UPDATED
Every story on Updated that mentions CVEs & Actively Exploited Vulnerabilities, newest first. Each headline links to a summary page with the original source, so you can scan the topic in under a minute.
CISA KEV · · Critical severity
Google Brotli Unchecked Return Value Vulnerability. Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory...
CISA KEV · · Critical severity
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution...
Help Net Security · · Medium severity
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”,...
AlienVault OTX · · Critical severity
Two critical use-after-free vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2, affect the session.upload_progress feature. These flaws trigger during multipart request parsing before application code...
Tenable Research · · Critical severity
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js,...
CISA KEV · · Critical severity
PHP Stale Internal Request-State Vulnerability. PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions,...
CISA KEV · · Critical severity
PHP Memory Corruption Vulnerability. PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring...
GitLab · · Medium severity
GitLab is not affected by CVE-2026-112900 or the other vulnerabilities fixed in Pillow 13.0.0. GitLab products do not include the Pillow library, and our Security team has found no evidence of impact to GitLab-managed infrastructure....
Hacker News · · Medium severity
The Hacker News · · Critical severity
Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing...
CISA KEV · · Critical severity
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability. Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote...
CISA KEV · · Critical severity
Arista VeloCloud Orchestrator SQL Injection Vulnerability. Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO...
AlienVault OTX · · Critical severity
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, leaked before their scheduled patch on October 21, 2026. The flaws involve out-of-memory corruption in PHP core...
Exploit-DB · · Medium severity
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
Help Net Security · · Critical severity
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker...
AlienVault OTX · · Critical severity
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data...
Hacker News · · Medium severity
AWS Security Blog · · Critical severity
On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both...
Hacker News · · Medium severity
Hacker News · · Medium severity
Ubuntu blog · · Critical severity
Introduction Two critical security vulnerabilities affecting PHP have been identified that result in unauthenticated remote code execution (RCE) for any PHP application. The vulnerabilities have been assigned the CVE-2026-109618 and...
Palo Alto Unit 42 · · Medium severity
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619...
SANS Internet Storm Center · · Medium severity
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead...
Tenable Research · · Critical severity
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical...
All CISA Advisories · · Medium severity
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654...
CISA KEV · · Critical severity
Siemens Software Center Uncontrolled Search Path Element Vulnerability. Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL...
CISA KEV · · Critical severity
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the...
CISA KEV · · Critical severity
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability. Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call...
CISA KEV · · Critical severity
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses...
CISA KEV · · Critical severity
Plex Media Server External Control of File Name or Path Vulnerability. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on...
CISA KEV · · Critical severity
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability. EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands...
AlienVault OTX · · Critical severity
A DLL side-loading vulnerability in Software Center version 3.5.8.7 is being actively exploited by attackers. The threat actors distribute a genuine, digitally signed copy of the application alongside malicious DLL files through...
AlienVault OTX · · Medium severity
In early October 2026, analysts investigated a compromise of a Citrix NetScaler ADC appliance running an affected 14.1 build. Attackers chained two vulnerabilities: CVE-2026-88771 (pre-authentication log-poisoning/RCE) and...
AlienVault OTX · · Medium severity
A critical authentication bypass vulnerability in BeyondTrust Remote Support platform allows unauthenticated remote attackers to perform file operations without user interaction. Versions 26.2.3 and earlier are affected. BeyondTrust...
AlienVault OTX · · Critical severity
On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution vulnerability affecting NetScaler Application Delivery Controller and NetScaler Gateway with a CVSS score of 9.8. The vulnerability enables...
CISA KEV · · Critical severity
Fortinet Multiple Products Path Traversal Vulnerability. FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write...
CISA KEV · · Critical severity
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability. BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the...
CISA KEV · · Critical severity
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability. Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...
CSO Online Security · · Critical severity
A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers to write arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply...
AlienVault OTX · · Critical severity
Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3,...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free