Two memory-safety issues were identified in the Babelfish TDS protocol layer for Aurora PostgreSQL. CVE-2026-119923 involves the TDS connection-handshake handling and could allow a remote, unauthenticated actor to affect the database process. CVE-2026-119924 involves the TDS remote-procedure-call request handling and could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service.
A denial-of-service vulnerability exists in the Microsoft Windows Aero Theme due to improper handling of an error condition. Exploitation requires local access with low-privileged code execution capabilities. The vulnerability can cause a denial-of-service condition on affected Windows installations.
This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.
Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation on certain Google Compute Engine VMs. These vulnerabilities involve a 2-byte out-of-bounds read/write in the vTPM parameter decryption routine. CVE-2023-1017 could allow a local attacker to cause denial-of-service or possibly execute arbitrary code within the vTPM context. CVE-2023-1018 could allow a local attacker to leak limited data from the vTPM context. Google has automatically applied patches to all vulnerable VMs, and no customer action is required.
vsomeip, an open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability in versions 3.7.3 and below. The vulnerability allows a remote, unauthenticated peer to cause excessive memory allocation by declaring a large message size on a reliable (TCP) endpoint before the actual message bytes are received. This can lead to denial of service by exhausting host memory. The issue was fixed in version 3.7.4 by introducing a default maximum message size limit of 10 MiB.
CVE-2026-89090 is a denial of service vulnerability in the event stream header decoder of AWS SDK for Go v2 versions prior to 2026-03-23. An unauthenticated remote actor can send a crafted event stream response frame with an invalid header value type, causing the application process to panic and terminate. The issue is fixed in version 2026-03-23 and later.
CVE-2026-115417 is a vulnerability in the aws-c-mqtt library's MQTT 3.1.1 compatibility adapter that involves memory allocation with an excessive size value. This flaw could allow a remote actor to cause a denial of service (DoS) of the client process. The affected versions are aws-c-mqtt versions from 0.9.1 up to but not including 0.16.2. The vulnerability was disclosed by AWS in an important security bulletin requiring attention. No information about available patches or exploits in the wild is provided.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
An issue in the Linux kernel's virtio-net/TAP networking path affects KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This vulnerability allows an attacker with privileged access inside a guest virtual machine to send specially crafted network packets that can corrupt host kernel memory, potentially leading to host memory disclosure or denial of service. AWS-managed compute and container services are not affected, and no action is required for customers using these services.
Canonical's primary websites, including ubuntu.com, canonical.com, the Ubuntu blog, and developer portal, were disrupted by a distributed denial-of-service (DDoS) attack in October 2026. This incident follows a previous, more disruptive DDoS attack in April 2026 that also affected additional services such as Launchpad and the Snap Store. The October attack caused downtime of approximately four hours, with most affected services restored shortly after. No detailed information on the attack's size or origin has been publicly disclosed, and no group has claimed responsibility for the recent incident. Developer-facing services like Launchpad and the Snap Store were not impacted in the October attack. The April attack was attributed to a hacktivist group, but it is unclear if the two incidents are related.
This analysis discusses a new class of denial-of-service attacks called 'denial of wallet' attacks targeting AI token usage in cybersecurity operations centers (SOCs). Attackers can inflate the cost and latency of AI-driven security processes by injecting malicious prompts into data sources processed by AI agents. This can exhaust budgets or trigger security filters, causing silent failures or degraded investigation quality without immediate alerts. The risk includes disruption of AI-based SOC workflows and increased operational costs. Mitigations include strict token usage limits, filtering untrusted data, limiting agent permissions, and using on-premise AI models to reduce reliance on costly cloud APIs.
A high-severity vulnerability (CVE-2026-88779) affects Citrix NetScaler ADC and NetScaler Gateway products, including their FIPS variants. Multiple versions prior to 14.1-73.41, 13.1-64.28, and 13.1-37.282 are impacted. The vulnerability is publicly known but no confirmed exploits have been observed in the wild. No patch or remediation information is currently available.
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.
To remediate this issue, users should upgrade to version 0.15.0 or later.
CISA has issued a warning about a critical vulnerability in MikroTik RouterOS that allows for remote code execution or denial-of-service conditions without authentication. This flaw poses a significant risk to affected systems if exploited. No specific affected versions or patch information are currently provided.
This analysis discusses a new type of denial-of-service attack against AI agents called "denial of wallet," where attackers exploit the pay-as-you-go token consumption model of large language models (LLMs) to cause excessive financial costs. Autonomous AI agents that operate continuously and retry failed steps can consume tokens unpredictably and in large bursts, making costs difficult to control. Attackers can exploit this by sending numerous complex or looping requests that inflate token usage, leading to significant budget overruns. This issue has been recognized as a top risk in the OWASP guide for language models (LLM06:2026).
CVE-2026-94450 is a denial of service vulnerability in s2n-quic, a Rust implementation of the QUIC protocol. The flaw occurs due to improper validation of the Destination Connection ID length when a server is configured to send Retry packets. An unauthenticated attacker can exploit this by sending a crafted UDP datagram to shut down the vulnerable server endpoint. This affects s2n-quic versions up to and including 1.88.0. AWS services are not impacted, and only server endpoints configured to issue Retry packets are vulnerable. The vulnerability is fixed in version 1.89.0. No workaround exists, so upgrading is required.
Three Linux kernel vulnerabilities have been identified and added to CISA's Known Exploited Vulnerabilities catalog. These flaws allow local attackers to cause denial-of-service conditions, memory disclosure, or unauthorized memory modification. The vulnerabilities involve issues in the TLS receive path, AF_ALG socket handling, and bridge Netfilter ebtables SNAT target. Federal agencies are urged to patch these vulnerabilities promptly.
NightmareStresser was a long-running distributed denial-of-service (DDoS) for-hire service active since at least 2022, likely founded in 2016. It enabled nearly one million users to launch thousands of DDoS attacks per hour worldwide, accepting cryptocurrency payments while avoiding attacks on government, education, and hospital domains. The service was disrupted in a coordinated international law enforcement operation called Operation PowerOFF, which seized its domains and aimed to dismantle DDoS-for-hire infrastructures globally. This takedown is part of ongoing efforts by multiple countries to combat DDoS-for-hire services and hold their operators and users accountable.
The U.S. Federal Bureau of Investigation (FBI) seized the domains of NightmareStresser, a long-running distributed denial-of-service (DDoS) for-hire platform. NightmareStresser allowed users to rent botnets composed of compromised routers and IoT devices to launch large-scale DDoS attacks targeting various network layers. The service had over 566,000 registered users and could launch attacks up to 200 Gbps. This takedown was part of Operation PowerOFF, a coordinated international law enforcement effort to dismantle criminal DDoS-for-hire infrastructures worldwide. Previous actions under this operation have led to multiple arrests and domain seizures of similar services. The FBI and other agencies continue to target these platforms to reduce the prevalence of DDoS attacks globally.
CVE-2026-85228 is an integer overflow vulnerability in the tensor buffer validation component of the Deep Java Library (DJL), an open-source Java framework for deep learning maintained by Amazon. The flaw occurs when a crafted tensor payload declares a shape whose computed byte size exceeds the 32-bit signed integer range, causing the size to wrap and allowing an undersized buffer to pass validation. This leads to out-of-bounds reads during tensor operations. Exploitation could allow a remote, unauthenticated attacker to access adjacent process memory or cause a denial of service. A fix has been released in DJL version 0.37.0. Users are advised to upgrade to this version or later. No workaround other than upgrading is available, but limiting tensor input to trusted sources can reduce risk until patched.