Trending now

CVE-2026-108142 is an authorization bypass vulnerability in Veeam Backup & Replication, disclosed by Veeam on October 27, 2026, in its security advisory KB4948. Reported through HackerOne, the flaw allows an unauthenticated attacker to bypass access checks on the CDP Coordinator Service. The vulnerability affects both Windows-based deployments and the Veeam Software Appliance. The issue impacts Veeam Backup & Replication version 13.1.1.18 and earlier builds in the 13.1 branch, as well as version 13.0.2.29 and earlier builds in the 13.0 branch, while version 12.x is unaffected. Veeam has resolved the vulnerability in Backup & Replication versions 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63).

CVE-2026-112697 is a use-after-free vulnerability in WebKit, the web browser engine utilized by Apple's Safari and various in-app browsers. Discovered by OpenAI Codex Security researchers Amy Burnett and Euntae Jang, the flaw occurs when processing maliciously crafted web content. If triggered, this memory handling error can allow a remote attacker to execute arbitrary code on a target device. Apple addressed the vulnerability by implementing improved memory management in its software updates released on October 26, 2026. The fix is included in Safari 27.2, iOS 27.2 and iPadOS 27.2 (as well as iOS 26.7.2 and iPadOS 26.7.2), macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. At the time of the patch's release, there were no reports of the vulnerability being actively exploited in real-world attacks.

CVE-2026-112507 is an out-of-bounds write vulnerability affecting the kernel of Apple's iOS and iPadOS operating systems. Discovered by security researcher Tim Michaud of Aginor.ai, the flaw allows a malicious application running on a device to trigger unexpected system termination or write directly to kernel memory. This type of memory corruption can potentially be leveraged by attackers to bypass security boundaries or execute unauthorized actions on the affected device. Apple resolved the issue by implementing improved bounds checking to prevent unauthorized memory writes. The fix was rolled out on October 26, 2026, as part of the security updates in iOS 27.2 and iPadOS 27.2, which are available for iPhone 11 and later, as well as various iPad models. Users are advised to update their devices to the latest versions to mitigate the risk.

CVE-2026-86990 is an access-control vulnerability affecting Apple's CoreMedia framework, which is used to handle multimedia across various Apple operating systems. Discovered and reported by security researcher Mustafa Calap, the flaw allows a malicious application installed on a device to access the camera without obtaining the user's permission. Unlike other vulnerabilities patched in the same release cycle, there have been no reports of this specific flaw being actively exploited in the wild. Apple resolved the issue by implementing tightened access restrictions within the CoreMedia component. The fix has been deployed across a wide range of Apple platforms, including updates for iOS and iPadOS (versions 18.7.11, 26.7.2, and 27.2), macOS Golden Gate (27.2), macOS Tahoe (26.7.2), and visionOS (27.2). This ensures protection for both newer and older supported devices, such as iPhones, iPads, Macs, and Apple Vision Pro headsets.

CVE-2025-65200 is a vulnerability identified in LocalStack, a platform that emulates Amazon Web Services (AWS) cloud environments for local development. The issue specifically affects version 4.9.2 of the software and allows for arbitrary code execution within the context of the running LocalStack Docker container. The vulnerability can be exploited by hosting crafted content on a web-accessible URL and passing that URL as the `templateURL` parameter to the `_localstack/cloudformation/deploy` endpoint. When the endpoint processes this input, the hosted content is executed inside the container, enabling attackers to run unauthorized commands.

CVE-2026-46300, dubbed "Fragnesia," is a local privilege escalation (LPE) vulnerability found in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows an unprivileged local attacker to perform arbitrary byte writes into the kernel page cache of read-only files. The vulnerability arises from a logic error where `skb_try_coalesce()` fails to propagate the `SKBFL_SHARED_FRAG` marker, causing the kernel to lose track of externally backed fragments. This page-cache corruption can be exploited to modify the in-memory cached copies of read-only files, such as `/usr/bin/su`, enabling an unprivileged process to gain root privileges. Fragnesia is the third LPE vulnerability discovered by William Bowling of the V12 security team in the same general area of the Linux kernel (IPsec ESP / rxrpc), following "Copy Fail" and "Dirty Frag." A public proof-of-concept exploit for CVE-2026-46300 is available.

CVE-2025-24071 involves the exposure of sensitive information in Windows File Explorer, potentially allowing an attacker to perform spoofing over a network. This vulnerability arises from how Windows Explorer handles specially crafted .library-ms files within RAR/ZIP archives. When such an archive is extracted, Windows Explorer automatically parses the .library-ms file due to its indexing and preview mechanisms. If the .library-ms file contains a SimpleLocation tag pointing to an attacker-controlled SMB server, Windows Explorer attempts to resolve this path, triggering an NTLM authentication handshake and potentially sending the victim's NTLMv2 hash without explicit user interaction. This implicit trust and automatic processing of certain file types upon extraction can be exploited to leak credentials.

CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom's VMware ESX bare-metal hypervisor. Disclosed and patched by Broadcom in July 2026, the flaw allows a malicious actor with administrative privileges to perform certain operations without them being recorded in the system logs. In October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. According to cybersecurity researchers at CrowdStrike, a China-nexus cyber espionage group known as Warp Panda exploited this vulnerability as a zero-day in early 2026. The threat actor targeted U.S. organizations, particularly within the legal sector, using the flaw to reduce audit trail visibility and cover their tracks. By bypassing audit logging, the group was able to hinder forensic reconstruction and maintain persistent, covert access to compromised environments.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.