CVE-2026-107441 is an out-of-bounds write vulnerability in the CGI program of Zyxel GS1900 series switches that allows unauthenticated attackers to execute OS commands via crafted HTTP requests. The flaw was exploited in the wild as a zero-day before Zyxel released a patch on October 23, 2026. Approximately 1,000 devices were compromised in attacks initially misattributed to a different Zyxel vulnerability. Zyxel confirmed the new vulnerability after being notified by cybersecurity firm Binarly, which analyzed the malware variants used in the attacks. The vulnerability affects 10 models of the GS1900 series switches. Zyxel published an advisory on November 3, 2026, and released fixes to address the issue.
Ivanti released patches for two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, in its Connect Secure VPN product. These flaws were exploited in combination with a previously disclosed authentication bypass (CVE-2026-104935) in targeted attacks. The vulnerabilities affect versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier, with fixes available in versions 25.1.1.3 and 22.8R2.6. The chained exploitation allowed attackers to achieve unauthenticated root-level code execution on fully patched ICS appliances, primarily for credential theft and data exfiltration. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch promptly.
A critical zero-day vulnerability (CVE-2026-20127) in Cisco SD-WAN controllers has been exploited by a sophisticated threat actor linked to the Volt Typhoon 'Silent Train' network. The vulnerability allows remote attackers to bypass authentication and gain administrative access to SD-WAN controllers without credentials. Attackers deployed KeyDrift malware to maintain persistent access and steal encryption keys, targeting organizations in sectors such as defense, aerospace, telecommunications, and critical infrastructure. The campaigns have been ongoing since at least late 2025, affecting entities primarily in the United States, with a focus on regions including Hawaii, California, and Texas.
CVE-2026-76418 is a high-severity vulnerability in Cisco Secure Firewall ASA and FTD software affecting the Remote Access SSL VPN service. It allows unauthenticated remote attackers to cause the firewall device to restart unexpectedly, disrupting availability. The flaw stems from logic errors in tunnel groups configured with secondary authentication. Cisco has released patches to fix this issue and recommends upgrading. No workarounds exist, though disabling secondary authentication or tunnel group lists can reduce exposure but weaken security. This is the second zero-day exploited in Cisco ASA and FTD VPN services in recent months.
CVE-2026-41709 is a low-severity vulnerability in VMware ESXi that allows attackers with administrative privileges to perform certain operations without those actions being logged. This flaw reduces audit trail visibility, which can aid attackers in hiding their activities. The vulnerability was exploited as a zero-day by the China-linked threat actor Warp Panda in intrusions targeting US organizations, including law firms. VMware has released patches for ESXi versions 9.1.0.0-25370933, 9.0.2.0100-25595025, and 80U3j-25429389 and newer. The US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and urges prompt patching.
Apple released updates for iOS and macOS 27.2 addressing 286 vulnerabilities, including memory corruption bugs, privilege escalation flaws, sandbox escapes, and remote code execution issues. A critical zero-day vulnerability in CoreGraphics, exploited in the wild, was backported and fixed in iOS 18.7.11. The updates also patch numerous security holes in components such as WebKit, kernel, image handling, and network services. Additional patches were released for other Apple operating systems and software.
A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.
Arista Networks patched a critical zero-day vulnerability (CVE-2026-114625) in VeloCloud Orchestrator (VCO) On-Prem deployments. The flaw allows authenticated users with basic privileges to escalate to operator-level privileges via low-complexity SQL injection attacks without user interaction. This enables access to internal functionality not intended for remote access, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later have been patched. Until patches are applied, Arista recommends restricting VCO web interface access, monitoring for suspicious activity, and blocking known malicious IP addresses involved in ongoing attacks.
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
BeyondTrust Remote Support (RS) versions 26.2.3 and earlier contain a critical authentication bypass vulnerability (CVE-2026-102764) that has been actively exploited since August 2026. The flaw allows unprivileged remote attackers to perform unauthorized file operations on vulnerable appliances. The threat actor known as Armory Castle (UNC5221/Warp Panda), linked to Chinese espionage, exploited this zero-day to gain initial access, escalate privileges to root, deploy malware, and move laterally within networks. BeyondTrust patched the vulnerability for SaaS customers on October 8, 2026; self-hosted customers must apply the patch manually if automatic updates are not enabled. Any vulnerable appliance exposed to the internet during the exploitation window should be considered potentially compromised until reviewed.
A zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks PAN-OS has been exploited for remote code execution. The flaw affects the management interface of PAN-OS on PA-Series, VM-Series firewalls, and Panorama, allowing an authenticated attacker with network access to execute arbitrary code with root privileges. Palo Alto Networks has released patches and indicators of compromise (IoCs) related to limited observed exploitation. CISA has added this vulnerability to its KEV catalog, urging federal agencies to address it promptly.
CVE-2026-0322 is a high-severity remote code execution vulnerability in Palo Alto Networks PAN-OS management interface. It allows authenticated attackers with network access to execute code as root on affected firewall devices. Exploitation requires valid credentials and network access to the management interface. Palo Alto Networks has released security updates for multiple PAN-OS versions and recommends restricting management interface access to trusted internal IPs. Limited exploitation has been observed in the wild. No known workarounds exist, but Threat Prevention signatures offer limited detection capabilities.
Cisco patched a zero-day vulnerability (CVE-2026-76519) in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges via a relative path traversal flaw in the Advanced Malware Protection feature. The flaw is exploitable by sending a malicious email attachment to vulnerable SEG devices with the File Reputation service enabled and Content Scanner Tools versions earlier than 25.3.0.5525. Cisco confirmed active exploitation in October 2026 and provided indicators of compromise and mitigation guidance. The vendor has deployed mitigations for cloud instances and contacted affected customers. Administrators are advised to verify device versions, apply patches, and restrict appliance access.
CISA has issued an urgent warning to patch a critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure (ICS) appliances. This flaw has been actively exploited in zero-day attacks since at least October 1, 2026, allowing unauthenticated remote attackers to execute arbitrary commands. Ivanti has released multiple patched versions addressing this issue and urges immediate updates. The vulnerability has been used in complex exploit chains leading to root-level code execution and credential theft. CISA mandates federal agencies to patch and recommends all organizations to check for compromise and remediate accordingly.
Microsoft's October 2026 Patch Tuesday addresses a record 1,411 vulnerabilities, including three zero-day flaws—one actively exploited and two publicly disclosed. This update is significant due to the volume of fixes and the presence of zero-day vulnerabilities requiring attention.
Ivanti Connect Secure (ICS) remote access gateway is affected by a high-severity zero-day vulnerability (CVE-2026-104935) that allows authentication bypass and remote code execution without user interaction. The vulnerability affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Threat actors have exploited this flaw in the wild since at least October 1, 2026, chaining it with other vulnerabilities to achieve unauthenticated root-level code execution. Ivanti has released patches for some related flaws and is working on addressing a privilege escalation vulnerability used in the attack chain. Customers are urged to immediately apply available patches and use the Integrity Checker Tool to detect tampering.
The Pwn2Own Ireland 2026 hacking contest concluded with security researchers exploiting 98 zero-day vulnerabilities across multiple product categories, earning over $1.26 million in rewards. Targets included flagship mobile devices such as the Samsung Galaxy S26 and Google Pixel 10, AI infrastructure, messaging apps, smart home devices, printers, and wellness healthcare devices. The contest requires all targets to run the latest firmware, and vendors must patch disclosed zero-days within 90 days. No active exploitation in the wild is reported at this time.
During the Pwn2Own Ireland 2026 event, security researchers successfully exploited 45 unique zero-day vulnerabilities, including hacking the Samsung Galaxy S26 device three additional times. These exploits were rewarded with a total of $232,500 in cash prizes. No specific technical details or affected software versions are provided in the available information.
Microsoft's FORGE Lab is advancing AI-native vulnerability research, discovering and helping remediate numerous vulnerabilities across Windows and open-source projects including the Linux kernel. Their work from May to September 2026 led to 140 CVEs assigned for Windows and 155 validated reports for open-source projects. The research highlights challenges beyond discovery, emphasizing the need for scalable validation and remediation processes to keep pace with AI-generated findings. Key lessons include shifting focus from capability to scale, optimizing reasoning economics, and coordinating validation and remediation efforts. This approach aims to sustain vulnerability research at scale by integrating automated validation tools and human coordination.
Rockstar Games has suffered multiple confirmed security compromises from 2018 through 2026, involving diverse attack vectors rather than zero-day exploits. These include MFA fatigue attacks, exploitation of hardcoded credentials in collaboration tools, stolen OAuth tokens from third-party SaaS vendors, and reverse-engineered P2P network vulnerabilities leading to remote code execution. The most severe incident in August 2026 involved exfiltration of a playable GTA VI development build and extensive gameplay data due to failures in internal segmentation and data loss prevention. The attacks highlight systemic weaknesses in identity management, token security, and internal network controls.