Trending now

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-108142 is an authorization bypass vulnerability in Veeam Backup & Replication, disclosed by Veeam on October 27, 2026, in its security advisory KB4948. Reported through HackerOne, the flaw allows an unauthenticated attacker to bypass access checks on the CDP Coordinator Service. The vulnerability affects both Windows-based deployments and the Veeam Software Appliance. The issue impacts Veeam Backup & Replication version 13.1.1.18 and earlier builds in the 13.1 branch, as well as version 13.0.2.29 and earlier builds in the 13.0 branch, while version 12.x is unaffected. Veeam has resolved the vulnerability in Backup & Replication versions 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63).

CVE-2026-112507 is an out-of-bounds write vulnerability affecting the kernel of Apple's iOS and iPadOS operating systems. Discovered by security researcher Tim Michaud of Aginor.ai, the flaw allows a malicious application running on a device to trigger unexpected system termination or write directly to kernel memory. This type of memory corruption can potentially be leveraged by attackers to bypass security boundaries or execute unauthorized actions on the affected device. Apple resolved the issue by implementing improved bounds checking to prevent unauthorized memory writes. The fix was rolled out on October 26, 2026, as part of the security updates in iOS 27.2 and iPadOS 27.2, which are available for iPhone 11 and later, as well as various iPad models. Users are advised to update their devices to the latest versions to mitigate the risk.

CVE-2026-86990 is an access-control vulnerability affecting Apple's CoreMedia framework, which is used to handle multimedia across various Apple operating systems. Discovered and reported by security researcher Mustafa Calap, the flaw allows a malicious application installed on a device to access the camera without obtaining the user's permission. Unlike other vulnerabilities patched in the same release cycle, there have been no reports of this specific flaw being actively exploited in the wild. Apple resolved the issue by implementing tightened access restrictions within the CoreMedia component. The fix has been deployed across a wide range of Apple platforms, including updates for iOS and iPadOS (versions 18.7.11, 26.7.2, and 27.2), macOS Golden Gate (27.2), macOS Tahoe (26.7.2), and visionOS (27.2). This ensures protection for both newer and older supported devices, such as iPhones, iPads, Macs, and Apple Vision Pro headsets.

CVE-2026-112697 is a use-after-free vulnerability in WebKit, the web browser engine utilized by Apple's Safari and various in-app browsers. Discovered by OpenAI Codex Security researchers Amy Burnett and Euntae Jang, the flaw occurs when processing maliciously crafted web content. If triggered, this memory handling error can allow a remote attacker to execute arbitrary code on a target device. Apple addressed the vulnerability by implementing improved memory management in its software updates released on October 26, 2026. The fix is included in Safari 27.2, iOS 27.2 and iPadOS 27.2 (as well as iOS 26.7.2 and iPadOS 26.7.2), macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. At the time of the patch's release, there were no reports of the vulnerability being actively exploited in real-world attacks.

CVE-2025-24071 involves the exposure of sensitive information in Windows File Explorer, potentially allowing an attacker to perform spoofing over a network. This vulnerability arises from how Windows Explorer handles specially crafted .library-ms files within RAR/ZIP archives. When such an archive is extracted, Windows Explorer automatically parses the .library-ms file due to its indexing and preview mechanisms. If the .library-ms file contains a SimpleLocation tag pointing to an attacker-controlled SMB server, Windows Explorer attempts to resolve this path, triggering an NTLM authentication handshake and potentially sending the victim's NTLMv2 hash without explicit user interaction. This implicit trust and automatic processing of certain file types upon extraction can be exploited to leak credentials.

CVE-2026-84496 is an out-of-bounds write vulnerability affecting the Apple File System (APFS) in macOS. The issue occurs when the operating system attempts to mount a maliciously crafted disk image. If triggered, this flaw can cause unexpected system termination or corrupt the system's kernel memory. The vulnerability was discovered and reported to Apple by a collaborative group of security researchers, including Maher Azzouzi, Jonathan Bar Or, and several others. Apple resolved the issue by implementing improved bounds checking to prevent unauthorized out-of-bounds writes. The security patch was released on October 26, 2026, and is included in the macOS Golden Gate 27.2 and macOS Tahoe 26.7.2 software updates.

CVE-2026-112443 is a security vulnerability affecting the Wi-Fi component in Apple operating systems, including macOS Golden Gate and macOS Tahoe. Discovered by security researcher Nathaniel Oh (@calysteon), the flaw stems from a memory handling issue. If exploited, an attacker within radio range of the target device can trigger unexpected system termination, or a malicious application can cause system termination and corrupt process memory. Apple addressed this vulnerability in its October 26, 2026 security updates by implementing improved memory handling mechanisms. Users can resolve the issue by updating their systems to the latest versions, such as macOS Golden Gate 27.2 or macOS Tahoe 26.7.2.

**CVE-2026-112511** is a path handling vulnerability affecting Apple's macOS Screen Sharing Server. Discovered by security researcher Nathaniel Oh (@calysteon), the flaw stems from improper path handling logic within the Screen Sharing component. If exploited, a malicious Screen Sharing peer can leverage this issue to create arbitrary symbolic links (symlinks) with root privileges on the target system. Apple addressed this vulnerability by implementing improved path handling logic in its security updates released in October 2026. The fix is included in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Users are advised to update their systems to these versions or later to mitigate the risk of exploitation.