// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# 21 Oct
-
Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution
PHP vulnerabilities may allow unauthenticated remote code execution in installations serving web requests.
-
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Security advisories were published by Cisco on October 21, 2026, including updates related to Snort 3.
-
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Cisco Secure Client's Secure Firewall Posture module due to insufficient IPC input validation.
-
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
A Snort 3 vulnerability lets an authenticated local low-privilege user execute arbitrary commands as the Snort process through an unauthenticated control channel socket.
-
Cisco Unified Communications Products Security Hardening Release: October 2026
A security hardening release for Cisco Unified Communications products follows an internal review of voice and collaboration platforms.
-
Cisco Expressway Series Remote Code Execution Vulnerability
A Cisco Expressway Series vulnerability allows an unauthenticated remote attacker with network access to execute OS commands as root due to database service issues.
-
Cisco Expressway Series Security Hardening Release: October 2026
A security hardening release for Cisco Expressway Series addresses multiple internally discovered vulnerabilities not known to be actively exploited.
-
Cisco Unified Communications Manager Improper Access Control Vulnerability
A Cisco Unified Communications Manager improper access control flaw could allow unauthenticated remote attackers to bypass controls through crafted HTTP requests.
-
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
A Cisco IOS XR flaw on ASR 9000-series routers could let remote attackers cause denial of service via crafted IPv4 packets.
-
Cisco Expressway Series Information Disclosure Vulnerability
The Expressway Series has an unauthenticated remote information disclosure vulnerability caused by insufficient HTTP authorization checks during Mobile and Remote Access provisioning.
-
Widespread PHP Flaw May Cause Many Site Outages Today
A pair of PHP vulnerabilities affecting many websites is being actively exploited and can allow attackers to take control of servers.
-
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
The PHP project released security updates for two critical unauthenticated remote code execution flaws affecting memory handling and request state.
-
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core may affect PHP-based applications and services.
-
CVE-2026-109618 / CVE-2026-109619 | What is Known
Two PHP core flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution and are addressed in October 2026 security updates.