Security news 44/2026

PHP

A memory handling flaw during out-of-memory (OOM) errors allows an unauthenticated attacker to execute code remotely (RCE) and take over the web server. Products with embedded PHP are also affected, e.g. Palo Alto PAN-OS and Siemens RUGGEDCOM APE1808.

What to do: Immediately update PHP on all servers and hosting platforms per your distribution or vendor, and check for available PAN-OS fixes.

PHP

PHP global state may continue to reference request memory after it has been freed (use-after-free). An attacker can exploit this for remote code execution. Together with CVE-2026-109618, it is among the flaws exploited in PHP2Shell attacks.

What to do: Deploy the patched PHP version together with the fix for CVE-2026-109618, and until then restrict internet access to unnecessary PHP applications.

GitLab CE/EE

Due to insufficient validation of regular expressions in CI/CD configuration, an unauthenticated attacker can execute arbitrary code on the GitLab server. Versions 19.2 through 19.4 prior to the fixes are affected.

What to do: Update to 19.2.8, 19.3.5 or 19.4.2 and check internet-facing instances for signs of compromise.

Google Brotli (Node.js, .NET, Envoy, Istio, Debian and others)

A remote attacker can trigger a buffer overflow in the Brotli decoder in versions 1.0.3 through 1.2.0 using a crafted compressed data stream. This gives access to sensitive memory, can crash the service, or potentially allow code execution.

What to do: Update the Brotli library to 1.0.10, 1.1.1 or 1.2.1 and deploy vendor patches for products that bundle Brotli.

Cisco Secure Firewall ASA / FTD

A logic flaw in the Remote Access SSL VPN service manifests when secondary authentication is configured on a tunnel group. An unauthenticated attacker can then send a crafted request to force a device reload, causing a denial of service (DoS).

What to do: Update ASA/FTD per Cisco's advisory and check whether you use secondary authentication for SSL VPN.

Linux kernel (RHEL, OpenShift and others)

When coalescing TCP packets, the kernel loses the shared-fragments flag, so ESP (IPsec) processing may decrypt data directly into page cache pages. A local attacker with a regular account can thus write to memory beyond permitted boundaries and compromise the entire system.

What to do: Install the patched kernel from your distribution and reboot the servers.

Adobe Commerce (Magento)

The flaw allows uploading a malicious file and executing code if the victim visits a crafted URL or compromised page. PolyShell attacks exploiting it have already compromised hundreds of stores.

What to do: Apply Adobe's patches to all Commerce/Magento installations and check them for unknown uploaded files.

Ivanti Connect Secure

The dsinvoked service improperly trusts DSCache configuration data, enabling privilege escalation up to root. Attackers chain this flaw with others to gain unauthenticated root access.

What to do: Update Ivanti Connect Secure per the vendor's instructions and restrict access to device management.

VMware ESXi

Due to insufficient logging, a malicious administrator can perform certain operations without them being recorded. The flaw is low severity on its own but is nevertheless being exploited in attacks.

What to do: Update ESXi per VMware and restrict and monitor administrator accounts.

PHP2Shell: attackers gained root on 25 servers and Palo Alto firewalls

Attackers suspected of ties to China built their own exploit for the PHP flaws and gained root access on 25 servers; they likely still have access to a network connected to the US government. The attacks have been ongoing for more than a week, successfully compromising Palo Alto firewalls while so far failing against WordPress. Over 22.6 million exposed instances are potentially at risk, making PHP updates the top priority.

GitLab flaw exploited against Alpine Linux infrastructure

On October 20–21, attackers attempted to exploit CVE-2026-97229 on the Alpine Linux project's GitLab development server. Due to possible compromise, the project rebuilt the server and reset all passwords. Anyone who had an unpatched internet-facing GitLab should consider a similar approach.

PolyShell attacks breached hundreds of Adobe Commerce stores

PolyShell attacks exploiting CVE-2026-48356 have already breached hundreds of Adobe Commerce/Magento online stores. Traffic exploiting the Brotli flaw (CVE-2026-111497) is also emerging. This affects hosting providers and online store operators, who should apply patches without delay and review their installations.

APT group exploits Cisco SD-WAN to deploy KeyDrift malware

The newly tracked APT group UAT-11473 is exploiting the authentication bypass flaw CVE-2026-20127 in Cisco Catalyst SD-WAN controllers and deploying its custom KeyDrift malware on them. Cisco SD-WAN administrators should verify that patches are applied and hunt for signs of compromise.

Attackers exploit critical flaw in Drupal Commerce Core

Drupal warns of active exploitation of a highly critical missing authorization flaw in the Commerce Core module (CVE-2026-118539). Versions up to 2.41 and 3.0.0 through 3.3.13 are affected. Hosting providers with Drupal-based online stores should promptly update the module per Drupal's security advisory.

Attackers chain three Ivanti Connect Secure flaws to gain root

Attackers combine three flaws in Ivanti Connect Secure to gain unauthenticated root access to the VPN gateway. CISA has added CVE-2026-111357 and CVE-2026-118527 to its list of actively exploited vulnerabilities. Ivanti VPN operators should update and inspect their devices without delay.

Critical Linux kernel vulnerability threatens Ubuntu, RHEL and other distributions

CSIRT.CZ highlights CVE-2026-98432 (CVSS 9.8), a use-after-free flaw that occurs when establishing TCP connections over IPv4. Anthropic researchers developed an exploit for it that allows an unauthenticated remote attacker to execute commands as root. Monitor your distribution's kernel updates and deploy them as soon as possible.

Broccoli2Shell vulnerability in Brotli library threatens HTTP applications

CSIRT.CZ warns of the Broccoli2Shell flaw (CVE-2026-111497) in the Brotli compression library, which enables remote code execution. Applications and services that use Brotli for HTTP compression are at risk. The flaw is already being actively exploited, so both the library and products bundling it must be updated.

Fortinet FortiSandbox

By bypassing authentication via an alternate path, a remote attacker can execute unauthorized code or commands using crafted HTTP requests. FortiSandbox 4.2, 4.4.0–4.4.9 and 5.0.0–5.0.6 are affected, including PaaS versions.

What to do: Update per Fortinet's guidance and restrict web interface access to trusted networks.

Dell PowerProtect Data Domain

An authentication flaw allows an unauthenticated remote attacker to execute commands as root and take over the entire backup system. The stack overflow CVE-2026-103780 has the same impact.

What to do: Update as soon as possible per Dell's advisory and do not expose device management to the internet.

Progress WS_FTP Server (Windows)

An OS command injection flaw allows arbitrary command execution on the server in certain configurations. The related flaw CVE-2026-90865 also allows command execution with elevated privileges.

What to do: Update to version 2024.0.7 or 2025.0.4.

WordPress plugin Acadlix LMS

Versions up to 1.1.9 allow deletion of arbitrary files on the server, e.g. wp-config.php, which easily leads to remote code execution. The protective nonce is publicly exposed in the page source, so the attack effectively requires no authentication.

What to do: Identify sites on your hosting using this plugin and deactivate it until a patched version is deployed.

TOTOLINK A950RG

An attacker can inject and execute commands on the router via a spoofed MAC address in DHCP records. A public exploit exists, and the same firmware suffers from further command injection flaws (CVE-2026-116504, CVE-2026-116506).

What to do: Determine whether you or your customers operate these routers, restrict management access and watch for vendor firmware updates.

D-Link DIR-505

The web management interface contains a backdoor in /secmark1524.cgi through which the device can be remotely controlled. An exploit is publicly available.

What to do: Block device management access from untrusted networks and check with the vendor for an available fix.

OPNsense

A user with the System: Firmware privilege can save a malicious firmware mirror URL and execute commands as root. This can also be used to disable package signature verification.

What to do: Update to OPNsense 26.7.8 and grant firmware privileges only to accounts that strictly need them.

Juniper Session Smart Router / Conductor

An attacker with configuration write access can execute commands as root via YANG configuration. The related flaw CVE-2026-103403 allows file deletion and command execution.

What to do: Update per Juniper and limit the number of accounts with configuration write access.

Asterisk

When the res_config_ldap module is used, an unauthenticated attacker can inject an LDAP filter via a crafted SIP name and read data from LDAP. The module is not enabled by default.

What to do: If you use res_config_ldap, update to 20.20.1, 21.12.3, 22.10.1, 23.4.1 or Certified 20.7-cert11 or 22.8-cert3.

Dell OpenManage Enterprise

An OS command injection flaw allows a low-privileged remote attacker to execute commands on the hardware management server. Versions prior to 4.8.0 also contain other similar flaws.

What to do: Update to version 4.8.0 and restrict console access to the management network.