Trending now

CVE-2025-1974 is a vulnerability within the Ingress NGINX Controller for Kubernetes, specifically affecting the admission controller component. This flaw falls under a group of vulnerabilities collectively known as "IngressNightmare." The vulnerability arises because the admission controllers are accessible over the network without authentication. By sending a malicious ingress object directly to the admission controller, an attacker can inject arbitrary NGINX configurations. This results in code execution on the Ingress NGINX Controller's pod, potentially granting unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, which could lead to a complete cluster takeover.

CVE-2026-114820 is a security vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, specifically within the Java Secure Socket Extension (JSSE) component. The issue is tied to a certificate trust compromise involving the private keys of eight intermediate Certificate Authority (CA) certificates issued by eMudhra. In response, Oracle released updates to remove the affected root CA certificates—such as emSign Root CA and AAA Certificate Services—from the Java trust store to prevent unauthorized trust decisions. An unauthenticated attacker with network access can exploit this vulnerability across multiple protocols without requiring user interaction. By intercepting network traffic, an attacker can impersonate trusted websites and services, enabling them to read, modify, or delete data accessible to the affected Java runtime. The vulnerability also applies to client-side Java deployments, such as sandboxed Java Web Start applications or applets that load untrusted code. Remediation involves updating the Java runtime to a patched version or manually removing the compromised root certificates from the system's keystore.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-115560 is a remote code execution (RCE) vulnerability in PHP's session upload progress feature, which was disclosed by the PHP project in October 2026. The vulnerability stems from the inconsistent handling of session data when an application changes its serialization formats during request processing. It specifically affects environments where the `session.serialize_handler` is initially configured as `php_binary` or `php_serialize`, but is subsequently changed to `php` at runtime using `ini_set()` before `session_start()` is called, while the session upload progress feature remains active. Because this vulnerability requires a highly specific and uncommon combination of configuration settings and application code, the PHP security team has characterized it as an unlikely vector in practice. As a result, the issue is being addressed through PHP's routine release cycle rather than an emergency patch. Until a formal update is released, the recommended mitigation is to disable the session upload progress feature by setting `session.upload_progress.enabled = 0` in the PHP configuration.

CVE-2024-21413 is a remote code execution (RCE) vulnerability affecting Microsoft Outlook. It stems from improper input validation when Outlook processes URLs, particularly those using the `file://` protocol and crafted URL structures. This vulnerability, also known as the "MonikerLink" bug, allows attackers to bypass security protections, such as the Office Protected View, and execute arbitrary code on a victim's machine by sending a malicious email. The vulnerability can be triggered even when previewing a maliciously crafted email. Successful exploitation could lead to remote code execution, theft of NTLM credentials, data exfiltration, data encryption, installation of malware, and potential full system compromise. It affects various versions of Microsoft Outlook, including Microsoft Office 2016, 2019, 2021, and Microsoft 365 Apps.

CVE-2026-81963 is an elevation-of-privilege vulnerability found within the Windows Update Stack, the component responsible for managing and installing Windows updates. The flaw arises from two primary weaknesses: improper link resolution before file access, often referred to as "link following," and inadequate access control. A locally authenticated attacker with low privileges can exploit these weaknesses to elevate their privileges to SYSTEM level. This exploitation can occur without requiring any user interaction. Microsoft addressed this vulnerability as part of its September 2026 Patch Tuesday release, affecting various versions of Windows 11 and Windows Server 2025.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw stems from the system mishandling how the privileged `dsinvoked` broker trusts configuration data stored in the `DSCache`. By manipulating this trust—specifically by temporarily modifying library code in memory and altering a maintenance task in the configuration store—an attacker with local authenticated access can execute arbitrary code with root-level privileges. Discovered by cybersecurity firm Volexity, this vulnerability was actively exploited in the wild in October 2026 by a threat actor tracked as UTA0576. The attacker chained CVE-2026-111357 with an authentication bypass (CVE-2026-104935) and a predictable-filename weakness (CVE-2026-118527) to achieve unauthenticated root access on fully patched appliances, which they used to harvest Active Directory credentials and sensitive metadata. In response, Ivanti released security patches on October 29, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-118527 is a vulnerability in Ivanti Connect Secure (ICS) VPN appliances involving the generation of predictable numbers or identifiers, specifically manifesting as a predictable-filename weakness. This flaw allows a remote authenticated attacker to upload files containing attacker-controlled content to a known, predictable location on the local disk. In real-world attacks, threat actors (such as the group tracked as UTA0576) have chained this vulnerability with CVE-2026-104935 (an authentication bypass) and CVE-2026-111357 (a privilege escalation flaw) to gain unauthenticated root access to appliances and extract sensitive Active Directory credentials. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026. Ivanti has released security updates, such as Connect Secure versions 22.8R2.6 and 25.1.1.3, to address the issue.

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.