GitLab Patches CVSS 10.0 Unauthenticated RCE Flaw CVE-2026-110264
October 23, 2026
GitLab fixed CVE-2026-110264, a CVSS 10.0 regex flaw in Onigmo that can let unauthenticated users run code on self-managed servers
Application Security
GitLab Patches CVSS 10.0 Unauthenticated RCE Flaw CVE-2026-110264
GitLab fixed CVE-2026-110264, a CVSS 10.0 regex flaw in Onigmo that can let unauthenticated users run code on self-managed servers back to version 7.0.
Node.js Security Releases Fix Brotli Out-of-Bounds Write Flaw
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public PoC hit RCE only on ...
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before PyPI quarantined it.
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and during the patch release.
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94 minutes before detection.
Public Exploit Released for Critical FortiSIEM Flaw CVE-2026-106173
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 unauthenticated path traversal flaw in Fortinet FortiSIEM that leads to code execution.
OpenCode Silently Patched Critical RCE Flaw With No CVE
Pillar Security says OpenCode fixed a critical MCP OAuth remote code execution flaw in version 1.18.33 without a CVE or advisory, hiding it from scanners.
Node.js Security Releases Fix Brotli Out-of-Bounds Write Flaw
October 23, 2026
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
October 22, 2026
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
October 22, 2026
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
October 22, 2026
A CVSS 9.3 denial-of-service flaw in Signal’s RingRTC library can leave a microphone and camera live after hangup. A fix
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
October 22, 2026
Google’s Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
October 21, 2026
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
October 21, 2026
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94
Public Exploit Released for Critical FortiSIEM Flaw CVE-2026-106173
October 21, 2026
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 unauthenticated path traversal flaw in Fortinet FortiSIEM that leads to code
OpenCode Silently Patched Critical RCE Flaw With No CVE
October 21, 2026
Pillar Security says OpenCode fixed a critical MCP OAuth remote code execution flaw in version 1.18.33 without a CVE or
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.