Critical severity threats

A critical security advisory from Red Hat addresses multiple vulnerabilities in GuideLLM 3.5.1, particularly focusing on CVE-2026-104851, which involves arbitrary code execution via unrestricted template evaluation in the ReferenceFileSystem component of fsspec. This flaw allows a remote attacker to execute code by tricking a user or automated service into opening a malicious reference file. The impact is limited to the privileges of the running container or application process, without immediate host-level access. No fixes are currently available for these vulnerabilities in the affected products, including Red Hat OpenShift AI.

A critical security vulnerability (CVE-2026-98432) has been identified in the Linux kernel packages used by Red Hat Enterprise Linux 8.4. The flaw involves improper freeing of inet_opt and ireq_opt structures after an RCU grace period in the IPv4 networking code. Red Hat has released a security update to address this issue and recommends applying the update and rebooting affected systems to ensure the fix takes effect.

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security update for rsyslog addresses a critical vulnerability (CVE-2026-92709) in the omfile dynaFile template, where untrusted input is used as a path component without secure-path handling, potentially enabling arbitrary code execution. Additionally, a separate issue involving RainerScript's replace() function length wrap is fixed.

Red Hat has released a critical security update for Red Hat OpenShift GitOps version 1.22.3 addressing multiple issues including malformed version strings in the Argo Rollouts controller and image updater inconsistencies. The update fixes several CVEs including CVE-2026-56855. Users are advised to apply this update after ensuring all previous errata are applied.

Red Hat has released a critical security update for Red Hat OpenShift GitOps version 1.21.7 addressing multiple vulnerabilities including CVE-2026-75838. The update fixes issues such as malformed version strings in the Argo Rollouts controller and other security flaws identified by CWEs 79, 125, and 295. Users are advised to apply this update after ensuring all prior relevant errata are installed.

A critical security update for the Red Hat kernel-rt packages addresses multiple vulnerabilities in the Real Time Linux Kernel used for systems requiring high determinism. The update fixes several security issues including out-of-bounds reads, missing locks, improper ownership management, and host memory disclosure. The advisory also includes bug fixes and enhancements to improve kernel stability. Systems must be rebooted after applying the update to ensure protection.

Multiple critical authentication bypass vulnerabilities have been identified in the pyjwt library used by the fence-agents packages in Red Hat Enterprise Linux 9.4. These vulnerabilities include acceptance of empty HMAC keys, improper public key validation, acceptance of DER public keys as HMAC secrets, unvalidated JWKS redirects, and improper Unicode byte-order mark handling leading to token forgery. The fence-agents packages are used for remote power management in cluster environments to forcibly restart and remove failed or unreachable nodes. Red Hat has issued a security update to address these issues in the affected packages.

FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.

Red Hat OpenShift for Windows Containers 11.0 includes multiple security fixes addressing vulnerabilities such as improper certificate validation in Go's crypto/x509 package. One notable flaw (CVE-2026-111943) allows man-in-the-middle attacks by trusting compromised intermediate certificates, potentially compromising secure communications. The advisory provides upgrade guidance for Windows Machine Config Operator components. No known exploits in the wild have been reported.

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, allow unauthenticated remote code execution on affected servers. Emergency patches were released on October 21, 2026, for PHP versions 7.4, 8.0, 8.1, and supported 8.2–8.5 branches. Despite patches, millions of servers remain vulnerable. Exploitation attempts began shortly before patches were public, with confirmed real-world attacks including compromises of Palo Alto Networks devices. A third related vulnerability in Brotli (CVE-2026-111497) was patched later. Another unpatched PHP vulnerability (CVE-2026-115560) requires unusual configurations and is scheduled for a regular fix. Mitigation requires patching and auditing systems for compromise signs. Detection tools and updated security solutions can help identify exploitation attempts.

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages, which are critical components of the operating system. The update fixes several security issues including improper handling of duplicate SPI, improper class removal in network scheduling, Bluetooth device close handling, error path checks in nvmet-tcp, SCSI response data binding, host memory disclosure in nvme-tcp, and improper memory freeing in IPv4. Additionally, a local privilege escalation vulnerability related to skb_zerocopy ownership management is addressed. The advisory covers Red Hat Enterprise Linux 10.0 Extended Update Support and related builder products. A system reboot is required to apply these updates.

Eclipse Mnestix Browser versions from 1.6.0 up to but not including 2.3.0 contain a vulnerability that allows unauthenticated attackers to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures. This vulnerability is identified as CVE-2026-89292 and has a critical severity rating with a CVSS score of 9.2.

Google's November 2026 Android security updates address over 200 vulnerabilities, including a critical remote code execution flaw in the Framework component that requires no user interaction. The updates also fix multiple critical, high-severity, and denial-of-service vulnerabilities across Framework, System, Kernel, and various hardware components. The patches are delivered in two parts via security patch levels 2026-11-01 and 2026-11-05, covering a broad range of Android subsystems and vendor components.