Trending now

CVE-2026-118306 is a memory corruption vulnerability residing in the FileSystem component of Google Chrome. The flaw affects Google Chrome versions prior to 156.0.8078.73. It is triggered when a user interacts with a specially crafted HTML page, allowing a remote attacker to exploit the underlying memory corruption. If successfully exploited, the vulnerability allows a remote attacker to potentially execute arbitrary code outside of the browser's sandbox environment. The exploit can be initiated over a network without requiring any special privileges, though it does depend on user interaction to be executed. Google has addressed this issue in the 156.0.8078.73 update.

CVE-2026-118331 is a vulnerability affecting Google Chrome and other Chromium-based browsers, such as Microsoft Edge, prior to version 156.0.8078.73. The issue stems from improper input validation within the browser's FileAPI component. A remote attacker could exploit this flaw by convincing a user to visit a specially crafted HTML page, potentially allowing the attacker to execute arbitrary code within the browser's sandboxed environment. The vulnerability was discovered and reported by Anthropic researcher Xinyang Ge, who utilized the Claude AI model to assist in identifying the flaw. Google addressed the issue in late October 2026 with the release of Chrome version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users and administrators are advised to update their browsers to the latest version to mitigate the risk of exploitation.

CVE-2026-118344 is a use-after-free vulnerability identified in the Layout component of Google Chrome. Discovered and reported by security researcher Xinyang Ge, the flaw allows a remote attacker to execute arbitrary code within the browser's sandbox environment. This exploitation can be triggered when a user is induced to visit a specially crafted HTML page designed to target the vulnerability. The vulnerability affects Google Chrome versions prior to 156.0.8078.73. Google addressed the issue in a Stable channel update, releasing version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users are advised to update their browsers to the latest version to mitigate the risk of potential exploitation.

CVE-2026-118348 is a security vulnerability stemming from improper input validation within Skia, a 2D graphics library utilized by Chromium-based web browsers. The flaw affects Google Chrome versions prior to 156.0.8078.73, as well as other browsers built on the Chromium engine, such as Microsoft Edge. The vulnerability allows a remote attacker to potentially execute arbitrary code inside the browser's sandbox. To exploit this flaw, an attacker would typically need to lure a user into visiting a specially crafted HTML page. To mitigate the risk, users are advised to update their browsers to version 156.0.8078.73 or later.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2025-1974 is a vulnerability within the Ingress NGINX Controller for Kubernetes, specifically affecting the admission controller component. This flaw falls under a group of vulnerabilities collectively known as "IngressNightmare." The vulnerability arises because the admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject arbitrary NGINX configurations. This results in code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, which could lead to a complete cluster takeover.

CVE-2026-114820 is a security vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, specifically within the Java Secure Socket Extension (JSSE) component. The issue is tied to a certificate trust compromise involving the private keys of eight intermediate Certificate Authority (CA) certificates issued by eMudhra. In response, Oracle released updates to remove the affected root CA certificates—such as emSign Root CA and AAA Certificate Services—from the Java trust store to prevent unauthorized trust decisions. An unauthenticated attacker with network access can exploit this vulnerability across multiple protocols without requiring user interaction. By intercepting network traffic, an attacker can impersonate trusted websites and services, enabling them to read, modify, or delete data accessible to the affected Java runtime. The vulnerability also applies to client-side Java deployments, such as sandboxed Java Web Start applications or applets that load untrusted code. Remediation involves updating the Java runtime to a patched version or manually removing the compromised root certificates from the system's keystore.

CVE-2026-115560 is a remote code execution (RCE) vulnerability in PHP's session upload progress feature, which was disclosed by the PHP project in October 2026. The vulnerability stems from the inconsistent handling of session data when an application changes its serialization formats during request processing. It specifically affects environments where the `session.serialize_handler` is initially configured as `php_binary` or `php_serialize`, but is subsequently changed to `php` at runtime using `ini_set()` before `session_start()` is called, while the session upload progress feature remains active. Because this vulnerability requires a highly specific and uncommon combination of configuration settings and application code, the PHP security team has characterized it as an unlikely vector in practice. As a result, the issue is being addressed through PHP's routine release cycle rather than an emergency patch. Until a formal update is released, the recommended mitigation is to disable the session upload progress feature by setting `session.upload_progress.enabled = 0` in the PHP configuration.