Trending now

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-81376 is a security feature bypass vulnerability affecting Microsoft Visual Studio Code versions 1.0.0 through 1.136.1. The flaw stems from an incomplete comparison operation within the application's security evaluation logic, which is categorized as a protection mechanism failure. When Visual Studio Code assesses a security decision, the comparison logic omits certain necessary factors. An attacker can exploit this by crafting input that satisfies the partial check while violating the omitted factors, allowing them to bypass the editor's built-in security controls. Exploitation of this vulnerability requires user interaction, such as opening a repository, workspace, or file supplied by the attacker. Once triggered over a network, the bypass can lead to a scope change, enabling the compromised component to affect resources outside its intended security boundary. This can result in behaviors such as the unexpected launching of command shells, scripting interpreters, or network utilities, as well as unauthorized modifications to configuration files within the workspace. Microsoft has addressed this issue in Visual Studio Code version 1.136.2.

CVE-2026-96656 is an external control of file name or path vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw allows an administrator—or an attacker who has obtained administrative privileges—to write arbitrary files, specifically ELF shared objects (`.so` files), to an attacker-chosen path within the server's Codecs directory. Because Plex Media Server loads and executes all `.so` files in this directory at startup without verifying signatures, execute bits, or symbols, this arbitrary file write leads to code execution. Additionally, the vulnerability involves the `TranscoderH264Options` preference, which is appended verbatim to the x264 option string during transcoding. This vulnerability serves as the final stage of a four-part exploit chain known as "Plex2Shell," which also includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. When combined, these flaws allow unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit in October 2026, threat actors began actively targeting unpatched servers in the wild to deploy payloads such as XMRig cryptocurrency miners and reverse proxy software. Plex addressed the issue in an update released in August 2026.

CVE-2026-96654 is a vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw arises from the improper neutralization of URL values within the "searchOne" endpoint. This allows an attacker to call functions belonging to other plugins and supply custom parameters, enabling them to obtain the server owner's administrator token. This vulnerability is tracked as part of a chain of four security flaws collectively referred to as "Plex2Shell". When chained together, these flaws allow attackers to execute arbitrary code on vulnerable Plex Media Server instances without needing valid credentials. Following the public release of a proof-of-concept exploit, threat actors have actively targeted these vulnerabilities in the wild to deploy cryptocurrency miners and reverse proxy software. The issue was patched by Plex in August 2026.

CVE-2026-96652 is an unauthenticated server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw exists within the `/player/timeline` endpoint, where the application fails to validate the `protocol` parameter before inserting it into a programmatically-constructed player URL. By supplying any `X-Plex-Token` value and including a full URL in the `protocol` parameter, an attacker can force the Plex server to send a POST request to an arbitrary destination of their choice. This vulnerability is part of a chain of four flaws collectively known as "Plex2Shell". When chained together, these vulnerabilities allow attackers to achieve unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit, threat actors have actively targeted unpatched servers to deploy cryptocurrency miners and proxy software. Plex addressed the vulnerability in version 1.43.3.10861, which was released in August 2026.

CVE-2026-96655 is a server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw resides in the `/video/:/transcode/universal` path parameter, where it allows an authenticated user possessing the owner's token to request arbitrary internal or external network addresses. Discovered by security researcher Zach Main, the vulnerability was patched by Plex in August 2026. This vulnerability is a component of "Plex2Shell," a chain of four vulnerabilities that can be combined to achieve unauthenticated remote code execution on exposed Plex servers. Following the public release of technical details and proof-of-concept code in October 2026, attackers began actively exploiting this chain in the wild. Observed attacks have utilized the exploit chain to deploy cryptocurrency miners and residential proxy software on vulnerable systems.

CVE-2026-0257 is an authentication bypass vulnerability found in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS software. This flaw enables an attacker to circumvent security restrictions and establish an unauthorized Virtual Private Network (VPN) connection. The vulnerability stems from the system's reliance on cookies without adequate validation and integrity checking, specifically when authentication override cookies are enabled and a particular certificate configuration is in place. This issue does not impact Panorama or Cloud NGFW deployments.

CVE-2025-61624 is a path traversal vulnerability (CWE-22) affecting the command line interpreter (CLI) of several Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. The flaw stems from improper input validation, specifically involving unsanitized `system.auto-script` object names. This allows an authenticated attacker with administrative privileges and read-write permissions to escape restricted directories and write or delete arbitrary files on the underlying filesystem by executing crafted CLI commands. In real-world attacks, threat actors have exploited this vulnerability as a privilege-escalation vector to transition from restricted administrative access to root-level control over the underlying operating system. This exploit has been used in the wild to deploy PEERSTITCH, a stealthy, memory-resident ARM64 malware designed to evade traditional file-based detection. Fortinet addressed the vulnerability in April 2026, releasing patches for affected versions of FortiOS and other impacted products.

CVE-2026-21589 is a path traversal and arbitrary file access vulnerability that affects multiple self-hosted Atlassian Data Center and Server products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows remote, unauthenticated attackers to access specific files within the web application's root directory. To successfully exploit the vulnerability, an attacker must know the exact name and path of the target file, as the flaw does not allow directory listing or file enumeration. The vulnerability impacts all versions of the affected products prior to their designated fixed releases. While Atlassian's cloud-based services are secure and require no action, organizations utilizing self-hosted deployments are advised to upgrade to the patched versions. For systems that cannot be immediately updated, recommended mitigations include taking internet-facing instances offline, deploying web application firewall (WAF) rules, or configuring URL rewriting rules to block directory traversal attempts containing double-dot (`../`) sequences.