Mistral Vibe versions before 2.25.5 on Windows have an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start without any trust prompt.
A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.
The Joomla extension DJ-Classifieds versions prior to 3.11.3 contains an unauthenticated SQL injection vulnerability in the frontend search functionality. This flaw allows attackers to execute arbitrary SQL commands without authentication, potentially leading to severe impacts on data confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 9.3. No patch or remediation details are provided in the available data.
GoFound versions through 1.4.1 have a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can submit malicious document text to the /api/index endpoint, which is then indexed and returned unescaped by searcher/engine.go. The dashboard.vue component renders this content using v-html, causing script execution in an administrator's browser when a search matches the malicious document.
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have both the comment indexing and comment highlighting options enabled, and the payload only fires when a visitor reaches a singular page via a Relevanssi search-result permalink carrying the highlight query parameter.
CVE-2026-115774 is a denial of service vulnerability in the Twisted IMAP4 server affecting versions 26.4.0 and earlier. An authenticated client can send a SEARCH command with a negative literal size, causing an infinite loop in the parser. This freezes the single-threaded reactor, halting all IMAP connections and any other services running in the same process until it is restarted. There is no impact on confidentiality or integrity, and no code execution is possible.
CVE-2026-57203 is a vulnerability in Asterisk's ast_loggrabber component where it executes a Python script from the world-writable /tmp directory. This allows an attacker with shell access to place a malicious script that could be executed with elevated privileges when an administrator runs ast_loggrabber. The issue affects multiple versions of Asterisk prior to fixed releases and has been addressed in versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.
CVE-2026-117513 is a SQL injection vulnerability in the php-travel-agency-system by oretnom23. It affects the admin/customer_search.php file, specifically the Admin Search Pages component. The flaw allows remote attackers to manipulate input parameters such as customer_name, voucher_no, or emp_name to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no patch or vendor response is currently available.
Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
CVE-2026-76298 affects Splunk Enterprise versions prior to 10.4.4 and 10.2.8. It allows non-admin and non-power users to derive the PostgreSQL sidecar database superuser password and execute arbitrary OS commands as the Splunk Enterprise user on search head cluster members. This vulnerability arises because the privileged database password is derived from the search head cluster identifier, which is exposed in search job logs. The issue is fixed in versions 10.4.4 and 10.2.8.
CVE-2026-76291 affects Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. It allows users with the schedule_search capability to bypass safeguards in the scheduled search workflow and execute risky SPL commands. These commands can disclose or modify data or disrupt availability. The vulnerability arises because the search scheduler does not enforce SPL safeguards on scheduled searches. A fix is available in the specified patched versions.
ClickFix is a rapidly growing browser-based attack technique that uses fake AI tool installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Attackers exploit user habits around AI tool adoption, such as running terminal install commands and searching for AI apps via search engines, to deliver malicious payloads. These attacks bypass traditional defenses by leveraging legitimate domains, cloaking, and in-memory execution. ClickFix attacks accounted for up to 67% of detected browser-based attacks in mid-2026, with a significant portion delivered through compromised websites, malvertising, and SEO poisoning. Variants like InstallFix and LLMshare use cloned install pages and malicious shared AI chatbot artifacts to lure victims. Microsoft reports ClickFix as a highly effective initial access technique with over 1.1 million unique devices affected in early 2026.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
Threat actors are conducting phishing campaigns targeting Google Cloud Platform (GCP) environments by using sponsored search ads to steal privileged user credentials. They disable security controls, create service accounts with Gemini API access, and link attacker-controlled external projects to victim billing accounts. This enables unauthorized large-scale AI workload execution, causing significant unexpected charges within 24-48 hours. The attackers use evasion techniques such as geographic IP blending and demoting legitimate administrators to avoid detection and remediation.
A use-after-free vulnerability exists in the Search component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability has been assigned a high severity rating with a CVSS score of 8.8. Google has released a fix in version 156.0.8078.47.