Trending now

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP handshake path, affecting kernels dating back to version 4.4. The flaw stems from a race condition involving the ownership and reclamation of IPv4 option data (such as Timestamp or Record Route options) associated with a TCP request socket. When a connection progresses, two processors can act on related request and child sockets while referencing the same IP options object. This allows one path to free the object while another continues to use it, resulting in a stale kernel pointer that can be reached through network traffic. The vulnerability gained significant attention after Anthropic demonstrated that its AI model, Claude, could generate a proof-of-concept exploit for it. The exploit targets Linux servers running a multipath TCP (MPTCP) listener, allowing a remote, unauthenticated attacker to execute arbitrary commands as root. It achieves this in two stages: first, by exploiting the race condition to leak a kernel pointer and bypass Kernel Address Space Layout Randomization (KASLR), and second, by triggering the use-after-free to overflow a buffer and overwrite a callback pointer with a staged payload. The vulnerability has since been patched upstream and backported to all maintained stable kernel branches.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-76418 is a vulnerability affecting the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The issue stems from logic errors—specifically an unchecked return value leading to a NULL pointer dereference—when secondary authentication is configured on a tunnel group. An unauthenticated, remote attacker can exploit this flaw by sending a crafted request while connecting to the SSL remote access VPN, which triggers an unexpected device reload and results in a denial of service (DoS) condition. A successful VPN login is not required to reach the vulnerable code path. In October 2026, Cisco's Product Security Incident Response Team (PSIRT) identified active exploitation of this vulnerability in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. While Cisco has released software updates to resolve the issue, there are no official workarounds. Organizations unable to immediately apply the patches can temporarily mitigate the risk by disabling secondary authentication on the default or user-configured tunnel groups.

CVE-2024-21413 is a remote code execution (RCE) vulnerability affecting Microsoft Outlook. It stems from improper input validation when Outlook processes URLs, particularly those using the `file://` protocol and crafted URL structures. This vulnerability, also known as the "MonikerLink" bug, allows attackers to bypass security protections, such as the Office Protected View, and execute arbitrary code on a victim's machine by sending a malicious email. The vulnerability can be triggered even when previewing a maliciously crafted email. Successful exploitation could lead to remote code execution, theft of NTLM credentials, data exfiltration, data encryption, installation of malware, and potential full system compromise. It affects various versions of Microsoft Outlook, including Microsoft Office 2016, 2019, 2021, and Microsoft 365 Apps.

CVE-2026-113910 is a memory initialization vulnerability discovered by security researcher Tucker Willenborg in Apple's operating systems. The flaw stems from an issue where uninitialized kernel memory is not properly cleared. As a result, an application installed on an affected device could exploit this vulnerability to read and disclose sensitive kernel memory, potentially exposing privileged information such as cryptographic keys or authentication tokens. Apple addressed this issue in October 2026 by implementing improved memory handling across its software ecosystem. The fix has been deployed in security updates for various platforms, including iOS 27.2 and 26.7.2, iPadOS 27.2 and 26.7.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2.

CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom's VMware ESX bare-metal hypervisor. Disclosed and patched by Broadcom in July 2026, the flaw allows a malicious actor with administrative privileges to perform certain operations without them being recorded in the system logs. In October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. According to cybersecurity researchers at CrowdStrike, a China-nexus cyber espionage group known as Warp Panda exploited this vulnerability as a zero-day in early 2026. The threat actor targeted U.S. organizations, particularly within the legal sector, using the flaw to reduce audit trail visibility and cover their tracks. By bypassing audit logging, the group was able to hinder forensic reconstruction and maintain persistent, covert access to compromised environments.

CVE-2026-46300, dubbed "Fragnesia," is a local privilege escalation (LPE) vulnerability found in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows an unprivileged local attacker to perform arbitrary byte writes into the kernel page cache of read-only files. The vulnerability arises from a logic error where `skb_try_coalesce()` fails to propagate the `SKBFL_SHARED_FRAG` marker, causing the kernel to lose track of externally backed fragments. This page-cache corruption can be exploited to modify the in-memory cached copies of read-only files, such as `/usr/bin/su`, enabling an unprivileged process to gain root privileges. Fragnesia is the third LPE vulnerability discovered by William Bowling of the V12 security team in the same general area of the Linux kernel (IPsec ESP / rxrpc), following "Copy Fail" and "Dirty Frag." A public proof-of-concept exploit for CVE-2026-46300 is available.

CVE-2025-65200 is a vulnerability identified in LocalStack, a platform that emulates Amazon Web Services (AWS) cloud environments for local development. The issue specifically affects version 4.9.2 of the software and allows for arbitrary code execution within the context of the running LocalStack Docker container. The vulnerability can be exploited by hosting crafted content on a web-accessible URL and passing that URL as the `templateURL` parameter to the `_localstack/cloudformation/deploy` endpoint. When the endpoint processes this input, the hosted content is executed inside the container, enabling attackers to run unauthorized commands.