CVE-2026-79981 is a medium severity vulnerability in the Zephyr project's DNS stub resolver. The resolver binds a single UDP socket with a fixed ephemeral source port for all DNS queries to a configured server, violating RFC 5452's requirement that both source port and transaction ID vary. This allows an off-path attacker with UDP reachability to the device to guess the source port easily and flood forged DNS responses, potentially causing the application to resolve attacker-chosen addresses. The vulnerability affects Zephyr versions from 1.8.0 up to but not including 4.5.0. A patch is available that randomizes the source port per query, increasing the guessing space and mitigating the risk.
CVE-2026-79980 is a medium severity vulnerability in the DHCPv4 client of the Zephyr project. The client used a predictable transaction identifier that was incremented or reused rather than randomized per transaction as required by RFC 2131. This allowed an attacker who observed one identifier to predict future identifiers and forge DHCP replies. Such forged replies could redirect network traffic by changing the device's default gateway and DNS resolvers or disrupt network configuration by sending forged DHCPACK or DHCPNAK messages. A patch is available that ensures a fresh random transaction identifier is generated for each DHCP transaction phase.
CVE-2026-79979 is a use-after-free vulnerability in the Zephyr project affecting arm64 builds with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled. The issue arises from improper TLB invalidation that only targets ASID 0, allowing stale translations for other ASIDs to persist. This flaw enables unprivileged user threads to access and modify kernel or other domain memory, breaking memory isolation and potentially leading to full system compromise. The vulnerability affects Zephyr versions from 4.3.0 up to but not including 4.5.0. A fix has been implemented to correct the TLB invalidation to cover all ASIDs and preserve proper memory domain permissions.
CVE-2026-79978 is a low-severity vulnerability in the Zephyr RTOS affecting the ADXL345 accelerometer driver. The issue arises from out-of-bounds writes during FIFO data processing when the allocated buffer is smaller than a full batch. This can cause silent data corruption or crashes due to memory corruption in the RTIO block pool. Exploitation requires specific hardware configuration and buffer pool starvation conditions.
CVE-2026-79977 is a vulnerability in the WireGuard VPN implementation within Zephyr (subsys/net/lib/wireguard/wg.c) that allows an attacker to spoof the peer endpoint address without authentication. This occurs because the code updates the peer endpoint from unauthenticated messages when the receiver index does not match any session. The flaw enables an attacker to redirect traffic to an arbitrary address, causing denial of service or limited traffic interception without decrypting or forging tunnel content. The vulnerability affects Zephyr versions from 4.4.0 through 4.4.2. A fix removes unauthenticated endpoint updates and restricts handshake initiation to authenticated endpoints or configured endpoints. WireGuard in Zephyr is experimental and not enabled by default.
Zephyr's OpenThread integration used a default, publicly known Joining Device Credential (PSKd) "J01NME" when the joiner autostart feature was enabled but the PSKd was not overridden. This allowed an attacker within radio range to authenticate as a commissioner and provision the device with a malicious operational dataset, effectively taking control of the device's Thread network connection. The vulnerability affects Zephyr versions from 1.14.0 up to but not including 4.5.0. A fix was implemented to remove the default PSKd and enforce build-time checks requiring a unique PSKd when joiner autostart is enabled.
CVE-2026-115796 is a medium severity cross-site request forgery (CSRF) vulnerability in the Web Management Interface of Tenda F6 router firmware version 12.02.01.73. The flaw allows remote attackers to perform unauthorized actions via crafted requests. Exploit code has been publicly released. No patch or remediation information is currently available.
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
pypdf versions prior to 6.21.2 contain a vulnerability where repeated malformed cross-reference entries can cause excessive resource consumption by triggering complete PDF stream reloads during recovery attempts. This issue leads to long runtimes when processing crafted PDF files. The vulnerability is fixed in version 6.21.2.
A vulnerability in the pypdf library prior to version 6.21.2 allows an attacker to craft a PDF file with a cross-reference table declaring more entries than the file actually contains. This causes the library to perform excessive iteration, leading to long processing times when opening the file. The issue is addressed in version 6.21.2.
pypdf versions prior to 6.21.2 contain a vulnerability where an attacker can craft a PDF that repeatedly references the same nonexistent indirect object. This causes repeated full-file recovery loads and long runtimes when accessing certain file parts such as pages. The issue is fixed in version 6.21.2.
An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.
AWS fixed this issue service-side. No customer action is required.
CriticalExploitedMirageEPSS 11%Palo Alto Unit 42CVE-2026-109618
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP, a widely used scripting language for web servers and CMS systems. Both vulnerabilities involve improper handling of memory during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions that can be exploited in subsequent requests. Over 22.6 million exposed instances potentially vulnerable have been identified. Palo Alto Networks provides protections through multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should review the PHP Group’s security advisory for patching guidance.
Microsoft Teams will introduce an AI-powered, context-aware phishing detection feature starting in early November 2026. This feature aims to identify phishing, social engineering, impersonation attempts, and deceptive intent by analyzing conversation context, particularly focusing on external first-contact chats. The system does not retain message content for AI training or other secondary uses and requires no action from IT administrators to enable. This enhancement is part of a broader set of security improvements in Teams designed to reduce phishing and fraud risks.
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
CVE-2026-115569 is a path traversal vulnerability in the fallow-rs fallow codebase intelligence tool for TypeScript and JavaScript. Versions from 2.68.0 up to but not including 3.34.0 allow attacker-controlled Jest and Vitest project paths to reference files outside the project root via absolute paths, parent directory segments, wildcard globs, or symlinks. This causes fallow to parse external files as test-runner configurations, potentially affecting dependency and file usage analysis. The vulnerability does not expose file contents externally. The issue is fixed in version 3.34.0.
CVE-2026-115813 is a server-side request forgery (SSRF) vulnerability in AWS Multi Model Server version 1.1.11 and earlier. This flaw allows remote attackers to send requests to internal network destinations by exploiting the model download path with a crafted URL. The product is end-of-life with no fixed version available. Users are advised to discontinue use and migrate to supported model serving solutions. The vulnerability has a medium severity with a CVSS score of 5.8.
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
Two critical unauthenticated remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, were publicly disclosed in October 2026. These vulnerabilities have a high severity score (CVSS 9.2) and affect PHP's memory management, enabling reliable exploitation when chained. The disclosure triggered immediate emergency responses from criminal forum operators, who took their platforms offline, migrated infrastructure, and restricted new registrations to mitigate risk. These forums store sensitive data such as member identities, private communications, and stolen credentials, making the vulnerabilities a significant threat to their operations. The adversary economy's reaction mirrors legitimate enterprise incident response, highlighting the severity of the vulnerabilities. No specific affected PHP versions are detailed in the provided data.