Trending now

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-93577 is an integer overflow vulnerability found in the regular expression compiler of GitLab CE/EE. This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is compiled within a CI/CD configuration. Affected versions include all GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-89078 is identified as a double free vulnerability affecting the regular expression parser in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is parsed within a CI/CD configuration. GitLab has released remediations for this issue, impacting versions 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.

CVE-2026-114509 is an authentication bypass vulnerability in the built-in TokenGuard of the Laravel framework, which is used for token-based API authentication. The issue arises because the guard fails to properly validate that incoming API credentials are strings, only checking if they are non-empty. Consequently, an unauthenticated attacker can submit a crafted, non-string credential—such as an array within a JSON request—which bypasses the initial validation checks. When these non-string credentials are sent to a database running certain MySQL or MariaDB configurations, the database engine performs a type-coerced comparison, treating the stored text tokens as numbers. This type confusion causes the authentication lookup query to match an unintended existing user record rather than failing. As a result, attackers can gain unauthorized access and take over accounts on any routes protected by the affected guard. The vulnerability affects Laravel framework versions prior to 12.68.0 and 13.29.0, and has been resolved in those respective releases.

CVE-2025-43300 is an out-of-bounds write vulnerability that exists within Apple's Image I/O framework. The vulnerability can be triggered when a device processes a maliciously crafted image file, which can lead to memory corruption. Successful exploitation of this vulnerability can occur when a program writes data outside of an allocated memory buffer. This can result in the program crashing, data corruption, or potentially remote code execution. Apple has addressed this issue with improved bounds checking in multiple operating systems, including iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8.

CVE-2025-24154 is an out-of-bounds write vulnerability that affects several Apple operating systems, including iOS, iPadOS, macOS (Sequoia, Sonoma, and Ventura), and visionOS. The flaw is rooted in improper input validation within kernel-level code, which fails to properly restrict input size before writing data to memory. This allows an attacker to write beyond the bounds of an allocated buffer, potentially leading to unexpected system termination or kernel memory corruption. The vulnerability can be exploited remotely over a network without requiring user interaction or special privileges. Apple has resolved this issue by implementing improved input validation across its affected platforms. The fixes are included in the releases of iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, and visionOS 2.3.

CVE-2025-14174 is an out-of-bounds memory access vulnerability found in ANGLE, a component of Google Chrome. The vulnerability could allow a remote attacker to perform out-of-bounds memory access via a crafted HTML page. Google is aware that an exploit for this vulnerability exists in the wild. Apple also addressed CVE-2025-14174, describing it as a memory corruption flaw in WebKit that could lead to memory corruption. Apple indicated that this vulnerability may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.