Trending now

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.

CVE-2026-106069 is a TLS certificate hostname verification bypass vulnerability in Node.js that occurs when a hostname loosely resolves to an IP address or only becomes an IP address after normalization. In affected versions, platform resolvers and normalization functions (such as `url.domainToASCII()`) can interpret non-canonical IP addresses differently. For example, a leading zero in an IP address like `0127.0.0.1` might be interpreted as octal by the normalization function (returning `87.0.0.1`), while the DNS lookup resolves it to `127.0.0.1`. Because Node.js would verify the certificate against the normalized IP, an attacker could use a certificate matching the normalized IP to authenticate a connection that actually routes to the resolved IP, potentially allowing for impersonation or man-in-the-middle attacks. The vulnerability affects Node.js release lines 26.x, 24.x, and 22.x. It was reported by security researcher `anagnorisis2peripeteia` and resolved by Matteo Collina. The fix, introduced in Node.js versions 26.12.1, 24.22.1, and 22.23.4, addresses the issue by rejecting any hostnames that only resolve to an IP address after normalization before any certificate matching takes place.

CVE-2026-105482 is a vulnerability in Node.js that affects the `dns.resolve` function across the 22.x, 24.x, and 26.x release lines. The flaw causes the function to truncate domain names when they contain a NUL (null) character. This behavior can lead to inconsistent name handling, which poses a risk for applications that rely on precise validation of hostnames before executing DNS lookups. The issue was reported by security researcher hasanfleyah and resolved by James M Snell. To address the vulnerability, the Node.js project released updates on October 21, 2026, introducing input validation for null bytes in DNS resolve functions. Users are advised to upgrade to the patched versions, which include Node.js 22.23.4, 24.22.1, and 26.12.1.

CVE-2026-105481 is an HTTP request-response ordering vulnerability affecting the Node.js JavaScript runtime environment. The flaw impacts the 22.x, 24.x, and 26.x release lines. It occurs within HTTP keep-alive connections, where a keep-alive socket can mistakenly process an incoming response that was written and sent before the corresponding request was actually dispatched. To address this issue, Node.js released security updates on October 21, 2026, which include versions 22.23.4, 24.22.1, and 26.12.1. The patch, developed by James M. Snell, ensures that the HTTP agent's data guard functions correctly without relying on I/O operations. Users are advised to upgrade their Node.js installations to these patched versions to resolve the request-response ordering flaw.

CVE-2026-96656 is an external control of file name or path vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw allows an administrator—or an attacker who has obtained administrative privileges—to write arbitrary files, specifically ELF shared objects (`.so` files), to an attacker-chosen path within the server's Codecs directory. Because Plex Media Server loads and executes all `.so` files in this directory at startup without verifying signatures, execute bits, or symbols, this arbitrary file write leads to code execution. Additionally, the vulnerability involves the `TranscoderH264Options` preference, which is appended verbatim to the x264 option string during transcoding. This vulnerability serves as the final stage of a four-part exploit chain known as "Plex2Shell," which also includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. When combined, these flaws allow unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit in October 2026, threat actors began actively targeting unpatched servers in the wild to deploy payloads such as XMRig cryptocurrency miners and reverse proxy software. Plex addressed the issue in an update released in August 2026.

CVE-2026-96654 is a vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw arises from the improper neutralization of URL values within the "searchOne" endpoint. This allows an attacker to call functions belonging to other plugins and supply custom parameters, enabling them to obtain the server owner's administrator token. This vulnerability is tracked as part of a chain of four security flaws collectively referred to as "Plex2Shell". When chained together, these flaws allow attackers to execute arbitrary code on vulnerable Plex Media Server instances without needing valid credentials. Following the public release of a proof-of-concept exploit, threat actors have actively targeted these vulnerabilities in the wild to deploy cryptocurrency miners and reverse proxy software. The issue was patched by Plex in August 2026.

CVE-2026-96652 is an unauthenticated server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw exists within the `/player/timeline` endpoint, where the application fails to validate the `protocol` parameter before inserting it into a programmatically-constructed player URL. By supplying any `X-Plex-Token` value and including a full URL in the `protocol` parameter, an attacker can force the Plex server to send a POST request to an arbitrary destination of their choice. This vulnerability is part of a chain of four flaws collectively known as "Plex2Shell". When chained together, these vulnerabilities allow attackers to achieve unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit, threat actors have actively targeted unpatched servers to deploy cryptocurrency miners and proxy software. Plex addressed the vulnerability in version 1.43.3.10861, which was released in August 2026.

CVE-2026-96655 is a server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw resides in the `/video/:/transcode/universal` path parameter, where it allows an authenticated user possessing the owner's token to request arbitrary internal or external network addresses. Discovered by security researcher Zach Main, the vulnerability was patched by Plex in August 2026. This vulnerability is a component of "Plex2Shell," a chain of four vulnerabilities that can be combined to achieve unauthenticated remote code execution on exposed Plex servers. Following the public release of technical details and proof-of-concept code in October 2026, attackers began actively exploiting this chain in the wild. Observed attacks have utilized the exploit chain to deploy cryptocurrency miners and residential proxy software on vulnerable systems.