Live Threat Intelligence Radar

The PHP security team has announced two critical remote code execution vulnerabilities with CVSS v4.0 scores of 9.2 each, affecting multiple PHP versions including 5, 6, 7, and 8. Emergency patches are scheduled for release on October 21, 2026. Details about the vulnerabilities, affected versions, and fixes have not yet been disclosed. Information about the flaws leaked prematurely, but no active exploitation has been observed. Administrators are urged to prepare for immediate patching once updates become available.

Bulletin ID: 2026-141-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:30 PM PDT Description: CICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository. We identified CVE-2026-112407, an incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications before 1.0.11 that allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account via application templates deployed by the toolchain pipeline. Impacted versions: =1.0.7 AND <=1.0.10 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read the article

CVE-2026-105960 is a medium severity vulnerability in the HMS Networks PEAK-System Device Driver Setup. It involves improper handling of a variable-length receive-record copy where the driver does not sufficiently limit the copy operation to the actual output buffer length provided by the caller. This can lead to an out-of-bounds write affecting availability.

CVE-2026-110322 is a medium severity vulnerability in HMS Networks PEAK-System Device Driver Setup. The issue arises because the PEAK-System PCAN type 0x4030 processing path does not validate a selected or returned object pointer before dereferencing fixed fields during post-processing. This can lead to an availability impact. The vulnerability affects versions up to and including 5.1.2.1151 and 5.1.2. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-103672 is a high-severity vulnerability in the HMS Networks PEAK-System Device Driver Setup. It involves improper bounds checking of the Data Length Code (DLC) in the PCAN parser, allowing an attacker to index a length table with a DLC value greater than 0x0f. This leads to copying attacker-controlled payload data into a fixed-size stack buffer, resulting in a potential stack-based buffer overflow.

Bulletin ID: 2026-140-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/20/2026 13:00 PM PDT Description: Kiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI, or messaging channels such as WhatsApp, and that runs tools on the operator's machine. We identified CVE-2026-112380, an authorization issue in the WhatsApp channel and the internal subagent run-control endpoints. In certain configurations where a WhatsApp group was added to an operator's allowed groups, or where the direct-message policy was set to open, a member of that WhatsApp group could send instructions to another session's subagent. The subagent then executed those instructions on the operator's machine under that session's approval policy, and the resulting audit trail was attributed to the operator rather than the actual sender. The default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self, so a group that is not explicitly listed is dropped before dispatch. Impacted versions: >=0.4.0 AND <0.7.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read the article

CVE-2026-101103 is a medium severity vulnerability in the HMS Networks PEAK-System Device Driver Setup. It involves improper validation of the caller-supplied output buffer size in the PCAN diagnostic call, which can lead to an out-of-bounds write (CWE-120). This vulnerability affects versions up to and including 5.1.2.1151. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-109576 is a medium severity vulnerability in the PEAK-System Device Driver Setup by HMS Networks. It involves a flaw in the parser where the processed-bytes counter advances even after rejecting a malformed record, potentially leading to an out-of-bounds condition. The vulnerability does not impact confidentiality or integrity but affects availability. It affects versions up to and including 5.1.2.1151. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-113725 is an OS command injection vulnerability in pypa virtualenv versions prior to 21.14.7. The bash activate script improperly escapes environment names containing backslashes, allowing command execution in the user's shell prompt. This issue is fixed in version 21.14.7.

CVE-2026-113724 is a vulnerability in pypa virtualenv prior to version 21.14.9 involving improper link resolution before file access. The safe_delete() error handler attempts to fix deletion failures by changing file permissions using os.chmod after reading mode bits with os.lstat, which follows symbolic links. This can allow a symlink planted inside a read-only directory to cause a victim-owned target outside the intended directory to become writable by the invoking user, potentially widening write permissions. The issue is fixed in version 21.14.9.