PAYCOMET for WooCommerce versions from 5.36 up to but not including 5.46 contain an authentication flaw where the plugin does not verify the cryptographic signature on payment notification requests related to tokenisation. This allows unauthenticated attackers to overwrite stored payment tokens for existing orders and delete saved card records. The issue is fixed in version 5.46.
CVE-2026-118688 is a vulnerability in wasmtime-wasi in Wasmtime versions before 36.0.18, 48.0.6, and 49.0.3. It involves the re-appending of a trailing slash to rename source paths, which causes the renameat system call on macOS and FreeBSD hosts to follow directory symbolic links (symlinks). This allows a guest with sandbox write access to rename a relative symlink such as "up/" to move host directories into its sandbox, potentially enabling unauthorized read or write access to host directories.
Coder versions before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 have a vulnerability where the audience claim of Google Cloud Engine instance-identity JWTs is not validated at a specific API endpoint. This allows attackers with a valid identity token for another relying party to replay it and obtain a workspace agent's session token, which remains valid until the next build.
MR ROBOT is a sophisticated Android Malware-as-a-Service operation targeting Indian bank customers. It operates on a subscription model allowing cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The malware uses a multi-stage dropper to deploy banking trojans that intercept SMS and OTPs, silently enable call forwarding to bypass two-factor authentication, and overlay phishing screens to steal sensitive financial and identity information. One affiliate compromised 153 devices and intercepted over 5,400 SMS messages. The operation includes a Telegram bot storefront offering about 36 fake apps impersonating banks and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.
The timoni-0.36.0-1.1 package on the GA media of openSUSE Tumbleweed addresses multiple security issues. These vulnerabilities are collectively fixed in this package version. No specific details about the individual flaws or their impacts are provided.
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This vulnerability affects certain versions of Wasmtime, a WebAssembly runtime, allowing for a sandbox escape. The affected versions include Wasmtime before 24.0.13, versions 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4. The vulnerability is identified as CWE-61, which relates to improper control of resource through a sandbox escape. No CVSS score or detailed impact information is provided, and no patch links or remediation details are included in the data.
This content describes a free, read-only bash script designed to triage WordPress sites for signs of compromise related to the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a third CVE-2026-115560. The script checks PHP versions, WordPress core and plugin integrity, suspicious PHP files in uploads, recent file modifications, common web-shell patterns, user accounts, cron jobs, logs, Docker containers, and configuration settings relevant to the vulnerabilities. It generates detailed Markdown reports without modifying the target systems. The PHP2Shell vulnerabilities are critical remote code execution bugs patched in PHP releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but the third CVE has no fixed build yet, with a recommended mitigation of setting session.upload_progress.enabled=0. The script helps detect potential backdoors planted before patching, as updating PHP alone does not remove them.
In October 2026, critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP affecting multiple supported versions. These vulnerabilities allow unauthenticated attackers to execute code remotely due to out-of-memory corruption and stale global state issues. Emergency security updates were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Mitigations exist but are incomplete; updating to the fixed versions is strongly recommended. Additional incidents involving LiteLLM, eMudhra, GitLab, Railway, and Zeabur were also reported in the same timeframe. The PHP project continues to address these issues with further advisories and release candidates.
A Korean-speaking threat actor linked with moderate confidence to North Korea's Lazarus Group is conducting a global campaign exploiting two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. The campaign targets government agencies, financial institutions, manufacturing, logistics, aviation, and trading platforms across multiple countries including the US, Japan, and EU. Exploitation attempts have been observed since 17 October 2026, involving web shell deployment and session poisoning. The vulnerabilities affect all internet-facing PHP installations below versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with Apache mod_php being at highest risk.
CVE-2026-115893 is a critical vulnerability in the bytecodealliance wasmtime runtime for WebAssembly on aarch64 platforms using the Cranelift compiler backend. Versions prior to 36.0.19, between 37.0.0 and before 48.0.7, and between 49.0.0 and before 49.0.4 are affected. The flaw allows a user-controlled WebAssembly module to escape the sandbox by exploiting an incorrect conditional branch target when compiling a br_table instruction with more than approximately 256,000 targets. This can lead to arbitrary code execution outside the sandbox. The issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
PHP2Shell refers to two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. These flaws have been exploited in attempts to spread a Mirai-derived botnet variant named Potassium. Despite multiple exploitation attempts and the emergence of an ASLR bypass exploit, no confirmed successful compromises have been reported. The vulnerabilities were patched on October 21, 2026, with PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations have taken precautionary measures including taking systems offline during patching. Exploits require uncommon server configurations and detailed knowledge, limiting their effectiveness in typical production environments.
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Non security issue fixed:
- SELinux CIL files are not shipped in Docker (bsc#1278193).
Changes for docker:
- Update to Docker 29.7.2. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/29/#2972>
fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
- Update to buildx 0.36.1. See upstream changelog online at
<https://github.com/docker/buildx/releases/tag/v0.36.1>
