// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# 22 Oct
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) infocon yellow , (Wed, Oct 21st)
PHP.net will release a critical update for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, with early proof-of-concept exploits available.
# 21 Oct
-
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution
PHP vulnerabilities may allow unauthenticated remote code execution in installations serving web requests.
-
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Security advisories were published by Cisco on October 21, 2026, including updates related to Snort 3.
-
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Cisco Secure Client's Secure Firewall Posture module due to insufficient IPC input validation.
-
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
A Snort 3 vulnerability lets an authenticated local low-privilege user execute arbitrary commands as the Snort process through an unauthenticated control channel socket.
-
Cisco Unified Communications Products Security Hardening Release: October 2026
A security hardening release for Cisco Unified Communications products follows an internal review of voice and collaboration platforms.
-
Cisco Expressway Series Remote Code Execution Vulnerability
A Cisco Expressway Series vulnerability allows an unauthenticated remote attacker with network access to execute OS commands as root due to database service issues.
-
Cisco Expressway Series Security Hardening Release: October 2026
A security hardening release for Cisco Expressway Series addresses multiple internally discovered vulnerabilities not known to be actively exploited.
-
Cisco Unified Communications Manager Improper Access Control Vulnerability
A Cisco Unified Communications Manager improper access control flaw could allow unauthenticated remote attackers to bypass controls through crafted HTTP requests.
-
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
A Cisco IOS XR flaw on ASR 9000-series routers could let remote attackers cause denial of service via crafted IPv4 packets.
-
Cisco Expressway Series Information Disclosure Vulnerability
The Expressway Series has an unauthenticated remote information disclosure vulnerability caused by insufficient HTTP authorization checks during Mobile and Remote Access provisioning.