Trending now

CVE-2026-81983 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Acrobat and Acrobat Reader on Windows and macOS. Disclosed in September 2026 as part of Adobe's APSB26-141 security bulletin, the flaw resides within the application's image pipeline. It stems from an integer overflow where a file-controlled count, computed using 32-bit arithmetic, is trusted as a loop bound. Because the upstream size check shares the same wrapping arithmetic, it fails to validate the input properly, allowing data to be written outside the allocated memory buffer. Exploitation of this vulnerability requires user interaction, meaning a victim must open a specially crafted, malicious PDF document. If a user opens such a file, the memory corruption caused by the out-of-bounds write can allow an attacker to execute arbitrary code within the security context of the current user. The vulnerability was discovered by security researchers using a custom, large language model (LLM)-generated fuzzer that targeted the software's image parsing decoders.

CVE-2026-96951 is a command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass security features over a network. Specifically, successful exploitation enables attackers to evade Mark of the Web (MOTW) defenses, which are trust boundary mechanisms designed to trigger Protected View in Microsoft Office documents and SmartScreen warnings for downloaded executables. The vulnerability can be triggered when Windows generates a thumbnail or preview of a file, meaning a user does not necessarily have to open the file to initiate the exploit. In typical attack scenarios, an attacker delivers a specially crafted file to a target via email, instant messaging, or web downloads. Microsoft has confirmed that this vulnerability is being actively exploited in the wild. Consequently, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft addressed the vulnerability in its October 2026 cumulative security updates.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.

CVE-2026-106069 is a TLS certificate hostname verification bypass vulnerability in Node.js that occurs when a hostname loosely resolves to an IP address or only becomes an IP address after normalization. In affected versions, platform resolvers and normalization functions (such as `url.domainToASCII()`) can interpret non-canonical IP addresses differently. For example, a leading zero in an IP address like `0127.0.0.1` might be interpreted as octal by the normalization function (returning `87.0.0.1`), while the DNS lookup resolves it to `127.0.0.1`. Because Node.js would verify the certificate against the normalized IP, an attacker could use a certificate matching the normalized IP to authenticate a connection that actually routes to the resolved IP, potentially allowing for impersonation or man-in-the-middle attacks. The vulnerability affects Node.js release lines 26.x, 24.x, and 22.x. It was reported by security researcher `anagnorisis2peripeteia` and resolved by Matteo Collina. The fix, introduced in Node.js versions 26.12.1, 24.22.1, and 22.23.4, addresses the issue by rejecting any hostnames that only resolve to an IP address after normalization before any certificate matching takes place.

CVE-2026-105482 is a vulnerability in Node.js that affects the `dns.resolve` function across the 22.x, 24.x, and 26.x release lines. The flaw causes the function to truncate domain names when they contain a NUL (null) character. This behavior can lead to inconsistent name handling, which poses a risk for applications that rely on precise validation of hostnames before executing DNS lookups. The issue was reported by security researcher hasanfleyah and resolved by James M Snell. To address the vulnerability, the Node.js project released updates on October 21, 2026, introducing input validation for null bytes in DNS resolve functions. Users are advised to upgrade to the patched versions, which include Node.js 22.23.4, 24.22.1, and 26.12.1.

**CVE-2026-106072** is a certificate validation vulnerability in Node.js that affects the 22.x, 24.x, and 26.x release lines. The issue arises when a client attempts to connect to an IPv4 address written in a non-canonical format, such as a shortened or hexadecimal string. Because Node.js fails to recognize these non-standard formats as IP addresses during TLS hostname verification, it falls back to matching the certificate's DNS Subject Alternative Names (SANs) instead of its IP address entries. However, the underlying operating system still resolves and connects to the numeric IP address. This discrepancy allows an attacker who possesses a certificate with a DNS SAN matching the non-canonical string to authenticate an IP endpoint that the certificate was never meant to cover, potentially establishing a verified TLS session. This scenario is particularly relevant in environments utilizing private PKI, internal CAs, or mutual TLS. The vulnerability was addressed in the Node.js security updates released on October 21, 2026 (specifically versions 22.23.4, 24.22.1, and 26.12.1) by ensuring that TLS rejects non-canonical IP addresses and correcting hostname normalization checks.

CVE-2026-105481 is an HTTP request-response ordering vulnerability affecting the Node.js JavaScript runtime environment. The flaw impacts the 22.x, 24.x, and 26.x release lines. It occurs within HTTP keep-alive connections, where a keep-alive socket can mistakenly process an incoming response that was written and sent before the corresponding request was actually dispatched. To address this issue, Node.js released security updates on October 21, 2026, which include versions 22.23.4, 24.22.1, and 26.12.1. The patch, developed by James M. Snell, ensures that the HTTP agent's data guard functions correctly without relying on I/O operations. Users are advised to upgrade their Node.js installations to these patched versions to resolve the request-response ordering flaw.

CVE-2026-106074 is a vulnerability in Node.js that affects applications utilizing startup snapshots or single-executable applications (SEAs). The issue stems from the entropy caches used by the `crypto.randomUUID()` and `randomInt()` functions. When an application is built as a startup snapshot or a single-executable application, these entropy caches can be preserved and saved directly into the snapshot. Because the cached randomness is frozen into the application, multiple processes spawned from the same snapshot or executable will repeat the exact same "random" values. This behavior undermines security mechanisms and application logic that rely on these values being unpredictable. To resolve the issue, Node.js has been updated to reset these caches across snapshots, and developers are advised to upgrade their Node.js runtime and rebuild any affected single-executable applications or startup snapshots.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.