The security record
Original notices from software maintainers and security agencies. Check the affected products, versions and configurations, then follow the recommended action.
A security update is not evidence of a breach. Confirmed compromise, possible exposure and observed exploitation are labeled separately. Affected products, versions and configurations vary. These sources do not endorse this site or Motoko; migration does not replace immediate patching, credential rotation or incident response.
39 notices · Latest first
Download JSONNo notices match your search. Try a product name or clear the search to see the full record.
PHP
Application runtime
PHP security advisory publication
Security update
PHP's emergency release fixes two critical vulnerabilities that can allow unauthenticated remote code execution in web-request deployments.
What to do Apply the PHP security update or your vendor's equivalent immediately; the maintainers say there are no complete mitigations.
Source checked
Node.js
Application runtime
Node.js security-release publication
Security update
Node.js security updates for the 22.x, 24.x and 26.x lines include a high-severity Brotli decoder flaw that can permit remote code execution.
What to do Update to the fixed release for your supported Node.js line and review the advisory for the features your application uses.
Source checked
LiteLLM
AI software supply chain
Vendor incident-report publication; report updated 21 October at 20:30 UTC
Confirmed compromise
LiteLLM confirms that its compromised release pipeline published malicious 1.107.0 PyPI wheels and container images; private enterprise releases were not affected.
What to do Follow the incident-response guidance, replace affected artifacts with a verified clean release and rotate credentials reachable from affected hosts.
Source checked
Railway
Hosting platform / credentials
Initial disclosure publication; credential-response guides published 22 October
Possible exposure
Railway says an unauthorized party may have accessed customer environment variables and decrypted some contents; the scope remains under investigation.
What to do Rotate secrets stored in Railway, review service logs and follow the additional AWS or Google Cloud guidance where those credentials were used.
Source checked
GitLab
Development infrastructure
Critical patch-release publication
Security update
GitLab's patch release fixes a critical regular-expression compiler flaw and other security issues in affected self-managed Community and Enterprise Edition installations.
What to do Upgrade affected self-managed installations to a fixed supported release; GitLab.com already includes the fixes.
Source checked
Traefik
Proxy authentication
Maintainer advisory publication
Security update
Traefik's ForwardAuth middleware could pass another user's identity when authentication used connection-bound schemes such as NTLM or Negotiate.
What to do Update affected deployments to a fixed release and review the advisory if your authentication server uses a connection-bound scheme.
Source checked
Cisco Expressway
Communications appliance / database service
Cisco CVE-2026-76466 advisory publication
Security update
Cisco reports a critical database-service flaw in vulnerable clustered Expressway-C and Expressway-E deployments. A remote attacker with network access and the relevant cookies could execute operating-system commands as root.
What to do Update affected Expressway deployments to a fixed release, including X15.5.20 for the listed X15 line; Cisco lists no workaround.
Source checked
Vite
Development tooling
Maintainer advisory publication
Security update
Vite 6.4.4 can expose files blocked by server.fs.deny when its development server is explicitly exposed to the network and the files sit within allowed directories. The maintainer rates the issue moderate.
What to do Update the affected Vite 6 installation to 6.4.5 and avoid exposing development servers unnecessarily.
Source checked
eMudhra
Certificate trust / WebPKI
Cloudflare report publication; Cloudflare learned of the incident on 19 October around 17:00 UTC
Confirmed key compromise
Cloudflare reports compromised private keys for eight eMudhra intermediate certificates; its security review found no active exploitation on Cloudflare services.
What to do Apply the relevant software and trust-store updates, and review configured certificate authorities as directed in the report.
Source checked
Oracle / Java / MySQL
Database and enterprise software
Quarterly Critical Patch Update publication
Security update
Oracle's quarterly update includes 98 security patches across MySQL products and 55 for Java SE; exposure varies by product, component and version.
What to do Use the product-specific risk matrices and patch instructions to update affected installations.
Source checked
Apache Tomcat
Retained service / Java application server
Public disclosure date stated in Apache's advisories; fixed-version releases are dated 12 October
Security update
Apache discloses HTTP/2 request/response mix-ups in asynchronous servlets and a JNDIRealm password-validation bypass when non-GSSAPI SASL is configured. Tomcat 11 also has an AJP response mix-up. Scope depends on connector, version and realm configuration.
What to do Upgrade affected deployments to at least Tomcat 11.0.27, 10.1.61 or 9.0.123 on their respective branches, and compare each CVE's affected range with deployed connectors and authentication settings.
Source checked
Atlassian Data Center
Enterprise application dependencies
Vendor monthly security-bulletin publication
Security update
Atlassian's October bulletin fixes third-party dependency and application vulnerabilities across its Data Center products. The vendor assesses the listed issues as non-critical risk in the affected products; upstream severity ratings do not describe each product's risk. The bulletin does not report observed exploitation.
What to do Use the product-specific fixed-version table. For example, Confluence Data Center fixes are 11.0.0, 10.2.19 LTS or 9.2.26 LTS; Bitbucket fixes are 10.5.1, 10.2.8 LTS or 9.4.26 LTS. Review the affected branch and supported upgrade path.
Source checked
Laravel framework
Application / authentication
Maintainer GitHub security advisory publication date
Security update
CVE-2026-114509 affects Laravel's built-in token-based API guard with certain MySQL/MariaDB configurations. Crafted non-string credentials can authenticate as an existing user without that user's API token; it does not describe every Laravel authentication setup.
What to do Update laravel/framework to at least 13.29.0 or 12.68.0 on the corresponding release line. Inventory routes using the built-in TokenGuard and verify the deployed Composer version.
Source checked
OpenSSH on Ubuntu
Server administration / retained tooling
Ubuntu security-notice publication; upstream OpenSSH 10.6 was released 6 October
Security update
Ubuntu issued fixes covering OpenSSH path handling, authentication state, compression and forwarding restrictions. The notice applies to Ubuntu 26.10 packages, rather than every OpenSSH installation.
What to do Install Ubuntu 26.10 package version 1:10.5p1-1ubuntu3.1 or a later security update. Other distributions should use their own vendor guidance.
Source checked
Roundcube Webmail
Webmail application
Roundcube security-release publication
Security update
Roundcube fixes IMAP and mail-header injection, server-side request forgery filtering, session deserialization and other webmail issues. Each issue has its own affected feature and prerequisites.
What to do Update production Roundcube 1.6.x installations to 1.6.20 and 1.7.x installations to 1.7.5, or later security releases in the same supported line.
Source checked
Pillow / OpenJPEG
Image-processing dependency
Maintainer advisory publication; fixed Pillow 13.0.0 release dated 16 October
Security update
Pillow wheels from 11.1.0 through 12.3.0 bundle an OpenJPEG decoder with a heap-buffer-overflow write reachable while loading crafted JPEG 2000 images. Updating only the host operating system does not replace the wheel’s bundled library.
What to do Upgrade to Pillow 13.0.0 or later and restrict accepted image formats in upload and preview pipelines.
Source checked
pypdf
Document-processing dependency
Maintainer advisory and fixed-release publication; later CVE indexing is not the disclosure date
Security update
Before pypdf 6.21.1, a crafted PDF image labeled as JPEG could invoke other Pillow image parsers. This issue affects environments with the optional Pillow dependency installed; it does not establish code execution by itself.
What to do Upgrade pypdf to 6.21.1 or later; maintainers also link the patch for installations that cannot yet upgrade.
Source checked
MCP TypeScript SDK
Agent server isolation
Maintainer advisory publication
Security update
Affected @modelcontextprotocol/server HTTP deployments could deliver one client's messages to another when clients shared a server or transport instance.
What to do Upgrade to version 2.3.0 or later and use the documented request or session isolation pattern.
Source checked
Apache Camel / Spring Redis
Application integration / data serialization
Apache Camel CVE-2026-78165 advisory publication
Security update
Camel's default Spring Redis serializer could deserialize untrusted Java objects before route processing. An actor able to publish to a subscribed Redis channel could reach code execution.
What to do Upgrade to Camel 4.18.5, 4.22.1 or 4.23.0 for your supported line. If upgrading is delayed, follow Apache's serializer-filter guidance and restrict Redis publishers.
Source checked
Symfony
PHP application framework
Symfony component security-advisory publication
Security update
Symfony fixes costly parsing of a crafted Cache-Control request header, plus process crashes when applications parse untrusted expressions or deeply nested YAML. The header flaw needs no authentication; the other paths depend on application features.
What to do Update affected components to the fixed versions in the advisories. The current follow-up fixes are included in Symfony 5.4.54, 6.4.48, 7.4.21 and 8.1.9.
Source checked
NGINX
Web server and proxy
Security-fix release publication
Security update
NGINX fixed five medium-severity vulnerabilities involving specific rewrite, expression-evaluation, HTTP/3, TLS session-ticket and asynchronous-I/O configurations.
What to do Update affected installations to a fixed supported release and check the feature-specific conditions in the advisories.
Source checked
Linux
Operating system / virtualization
Coordinated oss-sec disclosure; linked research write-up is dated 12 October
Research disclosure
A Linux vhost cache flaw can give a local user with vhost-device access root privileges, with a guest-escape path under specific virtualization conditions.
What to do Install the fixed kernel or vendor backport and reboot; apply the advisory's device-access restrictions while unpatched.
Source checked
Next.js / React
Application framework
Next.js security-update publication
Security update
Next.js fixed two critical remote-code-execution paths and a high-severity denial-of-service issue affecting particular server-side features and dependencies.
What to do Upgrade to a fixed Next.js release and review the advisory for the affected App Router, image-optimization and Server Actions configurations.
Source checked
Palo Alto Networks
Firewall management interface
Initial advisory publication; updated 15 October
Observed exploitation
Palo Alto Networks reports very limited exploitation of a PAN-OS management-interface flaw that lets an authenticated attacker execute code as root.
What to do Install the fixed release for your PAN-OS branch and restrict management-interface access to trusted systems.
Source checked
Drupal core
Content management system
Drupal security advisory publication
Security update
Drupal's Field UI vulnerability is not directly exploitable with core alone, but contributed modules or custom code can expose exploit paths, including one requiring no authentication.
What to do Update supported installations to Drupal 10.6.19, 11.3.19 or 11.4.10 as appropriate; uninstalling Field UI provides temporary protection while updating.
Source checked
PostgreSQL ODBC driver
Database connector
psqlODBC 18.00.0005 security release publication
Security update
psqlODBC versions 08.01.0102 through 18.00.0004 could corrupt application memory when binding an excessive number of statement parameters. Exposure depends on how applications construct parameter lists.
What to do Upgrade to psqlODBC 18.00.0005. Until then, cap parameter counts built from external input or use an array parameter as described by the maintainer.
Source checked
.NET Framework
Application runtime
Microsoft cumulative-update release date
Security update
Microsoft's cumulative update fixes multiple security issues in .NET Framework, including remote code execution, denial of service and privilege escalation.
What to do Apply the update appropriate to your installed .NET Framework and Windows versions using Microsoft's product-specific links.
Source checked
Keycloak
Identity and token exchange
Keycloak 26.8.1 security-fix release publication; the underlying CVE issue was opened 25 September
Security update
A Standard Token Exchange V2 request could bypass a confidential client's required mTLS certificate binding when the requester already held its credentials and a valid subject token.
What to do Use a supported release containing the CVE-2026-97846 fix, including 26.8.1, and review the upgrade guide and your token-exchange configuration.
Source checked
Adobe Commerce / Magento Open Source
Application / commerce
APSB26-153 publication date
Security update
APSB26-153 addresses critical, high and medium issues in affected Commerce and Magento releases, including arbitrary code execution. Adobe explicitly says it is not aware of in-the-wild exploits for these issues.
What to do Apply the October security update for your supported product and release line, using Adobe's version table. Adobe also requires the separate CVE-2026-75650 hotfix; do not assume the monthly update includes it.
Source checked
SharePoint Server Subscription Edition
Enterprise web applications
Microsoft cumulative security-update publication
Security update
KB5002927 addresses SharePoint code execution, disclosure, spoofing, privilege and security-feature bypass issues, alongside a Word code-execution issue. It applies to the on-premises Subscription Edition release, not SharePoint Online. The update article does not establish exploitation of the listed issues.
What to do Install KB5002927, build 16.0.20326.20190, following the SharePoint deployment instructions. Farms using SharePoint Workflow Manager require KB5002799 first. Classic Workflow Manager needs the documented debug-flag step. The package replaces KB5002908.
Source checked
NetScaler ADC and Gateway
Retained enterprise access infrastructure
Vendor bulletin CTX697191 initial publication
Security update
CVE-2026-107406 can cause remote code execution or denial of service in customer-managed SAML SP/IdP configurations. Version-specific preconditions apply: newer affected builds require SAML IdP, while older builds can also be exposed as SAML SP. Citrix said it knew of no unmitigated exploits at publication.
What to do Apply 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 FIPS/NDcPP, or a later supported fixed release for that branch. Earlier September/October fixes do not cover this issue. Review the bulletin configuration matrix; Citrix-managed cloud services are updated by Citrix.
Source checked
Go
Application runtime and standard library
Go security-release publication; later certificate guidance dated separately
Security update
Go fixes HTTP/2 denial-of-service, HTTP request and response handling, template escaping and other issues. Exposure depends on which standard-library features a program uses.
What to do Use the current supported security release, Go 1.27.3 or 1.26.10 as checked on 22 October, and rebuild and redeploy affected applications. These include the 8 October fixes and a separate 19 October certificate-trust mitigation.
Source checked
PostgreSQL JDBC driver
Database connector / authentication
pgJDBC 42.7.14 release and maintainer advisories; PostgreSQL news announcement followed 9 October
Security update
pgJDBC 42.7.14 fixes a fail-open authentication-policy configuration and a separate flaw that could store earlier statement bytes when an application supplied a value shorter than its declared length.
What to do Upgrade to pgJDBC 42.7.14. Review requireAuth settings and use the maintainer's documented authentication-policy workaround if an immediate upgrade is unavailable.
Source checked
aiohttp
Application HTTP dependency
Maintainer advisory publication; fixed 3.14.4 release was published 5 October
Security update
The aiohttp maintainers disclosed multiple cases of excessive or unbounded memory and CPU consumption on attacker-controlled requests. Versions through 3.14.3 are affected.
What to do Update to aiohttp 3.14.4 or later and review the advisory against the request-handling features the service uses.
Source checked
WordPress core
Application / CMS
WordPress maintenance and security release publication date
Security update
WordPress's release includes stored cross-site scripting, denial of service, WXR-export SQL injection and private-comment disclosure fixes. This is a core security update, separate from the PHP runtime update.
What to do Install WordPress 7.1.3 or the applicable backported security release for your deployed branch. Confirm the installed version; maintainers identify only the latest major release as actively supported.
Source checked
Django
Application framework
Django security-release publication
Security update
Django fixes denial-of-service, spatial-lookup request forgery and model-formset privilege issues. The affected features and input conditions differ; default auto-increment model primary keys are not affected by the formset issue.
What to do Upgrade supported installations to Django 6.1.2, 6.0.9 or 5.2.18, or a later security release in the same supported line.
Source checked
Atlassian Data Center products
Enterprise web applications
Vendor critical-advisory publication; outside the preferred 7–22 October window
Security disclosure
CVE-2026-21589 permits access to specific files beneath affected application roots when the attacker knows their exact names and paths. It does not enumerate directories. Atlassian says its patched Cloud products showed no evidence of exploitation; that statement must not be generalized to customer-managed instances.
What to do Patch affected installations to the vendor-listed fixed version: Confluence 9.2.26 or 10.2.19; Jira Software 9.12.40, 10.3.26 or 11.3.12; other products have separate fixes. If patching is delayed, restrict external access and apply the vendor-tested proxy or rewrite mitigation.
Source checked
Craft CMS
Content management system
Craft CMS maintainer advisory publication
Security update
A malicious or compromised account with basic Control Panel access can trigger operating-system command execution as the PHP/web-server account through the render-components action when an entry type and entry already exist. The advisory affects Craft CMS 5.0.0 through versions before 5.11.0.
What to do Update affected Craft CMS 5 installations to 5.11.0 or later and review Control Panel account access. This is an authenticated flaw, not anonymous code execution.
Source checked
Apache HTTP Server
Web server
Apache HTTP Server 2.4.69 security release date
Security update
Apache's October release fixes multiple module and configuration-specific issues, including CGI redirect handler confusion, WebDAV crashes and data corruption, and HTTP/2 memory handling. These are security fixes, not evidence that every Apache deployment was compromised.
What to do Upgrade affected httpd 2.4 installations to 2.4.69 or the vendor's fixed package. Review enabled CGI, DAV, HTTP/2 and proxy modules against the individual advisories rather than treating every CVE as universally reachable.
Source checked
