Security news 44/2026

PHP

On an out-of-memory (OOM) error, PHP may leave request memory uninitialized, and subsequent cleanup continues to operate on it. An unauthenticated attacker can thus execute code remotely on the server (RCE). According to reports, the flaw was exploited by suspected China-linked attackers in their custom PHP2Shell exploit.

What to do: Immediately update PHP on all web servers per vendor or distribution guidance and check the servers for signs of compromise.

PHP

PHP global state may continue to point into a previous request's memory even after it has been freed, and subsequent requests read invalid data from it. An attacker can thus execute code remotely without authentication. The flaw is exploited together with CVE-2026-109618.

What to do: Deploy fixed PHP versions together with the fix for CVE-2026-109618 and restart PHP-FPM and web services after updating.

GitLab CE/EE

Due to insufficient validation of regular expressions in CI/CD configuration, an unauthenticated attacker can execute arbitrary code on the GitLab server. Affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2.

What to do: Update to 19.2.8, 19.3.5, 19.4.2 or later, restrict internet access to GitLab and check the server for possible compromise.

Google Brotli (Node.js, .NET, Envoy, Istio, Debian and others)

A buffer overflow in the Brotli decoder in versions 1.0.3 through 1.2.0 allows an unauthenticated attacker to use a crafted compressed stream to read memory, crash the service and potentially execute code. The library is used by many HTTP servers, proxies and runtimes.

What to do: Update libraries and programs using Brotli to version 1.0.10, 1.1.1 or 1.2.1 and deploy fixed distribution packages as well as dependent applications.

Linux kernel (RHEL, OpenShift and others)

When the kernel coalesces network packets, the shared-memory flag is lost. ESP (IPsec) decryption can then overwrite data in the page cache. A local user with normal privileges can compromise the confidentiality and integrity of the system.

What to do: Deploy the fixed kernel from your distribution vendor and reboot servers, especially those using IPsec and with multi-user access.

Cisco Secure Firewall ASA / FTD

When secondary authentication is configured on a tunnel group, an unauthenticated attacker can reboot the device with a single crafted request to the remote access SSL VPN. The result is a denial of service (DoS).

What to do: Update ASA/FTD per Cisco's advisory and consider restricting access to the SSL VPN in the meantime.

Ivanti Connect Secure

In version 22.8R2.4, the dsinvoked service improperly trusts DSCache configuration data, allowing privilege escalation to root. Attackers have been chaining it with another zero-day, CVE-2026-118527, since at least October 1.

What to do: Install Ivanti security updates and check the gateway for signs of compromise.

Adobe Commerce / Magento

Unrestricted upload of dangerous files can lead to code execution if a victim visits a crafted URL. Hundreds of online stores have already been compromised this way in the PolyShell campaign.

What to do: Update Adobe Commerce per vendor guidance and check upload directories for webshells.

VMware ESXi

Due to insufficient logging, a malicious administrator can perform certain operations without them being recorded. The flaw does not grant access by itself, but helps an attacker cover their tracks.

What to do: Update ESXi per vendor guidance and restrict and audit administrator accounts.

GitLab flaw exploited, Alpine Linux rebuilds its server

On October 20–21, attackers attempted to exploit CVE-2026-97229 on Alpine Linux development infrastructure. Due to the risk of compromise, the project rebuilt its GitLab server and reset all passwords. More than 1,000 internet-facing GitLab servers remain unpatched, so after updating, also check for possible compromise.

PHP2Shell exploit: attackers gained root on 25 servers

Suspected China-linked attackers built a custom exploit for PHP flaws and took over 25 servers. According to the report, they likely still have access to a network connected to the US government. Linux kernel and VMware ESXi flaws are also mentioned in connection with the attack, so the entire stack needs patching.

XCPE botnet of 1.3 million Android TV boxes disrupted

Google, together with partners and law enforcement, cut off a botnet of more than 1.3 million Android TV boxes from its command-and-control servers. According to Google, the manufacturer Videostrong deliberately planted a backdoor in the devices and sold access to criminals. They used the boxes for ad fraud and to relay third-party traffic through home connections, so ISPs should monitor suspicious traffic from customer end devices.

APT group exploits Cisco SD-WAN to deploy KeyDrift malware

The newly described group UAT-11473 is exploiting the authentication bypass CVE-2026-20127 in Cisco Catalyst SD-WAN controllers and deploying its custom KeyDrift malware framework. Cisco SD-WAN operators should verify patch status and inspect their controllers.

Synology warns of C3RB3R ransomware on NAS devices

Synology has observed an increase in C3RB3R ransomware attacks on its NAS devices and urges customers to update immediately. This affects businesses as well as customers with internet-facing NAS devices.

PolyShell campaign compromises hundreds of Adobe Commerce stores

Attacks via the file upload flaw CVE-2026-48356 have compromised hundreds of stores on Adobe Commerce and Magento. At the same time, traffic exploiting the Brotli flaw (CVE-2026-111497) is appearing. Hosting providers with online stores should check uploaded files and deploy fixes.

CSIRT.CZ: critical Linux kernel flaw in Ubuntu, RHEL and others

CSIRT.CZ warns of vulnerability CVE-2026-98432 (CVSS 9.8), a use-after-free when establishing TCP connections over IPv4. According to CSIRT.CZ, the flaw can be exploited remotely. It affects virtually all Linux servers, so watch for kernel fixes from your distribution and deploy them together with the fix for CVE-2026-46300.

CSIRT.CZ: Broccoli2Shell flaw in Brotli threatens HTTP applications

CSIRT.CZ warns of the critical Broccoli2Shell vulnerability (CVE-2026-111497) in the Brotli compression library, which may allow an attacker to execute code remotely. The flaw is already being actively exploited and affects applications and proxies that process compressed HTTP traffic.

Progress WS_FTP Server (Windows)

OS command injection in versions before 2024.0.7 and 2025.0.4 allows arbitrary command execution in certain configurations. The related flaw CVE-2026-90865 allows commands to be executed with elevated privileges.

What to do: Update to 2024.0.7 or 2025.0.4 and restrict access to the FTP server.

Dell PowerProtect Data Domain

Improper authentication allows a remote unauthenticated attacker to execute commands as root and take over the backup system. The same versions are also affected by the stack overflow CVE-2026-103780.

What to do: Update per Dell's advisory as soon as possible and do not expose Data Domain management to untrusted networks.

WordPress plugin AjaxLoadMore Cache

Versions up to 3.1.1 contain a flaw that an unauthenticated attacker can exploit for remote code execution on the website.

What to do: Search hosted websites for the plugin and update it, or deactivate it until a fix is released.

WordPress plugin Acadlix LMS

In versions up to 1.1.9, improper path validation allows deletion of arbitrary files on the server, such as wp-config.php, which can lead to site takeover. The protection can effectively be bypassed even by an unauthenticated attacker.

What to do: Update the plugin to a version newer than 1.1.9, or deactivate it.

Yamaha NWR100 (Wi-Fi router)

OS command injection allows an unauthenticated attacker to execute arbitrary commands on the router via a crafted request.

What to do: Update the firmware per vendor guidance and do not expose router management to the internet.

D-Link DIR-505

The web management interface in firmware 1.10B02 contains a backdoor that allows remote takeover of the device. An exploit is publicly available, and the same firmware also suffers from a stack overflow in TFTP (CVE-2026-120189).

What to do: Decommission the device or isolate it from the internet and block access to its management interface.

OPNsense

In versions before 26.7.8, a user with the System: Firmware privilege can save a malicious mirror URL and execute commands as root. They can also disable package signature verification.

What to do: Update to 26.7.8 or later and review who has firmware management privileges.

Juniper Session Smart Router / Conductor

An attacker with configuration write privileges can execute commands as root via AccessManager. A similar flaw, CVE-2026-103403, additionally allows file deletion.

What to do: Update per Juniper guidance and restrict accounts with configuration write privileges.

Dell OpenManage Enterprise

Versions before 4.8.0 contain an OS command injection that can be exploited even by a remote low-privileged user. Other similar flaws require high privileges.

What to do: Update to 4.8.0 and make the management interface accessible only from the management network.

Tenda W18E

The packet capture feature in diagnostics allows an authenticated user to execute commands as root. If the device is in its factory default state, the attacker does not even need to log in.

What to do: Secure new devices with a password immediately before connecting them to the network, update the firmware per vendor guidance and restrict access to management.