Drupal has patched two critical remote code execution vulnerabilities affecting all supported versions of its core, specifically in the Field UI module and the contributed Entity List module. These flaws could allow attackers to execute arbitrary code remotely, with some exploitation paths requiring no authentication. Administrators are urged to update to Drupal core versions 10.6.19, 11.3.19, or 11.4.10 and Entity List module version 3.0.10. Uninstalling the Field UI module is recommended if immediate upgrade is not possible. The vulnerabilities impact all supported Drupal versions and pre-release versions of Drupal 12 before beta2. Exploits may emerge soon after disclosure, so timely patching is critical.
F5 and Juniper Networks have released patches for multiple critical vulnerabilities affecting their products, including remote code execution (RCE) flaws that could allow unauthenticated attackers to take full control of affected devices. The vulnerabilities include buffer overflows, memory corruption, and other issues that may lead to device crashes or complete takeover. No exploitation in the wild has been reported. These patches address dozens of security defects across NGINX, Junos OS, Junos OS Evolved, and Juniper Cloud-Native Router.
Microsoft released patches addressing over 30 vulnerabilities, including two dozen high-severity remote code execution (RCE) flaws in the Office suite. The vulnerabilities include buffer overflows, off-by-one, use-after-free, path traversal, and numeric truncation errors. Most RCEs require a user to open a specially crafted file, such as a malicious document. The majority of fixes target Word, with some for Excel, Outlook, PowerPoint, and SharePoint. Additional fixes cover information disclosure and security bypass issues in Office, as well as other Microsoft products. No exploitation in the wild has been reported for these vulnerabilities.
This content is an announcement of a live Ask Me Anything (AMA) session hosted by the Firefox security team on Reddit. The team invites the community to ask questions about securing the open-source Firefox browser, covering topics such as anti-fingerprinting, security hardening, product security, fuzzing, web security standards, and privacy protections.
A zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks PAN-OS has been exploited for remote code execution. The flaw affects the management interface of PAN-OS on PA-Series, VM-Series firewalls, and Panorama, allowing an authenticated attacker with network access to execute arbitrary code with root privileges. Palo Alto Networks has released patches and indicators of compromise (IoCs) related to limited observed exploitation. CISA has added this vulnerability to its KEV catalog, urging federal agencies to address it promptly.
CVE-2026-0322 is a high-severity remote code execution vulnerability in Palo Alto Networks PAN-OS management interface. It allows authenticated attackers with network access to execute code as root on affected firewall devices. Exploitation requires valid credentials and network access to the management interface. Palo Alto Networks has released security updates for multiple PAN-OS versions and recommends restricting management interface access to trusted internal IPs. Limited exploitation has been observed in the wild. No known workarounds exist, but Threat Prevention signatures offer limited detection capabilities.
This is a promotional post seeking testers for an open-source tool designed to ingest multiple vulnerability feeds and prioritize CVEs based on exploitation risk and other factors. The tool aims to help users rank vulnerabilities for remediation efforts more effectively. It is currently implemented as a Cloudflare worker with plans for a Docker version.
Microsoft's October 2026 Patch Tuesday includes security updates addressing 1415 vulnerabilities across multiple products, with 85 marked as critical. Among these, 67 are remote code execution vulnerabilities. One vulnerability, CVE-2026-96951, a security feature bypass in Windows Shell involving command injection, has been exploited in the wild. Other notable vulnerabilities affect Windows Active Directory Domain Services, Microsoft Exchange Server, Windows Hyper-V, Microsoft Office Excel, Microsoft QUIC, and various Windows components. The vulnerabilities have CVSS base scores ranging from 7.0 to 9.8, indicating high severity. Microsoft has released patches for these issues as part of the monthly update cycle.
Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that allows attackers with upload access to execute arbitrary JavaScript in an administrator's browser. This can lead to theft of administrator authentication tokens and unauthorized access to the Shopware Administration API. If the compromised administrator has extension management privileges, attackers can upload and activate malicious plugins to achieve remote code execution on the server. No vendor patch or statement is currently available. Mitigation involves restricting media upload access to trusted users or disabling HTML file uploads.
Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, module installation, and administrative workflows. These include remote code execution, server-side template injection, stored and reflected cross-site scripting, open redirect, and username enumeration. Exploitation requires authenticated administrative access for most issues, but some vulnerabilities enable unauthenticated attackers to enumerate valid admin usernames. No patch is currently available, and risk mitigation involves restricting administrative interface access and disabling or limiting certain features.
MSPEP v6 is a newly published encryption system that leverages multiple physical device sensors to generate a continuous hardware-rooted entropy pool. It uses random subsets of sensors and cryptographic extractors to produce secure keys and supports applications such as storage encryption, physical timestamping, distributed consensus, and AI session security. The system is released as a defensive publication under a CC0 license, making it freely available without patent restrictions. No vulnerabilities or exploits are described in the publication.
Citrix has issued an urgent warning for IT administrators to immediately patch a critical remote code execution (RCE) vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. The vulnerability allows remote attackers to execute arbitrary code on affected systems. No specific affected versions or patch details are provided in the available information. There is no confirmation of active exploitation in the wild at this time.
Cisco has released patches addressing 35 vulnerabilities across multiple products, including over a dozen critical issues. These vulnerabilities could allow unauthorized access, information leaks, privilege escalation, denial of service (DoS), and remote code execution. Notable affected components include Meraki, License On-Prem, NX-OS, Application Policy Infrastructure Controller (APIC), and Finesse. Cisco reports no known exploitation of these vulnerabilities in the wild. The company has provided security advisories with patches to remediate these issues.
A high-severity vulnerability (CVE-2026-88779) affects Citrix NetScaler ADC and NetScaler Gateway products, including their FIPS variants. Multiple versions prior to 14.1-73.41, 13.1-64.28, and 13.1-37.282 are impacted. The vulnerability is publicly known but no confirmed exploits have been observed in the wild. No patch or remediation information is currently available.
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]
SConnect, a popular browser extension and native host used for authentication with eIDs, 3SKeys, and hardware signing tokens, contains a remote code execution (RCE) vulnerability. The flaw arises from a flawed RSA-2048 token validation implementation that allows uninitialized memory to be exploited, enabling arbitrary DLLs to be loaded silently by any site or iframe the user visits. Version 2.16.0.0 of the extension and native host is affected. The vulnerability is tracked as CVE-2026-18397 with a CVSS score of 9.4, indicating critical severity.
TV Box Sentinel v2.0 is an open-source network monitoring and heuristic threat detection tool designed to identify compromised Android TV boxes and IoT devices. It targets malware preinstalled in the /system partition of uncertified Android TV boxes and botnet loaders such as Badbox, Peachpit, Triada, and Guerrilla. The tool analyzes network traffic captures and router logs to detect indicators of compromise like beaconing, anomalous traffic, C2 communications, lateral movement, and cryptojacking. It generates automated mitigation rules for firewalls and DNS sinkholes and provides executive reports and a graphical user interface for ease of use.
Two zero-day vulnerabilities in the open-source Zammad ticketing system were exploited in an AI-powered attack against the Dutch Institute for Vulnerability Disclosure (DIVD). The flaws allowed attackers to hijack sessions, execute remote code, and escalate privileges to root. The attack led to data exfiltration within DIVD's environment, though network segmentation limited further compromise. Affected versions include Zammad 6.3.0 to 6.5.4, with later versions 7.0.0 to 7.1.3 containing the defect but not exploitable due to environment conditions. DIVD recommends upgrading to Zammad version 7 or taking the system offline. A verification script for detecting compromise is available.
A malicious actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker attempted to establish persistence using a password-protected webshell and tried to escalate privileges by setting setuid and setgid bits on /bin/sh. The attack involved disguising a PHP webshell as a CSS file and manipulating web server aliases to evade detection. Although the targeted sensor was not compromised, the attack demonstrated sophisticated post-exploitation techniques for maintaining access and evading detection.
InvoicePlane version 1.7.1 contains a critical remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code on affected systems remotely. No vendor advisory or patch information is currently available to confirm remediation status or mitigation steps.