Hewlett Packard Enterprise (HPE) released security updates addressing 72 vulnerabilities in ArubaOS, including eight maximum-severity flaws involving authentication bypass and remote code execution (RCE). These critical vulnerabilities affect multiple versions of AOS-8 and AOS-10 and can be exploited remotely without privileges or user interaction. HPE strongly urges customers to apply patches promptly and recommends restricting access to management interfaces to reduce exploitation risk. No public exploit code or active exploitation has been reported as of the advisory date.
PHP2Shell refers to two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. These flaws have been exploited in attempts to spread a Mirai-derived botnet variant named Potassium. Despite multiple exploitation attempts and the emergence of an ASLR bypass exploit, no confirmed successful compromises have been reported. The vulnerabilities were patched on October 21, 2026, with PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations have taken precautionary measures including taking systems offline during patching. Exploits require uncommon server configurations and detailed knowledge, limiting their effectiveness in typical production environments.
The PyPI package 'onsokets' version 0.1.0 contains malicious code designed for automated file exfiltration, targeting Android devices. This package is part of a campaign identified as 2026-10-proxyrubika, which has clear malicious intent related to information stealing.
A path traversal vulnerability (CWE-22) exists in flatpak's xdg-desktop-portal prior to version 1.22.1. Malicious sandboxed applications can exploit the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host system, limited to files accessible by the user. The vulnerability arises because filenames passed to the method are not properly validated by the frontend or common backends, allowing path traversal. This issue has been patched in version 1.22.1.
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.
A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper use of dpaa2_switch_free_fd() on receive frame descriptors, which expects a valid socket buffer pointer but was incorrectly called on descriptors without one. The fix moves dma_unmap_page() handling directly into dpaa2_switch_rx(), ensuring proper memory freeing depending on whether an SKB was created.
A vulnerability in the Linux kernel's wifi nl80211 component was resolved by adding a check to ensure the link is beaconing before performing a color change. This prevents the driver from being called with an invalid link state.
A reference leak vulnerability was identified and fixed in the Linux kernel's ThunderX network driver. The flaw involved the cavium_ptp_get() function acquiring a reference to a PTP PCI device, which was not properly released if initialization failed, causing a resource leak.
A vulnerability in the Linux kernel ALSA sequencer OSS interface was resolved. The snd_seq_oss_read() function incorrectly checks buffer sizes when reading queued events, causing improper handling of undersized reads. This could lead to events being copied incorrectly or left queued, potentially causing unexpected behavior in applications reading sequencer events.
A vulnerability in the Linux kernel's media video-i2c driver was resolved by correcting the driver removal process. The fix involves using vb2_video_unregister_device() instead of video_unregister_device() to properly disconnect the vb2 queue before unregistering the video device.
A vulnerability in the Linux kernel's drm/amdgpu component related to the ATOM command table nesting depth has been resolved. The issue involved capping the nesting depth at 32 levels and returning an error (-ELOOP) when this limit was exceeded.
A vulnerability in the Linux kernel's iwlwifi driver related to scheduled scan IE sizing has been resolved. The issue involved building the probe request before validating its length, allowing oversized information elements (IEs) to be copied into a fixed buffer. The fix moves the probe building after the length check and advertises the maximum scheduled scan IE length to userspace to prevent oversizing.
A vulnerability in the Linux kernel's mlx5 network driver related to handling miss tables in hardware steering (HWS) has been resolved. The issue involved improper removal of tables from a miss table list when a table with a miss table created by the 'mlx5hws_table_set_default_miss' API was deleted, potentially leaving garbage nodes in the list.
A vulnerability in the Linux kernel's lan966x network driver was resolved involving improper restoration of RX state after a reload failure. Specifically, certain fields related to RX page geometry and page pool registration were not restored correctly if resource reallocation failed, causing inconsistencies in RX buffer handling. This could lead to the XDP path advertising incorrect frame sizes, potentially causing buffer mismanagement.
A vulnerability in the Linux kernel's Btrfs filesystem was resolved by adding a lock to protect the sb_write_pointer() function. This function reads the super block from the block device page cache, and previously had a race condition related to block size changes. The fix involves taking the mapping invalidate lock around the read operation to serialize it against block size changes.
A vulnerability in the Linux kernel's md/raid5 component related to the handling of 32-bit sequence numbers (bm_seq) has been resolved. The issue involved incorrect comparison logic when the 32-bit sequence number wraps around, causing newer sequence numbers to appear smaller than older ones. This was addressed by implementing a wrap-safe comparison method.
A resource management vulnerability in the Linux kernel's Microchip Sparx5 driver was resolved. The flaw involved improper cleanup of PSFP (Per-Stream Filtering and Policing) resources when the flower setup process failed, potentially leading to resource leaks. Specifically, allocated stream gate, flow meter, and stream filter resources were not released on error paths. Additionally, incorrect handling of flow meter IDs could cause erroneous deletion attempts and reference count inconsistencies.
A vulnerability in the Linux kernel's libertas wifi driver was resolved that involved improper handling of short monitor mode TX frames. The function lbs_hard_start_xmit() incorrectly processes frames by casting data to a radiotap TX header and copying the 802.11 destination address without sufficient length checks, potentially causing out-of-bounds reads. The fix requires verifying that the frame has enough bytes for the radiotap TX header and destination address before accessing them.
A vulnerability in the Linux kernel's AMD GPU driver was resolved. The issue involved scheduling thermal work on a queue that was not initialized when Dynamic Power Management (DPM) was disabled via the amdgpu.dpm=0 module parameter. This could lead to improper handling of thermal work scheduling.
A race condition vulnerability in the Linux kernel's imx mailbox driver was resolved by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled by an interrupt service routine while the shutdown process was waiting on free_irq(), potentially causing problems on shared interrupt handlers. This could lead to the irq-core shutting down the interrupt with a 'nobody cared' message if the removed channel triggered an interrupt.