// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
DSA-6580-1 erlang - security update
A security update has been released for the Erlang programming language packages on Debian.
-
DSA-6581-1 unbound - security update
A security update has been released for the Unbound DNS resolver in Debian.
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect certain Cisco products.
-
VU#763488: Memory corruption vulnerabilities in PHP
Two memory corruption vulnerabilities in older PHP versions could allow remote code execution through crafted HTTP requests.
# Yesterday
-
CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
CVE-2026-115417 is a memory allocation flaw in the MQTT 3.1.1 compatibility adapter of aws-c-mqtt, affecting AWS Common Runtime and IoT SDK components.
-
CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
CVE-2026-115419 is an issue in the Strands Agents SDK A2A server where conversation state was not isolated between authenticated callers, allowing data to be disclosed to the wrong session.
-
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
A Snort 3 SMTP MIME parsing flaw in multiple Cisco products could let a remote attacker cause a denial-of-service restart.
-
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
Snort 3 hardening updates address multiple internally discovered out-of-bounds write vulnerabilities tracked by CVE-2026-20043.
-
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco products using Snort 3 detection engine have denial-of-service vulnerabilities that could cause unexpected restarts.
-
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
Multiple Cisco products using Snort 3 may restart unexpectedly if a remote attacker sends crafted GRE traffic exploiting improper handling of nested GRE packets.
-
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
A vulnerability in Cisco Snort 3 Detection Engine could let a remote unauthenticated attacker cause a denial-of-service condition through crafted GTP traffic.
-
Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Cisco has disclosed a buffer overflow vulnerability in Snort 3 VBA decompression that can cause a remote denial of service.
-
CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook
CVE-2026-115414 describes an OS command injection issue in AWS SAM CLI's Terraform hook, where resource addresses are interpolated into generated Makefile recipes.
-
CVE-2026-115416 - Incorrect authorization checks in Amazon Athena engine version 3 query processing
CVE-2026-115416 affects Amazon Athena engine version 3, where incorrect authorization checks could allow authenticated users to read account identifiers and SQL metadata.
-
ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
A NoMachine nxwebrunner heap-based buffer overflow, CVE-2026-114549, enables unauthenticated remote code execution and is rated CVSS 9.8.
-
ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability
A vulnerability in NVIDIA Megatron Bridge YAML parsing can allow remote code execution when users open malicious files or visit malicious pages.
-
ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
Cisco Snort has a stack-based buffer overflow in OLE VBA decompression that can allow unauthenticated remote code execution.
-
ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability
OpenSSL CMP has a remote information disclosure vulnerability, tracked as CVE-2026-63073, requiring no authentication.
-
ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability
OpenSSL contains a vulnerability in CMS AuthEnvelopedData integrity check validation that could allow tampering by network-adjacent attackers.
-
ZDI-CAN-36560: Apple (CVSS 8.8)
A CVSS 8.8 Apple vulnerability reported through a coordinated disclosure process is pending public disclosure after a fix period.
-
DSA-6534-3 webkit2gtk - regression update
The webkit2gtk package has received a regression update identified as DSA-6534-3.
-
DSA-6577-1 chromium - security update
A security update, DSA-6577-1, addresses vulnerabilities in Chromium on Debian systems.
-
DSA-6578-1 aide - security update
A security update for the AIDE file integrity monitoring package has been released for Debian.
-
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
A remote code execution vulnerability in PHP core versions after 5.4, identified as CVE-2026-109618, is listed on Exploit-DB.
-
Wednesday, October 21, 2026 Security Releases
Security releases for the Node.js runtime were published on October 21, 2026, addressing vulnerabilities.
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution or denial of service on affected workers.
-
CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
CVE-2026-112408 affects SageMaker Python SDK default_bucket(), which uses predictable S3 bucket names without ownership checks, enabling first-creation by another account.
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) infocon yellow , (Wed, Oct 21st)
PHP.net will release a critical update for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, with early proof-of-concept exploits available.
# 21 Oct
-
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution
PHP vulnerabilities may allow unauthenticated remote code execution in installations serving web requests.
-
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Security advisories were published by Cisco on October 21, 2026, including updates related to Snort 3.