Two critical remote code execution vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed on October 21, 2026. CVE-2026-109618 involves corruption during out-of-memory handling that disrupts PHP while internal request data is partially initialized, causing invalid data processing. CVE-2026-109619 exploits a stale global state where request-owned internal state persists after memory is freed. Both vulnerabilities affect ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing PHP hosts were identified as vulnerable, with 42% running end-of-life branches lacking official patches. Early exploitation attempts have been observed, including scanning and webshell deployment targeting the upload-progress vulnerability path.
CVE-2026-114462 is a medium severity vulnerability in Velneo vServer involving improper link resolution before file access, also known as 'link following'. It affects versions from 36.0 up to but not including 36.6, and from 37.0 up to but not including 37.2. The vulnerability could allow an attacker with low privileges and partial attack complexity to influence file access behavior. No known exploits are reported in the wild, and no official patch information is provided in the data.
Velneo vServer versions 36.0 up to but not including 36.6, and 37.0 up to but not including 37.2, contain an improper validation of array index vulnerability (CWE-129). This flaw could allow an attacker to cause unexpected behavior due to invalid array indexing. The vulnerability has a high severity score of 8.7. Fixed versions are 36.6 and 37.2.
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.
This security update for the SUSE Linux Enterprise Kernel 6.4.0-36.1 addresses multiple security vulnerabilities affecting various kernel components including netfilter, KVM, 9p, iscsi, and libceph. The fixes resolve issues such as improper handling of Ethernet MAC headers, page overflow in encryption paths, error path handling in 9p client walks, buffer appending in iscsi encoding, and multiplication overflow in Ceph decoding.
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Non security issue fixed:
- SELinux CIL files are not shipped in Docker (bsc#1278193).
Changes for docker:
- Update to Docker 29.7.2. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/29/#2972>
fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
- Update to buildx 0.36.1. See upstream changelog online at
<https://github.com/docker/buildx/releases/tag/v0.36.1>
CVE-2026-98507 is a high-severity vulnerability in the Linux kernel's memory management subsystem related to a missing memory barrier between anon_vma initialization and its publication to a virtual memory area (VMA). This flaw can cause a use-after-free (UAF) condition and lead to deadlocks when two threads concurrently fault on adjacent VMAs that are anon_vma-compatible. The issue arises from reordered memory stores and insufficient synchronization, causing anon_vma locks to be inconsistently held and released. The vulnerability affects Linux kernel version 2.6.36 and has been fixed in later commits.
A vulnerability in the Modern Events Calendar Lite WordPress plugin before version 7.36.4 allows authenticated users with the Subscriber role to update the title, content, and excerpt of posts, pages, and custom post types created by other users without proper authorization checks.
The European VAT Compliance Assistant for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the CF-IPCountry header in all versions up to and including 1.36.10. This vulnerability allows unauthenticated attackers to inject malicious scripts that are stored in order post-meta during guest checkouts and executed when users access the affected pages.
CVE-2026-102608 is a critical vulnerability affecting multiple specific versions of ZoneMinder, an open source closed-circuit television software. The vulnerability has a CVSS 3.1 base score of 9.0, indicating high impact on confidentiality, integrity, and availability. The flaw requires network access with low complexity and limited privileges but user interaction is required. The vulnerability affects a range of versions explicitly listed, including various builds from 1.28.1-8 through 1.36.37+dfsg1-1. There is no information provided about patches or vendor advisories. No known exploits in the wild have been reported.
CVE-2026-30971 is a high-severity vulnerability affecting multiple specific versions of ZoneMinder, an open-source closed-circuit television software. The vulnerability has a CVSS score of 8.8, indicating it can be exploited remotely with low attack complexity and requires low privileges. It impacts confidentiality, integrity, and availability of the affected system. No public exploit or known exploitation in the wild has been reported. The affected versions are explicitly listed, but no patch or remediation details are provided in the available data.
Ekko Studio versions up to 0.7.36 have a missing authorization vulnerability that allows any authenticated user without super_admin privileges to list and clear server-wide login lockouts. This can be exploited by sending DELETE requests to the /api/auth/locked-ips endpoint without specifying an IP parameter, which disables the login rate limiter and facilitates password guessing attacks against super_admin accounts.
ZoneMinder versions 1.34.0 through 1.36.38 contain a vulnerability in the web interface where failed token authentication is mishandled. This flaw allows the system to treat a failed token validation as a present user, bypassing the normal login redirect and disclosing monitor and zone metadata without proper permission checks. The vulnerability does not allow unauthorized state changes. It is fixed in version 1.36.63 by properly handling invalid tokens and rejecting non-user values at the authentication gate.
Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
FIXED BUGS:
==========
DFBUGS-9792: Use Azure Storage Account GPv2
DFBUGS-9382: [Backport to odf-4.16.z] [Backport to 4.22] Backport CA related fixes for NooBaa
DFBUGS-7335: [Backport to odf-4.16.z] [5.20] Update nodejs from v22.11.0 to v24.13.0
DFBUGS-7030: [Backport to odf-4.16.z] [GSS] noobaa DB grows with errors BlockStoreAzure _delete_blocks failed for block
CVE-2026-96202 is a heap-based buffer overflow vulnerability in the Microsoft Raw Image Extension that allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions from 2.1.0.0 up to but not including 2.4.36.0. An official fix is available in version 2.4.36.0. The vulnerability has a high severity score of 8.8 CVSS v3.1 and requires user interaction for exploitation.