligence

CVE-2026-96951 is a command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass security features over a network. Specifically, successful exploitation enables attackers to evade Mark of the Web (MOTW) defenses, which are trust boundary mechanisms designed to trigger Protected View in Microsoft Office documents and SmartScreen warnings for downloaded executables. The vulnerability can be triggered when Windows generates a thumbnail or preview of a file, meaning a user does not necessarily have to open the file to initiate the exploit. In typical attack scenarios, an attacker delivers a specially crafted file to a target via email, instant messaging, or web downloads. Microsoft has confirmed that this vulnerability is being actively exploited in the wild. Consequently, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft addressed the vulnerability in its October 2026 cumulative security updates.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-110447 is an OS command injection vulnerability affecting the Collabora Online Built-in CODE Server (`richdocumentscode`) Nextcloud app in versions prior to 26.4.303. The flaw resides in the `proxy.php` file and is triggered when the CODE server is not running, such as immediately following a system restart. During this state, the wrapper launches the Collabora AppImage via a PHP execution call that fails to properly neutralize externally-influenced input. Attackers can exploit this by sending crafted HTTP GET requests containing encoded path traversal sequences (`%2e%2e`) to the status endpoint, allowing them to execute arbitrary commands on the host. Standalone Collabora Online servers are unaffected by this issue. This vulnerability has been actively exploited in the wild, with threat actors using it to deploy PHP webshells on exposed servers. Once access is established under the web server account, attackers have been observed executing discovery commands to search for password databases—such as Bitwarden, 1Password, and `.kdbx` files—as well as cryptocurrency wallets. To mitigate this risk, administrators are advised to update the Nextcloud app to version 26.4.303 or later and audit their systems for potential indicators of compromise.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-96656 is an external control of file name or path vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw allows an administrator—or an attacker who has obtained administrative privileges—to write arbitrary files, specifically ELF shared objects (`.so` files), to an attacker-chosen path within the server's Codecs directory. Because Plex Media Server loads and executes all `.so` files in this directory at startup without verifying signatures, execute bits, or symbols, this arbitrary file write leads to code execution. Additionally, the vulnerability involves the `TranscoderH264Options` preference, which is appended verbatim to the x264 option string during transcoding. This vulnerability serves as the final stage of a four-part exploit chain known as "Plex2Shell," which also includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. When combined, these flaws allow unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit in October 2026, threat actors began actively targeting unpatched servers in the wild to deploy payloads such as XMRig cryptocurrency miners and reverse proxy software. Plex addressed the issue in an update released in August 2026.