A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation
of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
The LiteLLM 1.107.0 Python package was compromised and published to PyPI, distributing malicious code that executed automatically during Python interpreter startup. The payload collected a wide range of credentials including developer, cloud, browser, SSH, and environment variables, then encrypted and exfiltrated this data to attacker-controlled endpoints. The compromise originated from stolen developer GitHub credentials used to alter the release workflow. The malicious code executed without requiring explicit import of LiteLLM, affecting any environment where Python was started with the compromised package installed. Recovery requires more than removing the package; affected Python environments, running processes, and exposed credentials must be addressed. Microsoft Defender provides detection and hunting guidance. No patch or fixed version is explicitly stated.
CVE-2026-115569 is a path traversal vulnerability in the fallow-rs fallow codebase intelligence tool for TypeScript and JavaScript. Versions from 2.68.0 up to but not including 3.34.0 allow attacker-controlled Jest and Vitest project paths to reference files outside the project root via absolute paths, parent directory segments, wildcard globs, or symlinks. This causes fallow to parse external files as test-runner configurations, potentially affecting dependency and file usage analysis. The vulnerability does not expose file contents externally. The issue is fixed in version 3.34.0.
CVE-2026-115813 is a server-side request forgery (SSRF) vulnerability in AWS Multi Model Server version 1.1.11 and earlier. This flaw allows remote attackers to send requests to internal network destinations by exploiting the model download path with a crafted URL. The product is end-of-life with no fixed version available. Users are advised to discontinue use and migrate to supported model serving solutions. The vulnerability has a medium severity with a CVSS score of 5.8.
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
Two critical unauthenticated remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, were publicly disclosed in October 2026. These vulnerabilities have a high severity score (CVSS 9.2) and affect PHP's memory management, enabling reliable exploitation when chained. The disclosure triggered immediate emergency responses from criminal forum operators, who took their platforms offline, migrated infrastructure, and restricted new registrations to mitigate risk. These forums store sensitive data such as member identities, private communications, and stolen credentials, making the vulnerabilities a significant threat to their operations. The adversary economy's reaction mirrors legitimate enterprise incident response, highlighting the severity of the vulnerabilities. No specific affected PHP versions are detailed in the provided data.
A race condition vulnerability (CWE-362) exists in tokio-rs tokio version 1.54.0 involving improper synchronization between tokio::time::Interval::poll_tick and the multi-threaded runtime's time driver. This can cause use-after-free issues leading to assertion panics, task reference-count corruption, or heap memory corruption. The issue is fixed in version 1.54.1.
A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.
Microsoft announced that Windows Server 2016 will reach its end of support in January 2027, after which it will no longer receive security updates or patches.
Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach involving unauthorized access to its Quanum LSM system, resulting in exposure of patient records. The breach was confirmed publicly but specific technical details and affected versions were not provided. No known exploits or active attacks have been reported. The incident highlights risks to sensitive healthcare data due to unauthorized system access.
The PyPI package 'sitecard' versions 0.1.0 through 0.1.14 contains malicious code that creates an SSH session exposed via tunnels. This session is accessible without any authentication by default and reports to a hardcoded location, effectively acting as a backdoor. This exposes users to unauthorized remote access by attackers.
University Hospital in Ohio has taken its IT systems offline after detecting unusual server activity indicative of a potential security breach. The incident was reported on October 23, 2026, and involves the hospital's digital services being shut down as a precautionary measure. No specific technical details or confirmed exploits have been disclosed at this time.
Node.js versions 22.x, 24.x, and 26.x contain a vulnerability in TLS hostname verification where server certificates can be incorrectly validated against a different IP address when the host is specified as a non-canonical IPv4 literal with leading zeros. This occurs because the hostname normalization interprets leading-zero octets as octal, while the OS resolver interprets them as decimal, potentially allowing a server to be authenticated with a certificate issued for another IP address.
CVE-2026-105481 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Node.js HTTP Agent connection reuse mechanism. It allows a client to mistakenly accept a response sent before the corresponding request, due to incomplete handling of unsolicited responses on keep-alive sockets. This flaw affects Node.js versions 22.23.3, 24.22.0, and 26.12.0.
Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in DNS resolution functions where hostnames with embedded NUL bytes are truncated silently. This allows dns.resolve*() and dns.reverse() to resolve a different hostname than the one validated, potentially bypassing domain allowlist checks.
A vulnerability in Node.js affects the internal entropy caches used by crypto functions such as crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when user-land startup snapshots or single executable applications are built with useSnapshot. If these functions are called during snapshot creation, the cached random values are reused across processes started from that snapshot, causing collisions and predictability of supposedly unique identifiers. This impacts Node.js versions 22.23.3, 24.22.0, and 26.12.0.
CVE-2026-106071 is a low-severity vulnerability in Node.js 26.x where the filesystem permission model improperly enforces wildcard path grants. Specifically, a wildcard rule such as --allow-fs-read=/etc/passwd.* can incorrectly allow access to /etc/passwd itself due to early termination in the radix tree lookup. This flaw requires the wildcard grant to be directly under the root of the permission tree and differs from CVE-2026-58043. The vulnerability has a CVSS score of 3.6 and affects Node.js version 26.12.0.
Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in TLS hostname verification where certificates with only a DNS Subject Alternative Name (SAN) can authenticate IP endpoints if the client uses non-canonical IPv4 address spellings. This occurs because tls.checkServerIdentity() normalizes these addresses and matches them against DNS names, allowing improper validation. Exploitation requires a trusted CA to issue a certificate with a numeric DNS SAN and a platform resolver that accepts non-canonical IP formats.
Node.js versions 24.22.0 and 26.12.0 contain a vulnerability in TLS hostname verification where certificates without matching IP address SANs can authenticate connections to IPv4 addresses written with non-ASCII characters. This occurs because tls.checkServerIdentity() fails to recognize such hosts as IP addresses, leading to improper validation against DNS names or Common Names in certificates. This flaw is a regression from a previous fix and can allow acceptance of certificates not issued for the actual IP endpoint.
A business logic flaw in Node.js 26.x's zlib.ZipFile API can cause it to return incorrect bytes from a ZIP archive when local and central headers do not match. This occurs because the local header is cached without a content offset after validation failure, allowing attacker-controlled bytes to be returned while CRC-32 verification still passes. This discrepancy can cause Node.js-based scanners to approve different content than other ZIP implementations extract.