Trending now

CVE-2026-118306 is a memory corruption vulnerability residing in the FileSystem component of Google Chrome. The flaw affects Google Chrome versions prior to 156.0.8078.73. It is triggered when a user interacts with a specially crafted HTML page, allowing a remote attacker to exploit the underlying memory corruption. If successfully exploited, the vulnerability allows a remote attacker to potentially execute arbitrary code outside of the browser's sandbox environment. The exploit can be initiated over a network without requiring any special privileges, though it does depend on user interaction to be executed. Google has addressed this issue in the 156.0.8078.73 update.

CVE-2026-118344 is a use-after-free vulnerability identified in the Layout component of Google Chrome. Discovered and reported by security researcher Xinyang Ge, the flaw allows a remote attacker to execute arbitrary code within the browser's sandbox environment. This exploitation can be triggered when a user is induced to visit a specially crafted HTML page designed to target the vulnerability. The vulnerability affects Google Chrome versions prior to 156.0.8078.73. Google addressed the issue in a Stable channel update, releasing version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users are advised to update their browsers to the latest version to mitigate the risk of potential exploitation.

CVE-2026-118331 is a vulnerability affecting Google Chrome and other Chromium-based browsers, such as Microsoft Edge, prior to version 156.0.8078.73. The issue stems from improper input validation within the browser's FileAPI component. A remote attacker could exploit this flaw by convincing a user to visit a specially crafted HTML page, potentially allowing the attacker to execute arbitrary code within the browser's sandboxed environment. The vulnerability was discovered and reported by Anthropic researcher Xinyang Ge, who utilized the Claude AI model to assist in identifying the flaw. Google addressed the issue in late October 2026 with the release of Chrome version 156.0.8078.73/.74 for Windows and macOS, and 156.0.8078.73 for Linux. Users and administrators are advised to update their browsers to the latest version to mitigate the risk of exploitation.

CVE-2026-118348 is a security vulnerability stemming from improper input validation within Skia, a 2D graphics library utilized by Chromium-based web browsers. The flaw affects Google Chrome versions prior to 156.0.8078.73, as well as other browsers built on the Chromium engine, such as Microsoft Edge. The vulnerability allows a remote attacker to potentially execute arbitrary code inside the browser's sandbox. To exploit this flaw, an attacker would typically need to lure a user into visiting a specially crafted HTML page. To mitigate the risk, users are advised to update their browsers to version 156.0.8078.73 or later.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.

**CVE-2026-106072** is a certificate validation vulnerability in Node.js that affects the 22.x, 24.x, and 26.x release lines. The issue arises when a client attempts to connect to an IPv4 address written in a non-canonical format, such as a shortened or hexadecimal string. Because Node.js fails to recognize these non-standard formats as IP addresses during TLS hostname verification, it falls back to matching the certificate's DNS Subject Alternative Names (SANs) instead of its IP address entries. However, the underlying operating system still resolves and connects to the numeric IP address. This discrepancy allows an attacker who possesses a certificate with a DNS SAN matching the non-canonical string to authenticate an IP endpoint that the certificate was never meant to cover, potentially establishing a verified TLS session. This scenario is particularly relevant in environments utilizing private PKI, internal CAs, or mutual TLS. The vulnerability was addressed in the Node.js security updates released on October 21, 2026 (specifically versions 22.23.4, 24.22.1, and 26.12.1) by ensuring that TLS rejects non-canonical IP addresses and correcting hostname normalization checks.

CVE-2026-81963 is an elevation-of-privilege vulnerability found within the Windows Update Stack, the component responsible for managing and installing Windows updates. The flaw arises from two primary weaknesses: improper link resolution before file access, often referred to as "link following," and inadequate access control. A locally authenticated attacker with low privileges can exploit these weaknesses to elevate their privileges to SYSTEM level. This exploitation can occur without requiring any user interaction. Microsoft addressed this vulnerability as part of its September 2026 Patch Tuesday release, affecting various versions of Windows 11 and Windows Server 2025.