// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
A recent security discussion examines the reliability and exploitability of the php2shell vulnerability affecting PHP-based web infrastructure.
-
Ruby Regexp compilation fixes related to GitLab's CVE's
Ruby released Regexp compilation fixes related to GitLab CVEs.
-
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
CVE-2026-87912 and CVE-2026-87913 identify missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server.
-
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
A CVE reports an issue in awslabs mysql-mcp-server, a tool for connecting MySQL databases with Model Context Protocol clients.
-
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
A stored cross-site scripting issue in OpenSearch Dashboards involves a bypass of a Vega expression function.
-
CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
CVE-2026-85787 affects Amazon's PostgreSQL MCP server, allowing disallowed SQL inputs to modify data beyond read-only limits.
-
PHP Informational advisory: Session upload progress (CVE-2026-115560)
PHP published an informational security advisory for CVE-2026-115560, which affects session upload progress functionality.
-
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
A security alert update summarized recent PHP vulnerabilities and returned to normal status.
-
CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-95664 affects Apache Camel’s AWS2-S3 producer, which evaluates untrusted S3 object keys from the CamelAwsS3Key header as simple expressions.
-
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
A Palo Alto Networks advisory says PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect some of its products, with severity rated high.
-
DSA-6579-1 roundcube - security update
A security update for Roundcube webmail has been released for Debian systems.
-
DSA-6581-1 unbound - security update
A security update has been released for the Unbound DNS resolver in Debian.
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect certain Cisco products.
-
VU#763488: Memory corruption vulnerabilities in PHP
Two memory corruption vulnerabilities in older PHP versions could allow remote code execution through crafted HTTP requests.
# Yesterday
-
CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook
CVE-2026-115414 describes an OS command injection issue in AWS SAM CLI's Terraform hook, where resource addresses are interpolated into generated Makefile recipes.
-
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
OpenSSL CMP has a remote information disclosure vulnerability, tracked as CVE-2026-63073, requiring no authentication.
-
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
OpenSSL contains a vulnerability in CMS AuthEnvelopedData integrity check validation that could allow tampering by network-adjacent attackers.
-
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
A remote code execution vulnerability in PHP core versions after 5.4, identified as CVE-2026-109618, is listed on Exploit-DB.
-
Wednesday, October 21, 2026 Security Releases
Security releases for the Node.js runtime were published on October 21, 2026, addressing vulnerabilities.
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution or denial of service on affected workers.
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) infocon yellow , (Wed, Oct 21st)
PHP.net will release a critical update for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, with early proof-of-concept exploits available.
# 21 Oct
-
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution
PHP vulnerabilities may allow unauthenticated remote code execution in installations serving web requests.
-
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Cisco Secure Client's Secure Firewall Posture module due to insufficient IPC input validation.
-
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
A Snort 3 vulnerability lets an authenticated local low-privilege user execute arbitrary commands as the Snort process through an unauthenticated control channel socket.