# Threat Watch by Helix — Vulnerabilities

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1848 incidents, 75 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 1041 incidents, 52 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 109 incidents, 96 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (75)

### [critical] Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)
https://helix.ml/threat-watch/i/linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432 · Vulnerabilities · partial · since 2026-10-29 · CVE-2026-98432
A use-after-free race condition in the Linux kernel's IPv4 TCP handshake code (introduced in Linux 4.4, fixed upstream Oct 5) lets a remote unauthenticated attacker who can reach an exposed TCP service win a race to leak kernel memory (bypassing KASLR) and overwrite a callback pointer to execute arbitrary commands as root. Anthropic reported its Claude AI model wrote a working exploit (48 min to leak an address, 5 min to root) targeting servers with a multipath TCP listener; IPv6 is unaffected. Kernel team scores it 9.8; Red Hat, Oracle, SUSE and Amazon score 5.9–8.1. Debian, Oracle, SUSE and Amazon have shipped fixed kernels; Ubuntu and RHEL have not as of Oct 29, 2026.
Fixed: Upstream fix applied Oct 5, 2026 and backported to all maintained stable branches; Amazon Linux 2023 kernel6.18-6.18.56-125.164.amzn2023 and kernel6.12-6.12.113-138.209.amzn2023; Debian linux 6.12.113-1 and 6.1.190-1; SUSE kernel-default 6.12.0-160000.40.1 or later
Do: Check whether your distribution/kernel has shipped the CVE-2026-98432 fix and apply the vendor kernel update as soon as available (Debian, Oracle, SUSE, Amazon fixes already out); Until patched, restrict exposure of TCP services, especially any using multipath TCP (MPTCP), via firewalling/ACLs; Disable or avoid MPTCP listeners on internet-facing Linux servers where feasible; Monitor kernel/distribution advisories (ALAS2023-2026-3251/3335, ELSA-2026-500397/98/99, DSA-6568-1, DLA-4841-1/4850-1) and vendor status pages for fix releases; Watch for signs of exploitation: unexpected kernel crashes or root-level compromise on hosts with exposed TCP/MPTCP services

### [critical] WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected
https://helix.ml/threat-watch/i/wordpress-7-1-4-unauthenticated-race-condition-in-core-update-process-enables-rce-exploitation-attempts-detected · Vulnerabilities · patched · since 2026-10-29
WordPress 7.1.4 was released on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. Wordfence reports that threat actors are already actively attempting to exploit the flaw following the release, making rapid patching urgent. All self-hosted WordPress sites that have not yet updated to 7.1.4 are affected. Site owners should verify their WordPress version and update immediately, as exploitation attempts were detected after the release.
Fixed: 7.1.4
Do: Verify your WordPress version and update to 7.1.4 immediately; Check logs for exploitation attempts against the update process; Ensure automatic updates for minor/security releases are enabled; Review site integrity and look for signs of compromise

### [critical] Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907)
https://helix.ml/threat-watch/i/zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files · Vulnerabilities · patched · since 2026-10-28 · CVE-2025-29787, CVE-2026-115905, CVE-2026-115907, CVE-2026-115908, CVE-2026-115909
The Rust zip crate (zip-rs/zip2) has four critical/high vulnerabilities. CVE-2026-115905 (<=9.0.4): ZipArchive trusts the Central Directory File Header while ZipStreamReader trusts the Local File Header, so crafted ZIPs present different filenames/contents to scanners vs extraction, enabling scanner bypass, arbitrary file overwrite, DoS and RCE; shallow_copy_file can also desync headers. CVE-2026-115908 (>=7.2.0,<9.0.0): ZipArchive::extract validates symlink targets only lexically, allowing arbitrary file writes outside the extraction dir (including cross-drive/UNC on Windows) when the destination path is guessable; a regression reintroduced CVE-2025-29787 conditions. CVE-2026-115909 (>=1.3.0,<9.0.0): attacker-declared ZIP64 uncompressed size in the symlink branch causes an uncatchable SIGABRT from a 112-byte archive. CVE-2026-115907 (>=5.1.0,<9.0.0, legacy-zip feature): Shrink decoder capacity-overflow panic from attacker-controlled uncompressed size. All fixed in 9.0.0/9.0.5; public PoCs exist, no in-the-wild exploitation reported.
Fixed: zip 9.0.0; zip 9.0.5
Do: Upgrade the zip crate to 9.0.5 immediately (covers all four CVEs); Audit upload pipelines for ZipStreamReader::extract/visit on untrusted archives and any ZipArchive::extract of attacker-supplied ZIPs; Treat archives inspected with CDFH-based parsers as unverified if extraction uses streaming readers; block or re-scan archives whose LFH/CDFH entries disagree; Disable or gate the legacy-zip feature if not needed; run extraction in isolated sandboxes with resource limits and validate post-extraction paths; On Windows, restrict symlink creation privileges (SeCreateSymbolicLinkPrivilege) for extraction processes

### [high] VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls
https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709 · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-101767, CVE-2026-102764, CVE-2026-109618, CVE-2026-109619, CVE-2026-41709, CVE-2026-46300, CVE-2026-76418
CISA added CVE-2026-41709 (CVSS 2.7), an insufficient logging flaw in VMware ESX, to KEV on Oct 28, 2026 after CrowdStrike revealed China-nexus Warp Panda (UNC5221) exploited it as a zero-day in early 2026 to suppress audit trails in espionage against the US legal sector. Warp Panda exploits internet-facing edge devices, pivots to vCenter deploying BRICKSTORM/SharpStorm, harvests M365 session tokens and registers rogue MFA devices. Separately, a China-nexus actor used Dream-documented AI-assisted campaigns chaining PHP2Shell (CVE-2026-109618/109619) with the Fragnesia Linux kernel LPE (CVE-2026-46300, KEV, due Oct 31) to root 25 firewalls and steal AD credentials; Palo Alto confirmed active exploitation of its management interface, and Cisco confirmed exploitation of firewall DoS flaw CVE-2026-76418. Broadcom fixed CVE-2026-41709 in July 2026; FCEB agencies must remediate by Nov 11, 2026.
Fixed: VMware Cloud Foundation: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, 5.2.4; VMware vSphere Foundation: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025; VMware ESX: ESXi80U3j-25429389; VMware Telco Cloud Platform: ESXi80U3j-25429389
Do: Patch VMware ESX/ESXi, vSphere Foundation, Cloud Foundation, and Telco Cloud Platform to fixed builds immediately; patch Linux kernel for Fragnesia (CVE-2026-46300) by Oct 31 and Palo Alto/Cisco firewall software per vendor advisories.; Hunt for Warp Panda activity: audit ESXi/vCenter logs for gaps, look for BRICKSTORM/SharpStorm indicators, and check for bypassed audit logging on internet-facing edge devices.; Review cloud and M365 environments for harvested session tokens: revoke sessions, check for rogue MFA device registrations, enforce token binding/conditional access.; Reduce internet exposure of ESXi, vCenter, and edge/VPN appliances; follow CISA BOD 26-04 forensic triage requirements; discontinue use if mitigations unavailable.; Assume prior admin-level activity may be unlogged; perform forensic triage on any ESXi host or firewall that was internet-reachable or admin-accessed during 2026.

### [critical] Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)
https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767 · Vulnerabilities · patched · since 2026-10-28 · CVE-2025-61882, CVE-2026-101767, CVE-2026-35273
Threat actors began scanning and running exploratory exploits against Oracle E-Business Suite instances for CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution. Defused observed exploit attempts against decoy EBS systems on Oct 27, 2026, though Oracle has not yet tagged the flaw as exploited in the wild. Shadowserver tracks over 670 Internet-exposed Oracle EBS instances, mostly in the US. Oracle patched the flaw in its October 20, 2026 Critical Security Patch Update and warned that some customers were compromised because they had not applied available patches. Oracle products are frequent targets: Clop and ShinyHunters previously exploited EBS and PeopleSoft zero-days, and CISA has listed 46 Oracle bugs as actively exploited since 2021.
Fixed: October 2026 Critical Security Patch Update (2026-10-20)
Do: Apply Oracle's October 2026 Critical Patch Update immediately if running EBS; Take EBS instances off the public Internet or restrict HTTP access to the Thin Client Framework servlet; Check logs and decoys for exploit attempts against CVE-2026-101767 since disclosure; Assume compromise if unpatched and exposed; investigate for data theft and follow-on access; Stay on actively supported Oracle versions and keep up with quarterly CPU patches

### [high] Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)
https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418 · Vulnerabilities · patched · since 2026-10-29 · CVE-2026-20349, CVE-2026-76418
Cisco released fixes on 2026-10-29 for CVE-2026-76418 (CVSS 8.6), a second exploited zero-day in its Secure Firewall ASA and FTD software since August. The flaw resides in the Remote Access SSL VPN service and stems from logic errors in tunnel groups configured with secondary authentication. Unauthenticated attackers can send a malicious request during SSL VPN connection to force the device to reload, disrupting availability. Cisco learned in October that the flaw was being exploited in the wild but disclosed no details on attacks or threat actors; it is unclear whether the same actor exploited August's CVE-2026-20349. The bug surfaced via a Cisco TAC support case. No workarounds exist; disabling the tunnel group list or removing secondary authentication reduces exposure but weakens VPN security. Secure Access, cloud-delivered firewall, and Secure Firewall Management Center are not affected.
Do: Upgrade ASA/FTD to the patched releases immediately, prioritising internet-reachable SSL VPN endpoints; If patching is delayed, restrict exposure of the SSL VPN login service and consider disabling the tunnel group list or removing secondary authentication, weighing the security trade-off; Monitor firewalls for unexpected reloads and anomalous SSL VPN connection requests; Review whether secondary authentication is used in affected tunnel groups and harden remote access VPN configurations; Check for related exploitation indicators tied to the August CVE-2026-20349 zero-day

### [critical] Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601)
https://helix.ml/threat-watch/i/electrum-malicious-server-rbf-fee-bump-theft-via-unverified-mempool-tx-cve-2026-117601 · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-117601
A malicious Electrum server can swallow a client's just-broadcast transaction (tx1) and replace it in the client's history with a conflicting, invalid transaction (tx2) whose outputs pay the attacker; signatures are not verified due to light-client design. If the user then RBF fee-bumps the displayed tx2, they sign and pay the attacker. Attackers grinded output addresses to mimic the last four chars of the legit address and used zero-fee tx2 to bait fee bumps; some servers performed this in the wild, with two user reports including a confirmed loss. Fix in commit 90fe308 (v4.8.3, tagged 2026-10-23, released 2026-10-24) verifies signatures of is_mine inputs for mempool transactions; incoming txs remain unvalidated. Users connecting only to trusted/self-run servers are unaffected.
Fixed: electrum 4.8.3
Do: Upgrade Electrum to 4.8.3 or later immediately; Until upgraded, manually verify output addresses and amounts before signing any transaction, including fee bumps; Connect only to trusted servers, ideally run your own Electrum server; Check wallet history for unexpected replacement transactions after broadcasting; Watch for addresses whose last characters mimic your intended payee address

### [high] Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626)
https://helix.ml/threat-watch/i/jenkins-multiple-vulnerabilities-fixed-in-2-588-lts-2-580-2-rce-arbitrary-file-read-write-xss-cve-2026-117612-et-al · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, CVE-2026-117621, CVE-2026-117622, CVE-2026-117623, CVE-2026-117624, CVE-2026-117625, CVE-2026-117626
On 2026-10-28 the Jenkins project published advisory 2026-10-28, which fixes 15 vulnerabilities in Jenkins core (13 rated High, 2 Medium) in weekly 2.588 and LTS 2.580.2. Every earlier release is affected. Most of the bugs give a logged-in user with modest permissions control of the controller. CVE-2026-117612 (CVSS 8.8): the XStream converter skipped the JEP-200 deserialization filter for classes named in a `resolves-to` attribute. A user with Overall/Read who can POST a config.xml can instantiate arbitrary types, which can lead to RCE. CVE-2026-117614: Agent/Configure was enough to run arbitrary code on the controller, because legacy agent launch commands were converted without script approval. CVE-2026-117616: an HTTP endpoint loaded any config.xml on disk as an agent, and saving that agent overwrites a file of the attacker's choosing. Two symlink bugs give arbitrary file read on job rename (CVE-2026-117615) and arbitrary file write by racing parallel artifact archiving (CVE-2026-117617). Both can lead to RCE. Account takeover issues: CVE-2026-117618 is a race in the setup wizard. While the initial admin is being replaced, an unauthenticated attacker can create an administrator account, so a fresh controller reachable from the internet is at risk. CVE-2026-117620 lets a user plant a 'Manage Old Data' entry; when an admin acts on it, a user's password is overwritten. CVE-2026-117619 lets a revoked API token keep its access through a 'remember me' cookie. The rest are stored XSS (config.xml collection elements, breadcrumb tooltips; CVE-2026-117613, -117623), XSS from compromised agents (CVE-2026-117621, -117622), a PersistenceRoot nesting bypass (CVE-2026-117624), and two information leaks (HTTP proxy settings and $JENKINS_HOME file listings; CVE-2026-117625, -117626). Many reports came from Anthropic's OSS program; others came from independent researchers. No exploitation is known. Upgrading is the fix. On 2.539+/LTS 2.541.1+, enforcing CSP mitigates the XSS issues.
Fixed: Jenkins weekly 2.588; Jenkins LTS 2.580.2
Do: Upgrade controllers to Jenkins 2.588 (weekly) or 2.580.2 (LTS). Every earlier version is affected, and only the upgrade closes the RCE paths.; Take the controller off the public internet. Most of these bugs need only a low-privilege account, and CVE-2026-117618 needs none, so internet exposure is the biggest risk multiplier. If it is public only so GitHub, GitLab, Bitbucket or Gitea webhooks can reach it, use the Webhook Relay plugin (https://plugins.jenkins.io/webhook-relay, setup: https://webhookrelay.com/docs/tutorials/cicd/jenkins-plugin/). The plugin opens an outbound WebSocket to a relay bucket and replays only webhook deliveries to the SCM endpoint (e.g. /github-webhook/). No inbound port is opened, so the UI, the config.xml APIs and the setup wizard are not reachable from outside.; Never leave a new controller on a reachable network while the setup wizard is unfinished (CVE-2026-117618). Finish setup on an isolated network, or with the admin created through JCasC.; Until you have upgraded, cut Overall/Read for anonymous users and audit who holds Item/Configure, Agent/Configure and View/Configure. Those permissions are the entry point for the XStream, agent-launch and symlink RCEs.; Look for tampering: agents with unexpected launch commands or new names, config.xml changes made through the REST API, new admin or user accounts, and any 'Manage Old Data' warnings. Do not act on Old Data warnings you cannot explain (CVE-2026-117620).; Revoke and re-issue API tokens you suspect are exposed, and invalidate sessions as well. Revoking a token did not end 'remember me' cookies obtained with it (CVE-2026-117619).; On 2.539+/LTS 2.541.1+, enforce Content Security Policy to blunt the stored XSS issues. Treat build agents as untrusted, because a compromised agent could inject XSS into the controller UI (CVE-2026-117621/-117622).

### [high] Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)
https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve · Vulnerabilities · partial · since 2026-10-24
Erica Windisch (Cyberdione Labs) published "Tailworm" on 2026-10-24, about two hours after sending it to Tailscale. The report lists 11 findings from lab testing of Tailscale v1.104.2 and headscale v0.29.5. The main issue is in Tailscale SSH: unix-socket forwarding checked socket paths by name but acted on them as root. A peer the tailnet policy already allows to SSH in could therefore dial root-only sockets with `ssh -L`, such as the Docker socket or the tailscaled LocalAPI. With `ssh -R` it could replace root-owned sockets, and a check-then-use race also defeated the path allowlist. The result is root on the target. Tailscale shipped fixes in 1.104.4 on 2026-10-28. Its bulletins are TS-2026-014 (SSH socket forwarding), TS-2026-015 (SSH session memory exhaustion that can OOM-kill tailscaled), TS-2026-016 (Serve unix backends reaching privileged sockets, including the LocalAPI) and TS-2026-017 (HTTP/2 Serve leaking Tailscale-App-Capabilities across mounts). An attacker first needs a foothold on an authorized device and a matching SSH grant. Movement is limited to connections the policy file allows, so Tailscale disputes the "worm" label. No in-the-wild exploitation has been reported. Not everything is fixed. The researcher reports the headscale memory-exhaustion issue as still pending. The Funnel entitlement check, enforced only by the CLI, has no fix. The Conn25 app-connector egress flaw affects only an unreleased, pre-production feature, which Tailscale says will be fixed before release. No CVEs have been assigned.
Fixed: Tailscale 1.104.4 (released 2026-10-28)
Do: Upgrade every node that runs Tailscale SSH or Serve to Tailscale 1.104.4 or later (`tailscale version`); Until upgraded, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it; this keeps SSH working but blocks the socket-forwarding path; Audit SSH rules in the tailnet policy file: replace identity- or tag-wide accept rules with per-pair grants, and use check mode for sensitive hosts; Self-hosted headscale: treat every SSH grant as root-equivalent (forwarding cannot be disabled there), set memory limits and restart supervision, and throttle registration until a fix ships; If a tailnet device may have been compromised, delete it in the admin console and rotate reachable auth keys and credentials; reimaging alone does not revoke copied node keys

### [critical] Adobe Campaign Classic: 8 critical flaws enabling RCE and security bypass patched (CVE-2026-104351 et al.)
https://helix.ml/threat-watch/i/adobe-campaign-classic-8-critical-flaws-enabling-rce-and-security-bypass-patched-cve-2026-104351-et-al · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-104350, CVE-2026-104351, CVE-2026-104353, CVE-2026-104354, CVE-2026-105489, CVE-2026-105779, CVE-2026-105780, CVE-2026-105781, CVE-2026-48360
Adobe released its October 2026 patches fixing eight critical vulnerabilities in Adobe Campaign Classic, including code injection, OS command injection, incorrect authorization, SQL injection, and reflected XSS flaws with CVSS scores from 9.1 to 9.9. Successful exploitation could allow arbitrary code execution, security feature bypass, and privilege escalation. The flaws affect Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux, fixed in build 9403. Adobe also patched a critical code injection flaw (CVE-2026-48360, CVSS 9.6) in Adobe Connect Desktop and Mobile for Windows, macOS, and Android that could result in arbitrary code execution. Adobe says it is not aware of any exploits in the wild for any of the addressed issues. Users are advised to update to the latest versions for protection.
Fixed: Adobe Campaign Classic 7.4.4 build 9403; Adobe Connect Desktop Windows 2026.9.61; Adobe Connect Desktop macOS Silicon 2026.10.66; Adobe Connect Desktop macOS Intel 2026.10.170; Adobe Connect Mobile Android 4.5
Do: Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 immediately; Update Adobe Connect Desktop to 2026.9.61 (Windows), 2026.10.66 (macOS Silicon), 2026.10.170 (macOS Intel) and Adobe Connect Mobile for Android to 4.5; Review internet-exposed Campaign Classic instances and restrict access pending patching; Check logs for signs of SQL injection or code execution attempts; Verify patched builds are deployed across all Windows and Linux hosts

### [critical] Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)
https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497 · Vulnerabilities · partial · since 2026-10-22 · CVE-2026-111497
An out-of-bounds write in Google's Brotli decoder (versions 1.0.3 to 1.2.0) lets anyone who can make a program decompress attacker-controlled Brotli data corrupt its memory, leak data, crash it or run code. Node.js disclosed it on October 21 as "Node2Shell": servers that decompress request bodies (Express 5, body-parser 2.x) and apps whose fetch() receives Brotli responses from a malicious or compromised server are exposed. By October 23 it was clear the same flaw reaches Python (the Brotli and brotlicffi packages that requests, httpx and aiohttp load automatically), libbrotli, curl, Bun, Envoy and Istio, hence "HTTP2Shell". OpenAI found the bug in February; it was fixed in Brotli source then but not recognised as a vulnerability or released until now, so every project bundling Brotli has to ship its own update. Researchers have shown code execution against an unmodified Node.js image; no exploitation in the wild has been reported. Advisory databases were slow to map the CVE to the PyPI packages, so dependency scanners may not flag them yet.
Fixed: libbrotli 1.2.1 (also 1.1.1, 1.0.10); Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Brotli (PyPI) 1.2.1, brotlicffi 1.2.1.0; Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8; Istio 1.29.9, 1.30.6, 1.31.2
Do: Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 (or newer in the same line) and rebuild container images; Node.js 25.x, 23.x, 20.x and older get no fix; Upgrade Python Brotli to 1.2.1+ and brotlicffi to 1.2.1.0+ wherever installed, including inside images; do not rely on scanners flagging it; Upgrade Bun to 1.4.4+, Envoy to 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8, Istio to 1.29.9 / 1.30.6 / 1.31.2, and libbrotli to 1.2.1 (or patched 1.1.1 / 1.0.10); install OS vendor Brotli updates; Where no patch is available yet, disable Brotli decoding of untrusted input (request bodies, outbound fetch responses)

### [critical] EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595)
https://helix.ml/threat-watch/i/epics-base-ai-agent-finds-4-severe-bugs-incl-critical-rce-in-industrial-control-software-cve-2026-114595 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598
Causal Security's autonomous AI agent Cipher discovered four previously unknown vulnerabilities in EPICS Base, the open source SCADA toolkit used by ~90 major scientific facilities including Argonne's Advanced Photon Source and ITER's fusion reactor control system. The flaws are a critical CVSS 9.8 integer overflow (CVE-2026-114595) enabling attacker-controlled out-of-bounds heap write and potential RCE; an 8.2 improper message-length validation flaw (CVE-2026-114596) causing OOB write and controller crash; and two 7.5 highs (CVE-2026-114597 insufficient bounds checking, CVE-2026-114598 type confusion) enabling OOB reads, crashes, DoS and adjacent memory disclosure. CISA issued an advisory. Exploitation requires network reach to EPICS services but not deep OT expertise. Fixes are in EPICS Base 7.0.11.
Fixed: 7.0.11
Do: Update EPICS Base to version 7.0.11 immediately; Segment/isolate control networks running EPICS from other systems and restrict access to EPICS services; Review exposure of EPICS controllers across network boundaries and firewall OT traffic; Monitor controllers for crashes or anomalous network traffic; Assess operational risk to experiments and plan for potential downtime

### [critical] Three TLS Bugs in GoAhead web server: revoked certs accepted, DH truncation, chain-depth bypass (no CVEs)
https://helix.ml/threat-watch/i/three-tls-bugs-in-goahead-web-server-revoked-certs-accepted-dh-truncation-chain-depth-bypass-no-cves · Vulnerabilities · patched · since 2026-10-28
FoxIO disclosed three independent TLS bugs in EmbedThis GoAhead <= 6.1.0, fixed in 6.1.1. With the OpenSSL-compatible backend (>=3.4.5), a CRL is loaded but never enforced, so revoked client certificates are silently accepted in mTLS deployments (CVSS 9.1, GOAHEAD-SA-2026-0006). LibreSSL legacy-verifier builds (3.2.x, 3.3.2-3.3.6) with VERIFY_PEER=1 and VERIFY_ISSUER=0 accept over-depth client certificate chains, bypassing the chain-depth limit (CVSS 7.4, GOAHEAD-SA-2026-0004). The Mbed TLS backend (>=4.0.2) has a buffer-length typo in sslOpen() that reduces the 2048-bit DH modulus to one byte, making TLS 1.2 DHE_RSA sessions decryptable to observers (CVSS 5.9, GOAHEAD-SA-2026-0005). GoAhead is embedded in vast numbers of IoT, firewall, OT and military devices (Palo Alto, D-Link, HP, Canon, Siemens, Boeing, etc.). No in-the-wild exploitation reported; GHSA advisories published.
Fixed: 6.1.1
Do: Upgrade GoAhead to 6.1.1 or later, or apply vendor firmware updates for devices embedding GoAhead; If upgrade is not immediate, disable finite-field DHE cipher suites or switch to the OpenSSL backend (Mbed TLS issue); Enable VERIFY_ISSUER=1 with a trusted CA bundle or use OpenSSL/LibreSSL 4.x (LibreSSL legacy verifier issue); Audit mTLS deployments for reliance on CRL revocation checking and re-evaluate trust in previously revoked client certificates; Inventory devices and products that embed GoAhead and track vendor advisories

### [critical] GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)
https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-100104, CVE-2026-100755, CVE-2026-101168, CVE-2026-103515, CVE-2026-103549, CVE-2026-104661, CVE-2026-105458, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14210, CVE-2026-14288, CVE-2026-14552, CVE-2026-14814, CVE-2026-15723, CVE-2026-16255, CVE-2026-16275, CVE-2026-16301, CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-78335, CVE-2026-81839, CVE-2026-82632, CVE-2026-84284, CVE-2026-85529, CVE-2026-89078, CVE-2026-92528, CVE-2026-9268, CVE-2026-92883, CVE-2026-93577, CVE-2026-96893, CVE-2026-97229
GitLab patched CVE-2026-110264 (CVSS 10.0), an unauthenticated RCE caused by an integer overflow in Ruby's Onigmo regex compiler, which GitLab bundles and ships. It affects every self-managed GitLab version since 7.0 (2014); the Oct 12 fix for the earlier CVE-2026-97229 covered only 19.2+, so instances patched then are vulnerable again. It is the fourth Onigmo RCE reported by researcher joaxcar in a month (two 9.9 auth-required, two 10.0 unauthenticated). Ruby released 4.0.9, 3.4.12, and 3.3.13 fixing three underlying bugs; Ruby 3.2 and earlier get no fix. No exploitation or CISA KEV listing as of Oct 23; no workaround exists. GitLab also fixed 10 other issues including an 8.2 account-takeover and a 7.5 OAuth/OIDC cache-poisoning flaw.
Fixed: GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13; Ruby 4.0.9, 3.4.12, 3.3.13
Do: Upgrade self-managed GitLab immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 — instances patched on Oct 12 are still vulnerable; Plan for downtime on single-node upgrades (19.4.3/19.3.6 include database migrations); use zero-downtime procedure on multi-node; Deploy GitLab's TLDR Sigma detection rules ('Onigmo native worker crash', 'Org mode render error burst') to hunt exploitation attempts; Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 in any Ruby app compiling regexes from untrusted input; note Regexp.timeout and pattern-length caps do not mitigate; Migrate off Ruby 3.2 (EOL, unfixed) or stop compiling attacker-controlled patterns via Regexp.new/union/compile or interpolation; Review SAML+LDAP auto-linking and shared-cache OAuth/OIDC setups against CVE-2026-15723 and CVE-2026-112212

### [critical] Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)
https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-106179, CVE-2026-106180, CVE-2026-106182, CVE-2026-106183, CVE-2026-106185, CVE-2026-106186, CVE-2026-106187, CVE-2026-106188, CVE-2026-106189, CVE-2026-106191, CVE-2026-106193, CVE-2026-106194, CVE-2026-106195, CVE-2026-106196, CVE-2026-106197, CVE-2026-106198, CVE-2026-106199, CVE-2026-106308, CVE-2026-106309, CVE-2026-106310, CVE-2026-106311, CVE-2026-106312, CVE-2026-106314, CVE-2026-106315, CVE-2026-106316, CVE-2026-106318, CVE-2026-106321, CVE-2026-106322, CVE-2026-106324, CVE-2026-106325, CVE-2026-106327, CVE-2026-106328, CVE-2026-106329, CVE-2026-106330, CVE-2026-106331, CVE-2026-106332, CVE-2026-106363, CVE-2026-106364, CVE-2026-106365, CVE-2026-106369, CVE-2026-106370, CVE-2026-106371, CVE-2026-106373, CVE-2026-106374, CVE-2026-106375, CVE-2026-106376, CVE-2026-106377, CVE-2026-106378, CVE-2026-106379, CVE-2026-106381, CVE-2026-106382, CVE-2026-106383, CVE-2026-106384, CVE-2026-106385, CVE-2026-110136, CVE-2026-110171, CVE-2026-110172, CVE-2026-112992, CVE-2026-112993, CVE-2026-112994, CVE-2026-112995, CVE-2026-112996, CVE-2026-112997, CVE-2026-112998, CVE-2026-112999, CVE-2026-113000, CVE-2026-113001, CVE-2026-113002, CVE-2026-113003, CVE-2026-113004, CVE-2026-113005, CVE-2026-113006, CVE-2026-113007, CVE-2026-113008, CVE-2026-113009, CVE-2026-113010, CVE-2026-113011
On 2026-10-20 Google promoted Chrome 156 to the stable channel for Windows, Mac and Linux, rolling out over coming days/weeks. Versions 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) contain 353 security fixes, including several critical memory corruption vulnerabilities in Skia, Accessibility, and CSS (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280), reported by Google and Xinyang Ge in early October 2026. Bug details and links are restricted until a majority of users are updated. No in-the-wild exploitation is mentioned. All users of Chrome on desktop platforms are affected until updated; the fix is delivered in the 156 stable release.
Fixed: 156.0.8078.47 (Linux); 156.0.8078.47/.48 (Windows/Mac)
Do: Update Chrome to 156.0.8078.47/.48 or later on all managed Windows, Mac and Linux endpoints as soon as the rollout reaches your channel; Force browser auto-update or push the update via enterprise policy (Update policies / MDM) and verify versions in your fleet; If you manage Chromium-based browsers (Edge, Brave, etc.), track their rebuilds of the same underlying fixes and patch accordingly; Restrict browsing of untrusted content via other controls until fleet updates complete

### [high] Node.js: October 2026 security releases fix DNS truncation, TLS hostname bypasses, Brotli RCE and HTTP keep-alive flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074)
https://helix.ml/threat-watch/i/node-js-october-2026-security-releases-fix-dns-truncation-tls-hostname-bypasses-brotli-rce-and-http-keep-alive-flaws-cve · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106070, CVE-2026-106071, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497, CVE-2026-48618, CVE-2026-48930, CVE-2026-48931
The Node.js Project released security updates for the 26.x, 24.x and 22.x lines on 2026-10-21 addressing seven vulnerabilities. High-severity issues include dns.resolve*() silently truncating hostnames at NUL bytes (bypassing allowlist validation), TLS hostname verification bypasses via fullwidth-digit IP spellings and non-canonical IPv4 literals like leading-zero octets, and a Brotli decoder out-of-bounds write in node:zlib that can enable remote code execution. Medium issues cover HTTP keep-alive socket response confusion, DNS SANs authenticating IP endpoints, and entropy caches for crypto.randomUUID()/randomInt() being baked into startup snapshots, causing repeated values across processes. Dependency updates include c-ares, OpenSSL, SQLite, Undici and ca-certificates. All users on affected lines should upgrade promptly.
Do: Upgrade Node.js deployments on 26.x, 24.x or 22.x to the October 2026 security releases immediately, prioritising internet-facing services using TLS hostname verification or node:zlib Brotli decompression; Rebuild any single executable applications or --build-snapshot artifacts created with useSnapshot so entropy caches are not baked in, and regenerate any UUIDs/randomInt values issued from snapshot-built processes; Audit applications that validate hostnames against allowlists then resolve via dns.resolve*() for NUL-byte truncation exposure; Rebuild container images and dependencies that bundle affected Node.js versions and redeploy

### [critical] Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48356)
https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-48356 · Vulnerabilities · unknown · since 2026-10-27 · CVE-2026-48356
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on Oct 27, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 10, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] pydicom: NaN/inf DICOM values let one upload crash MONAILabel and corrupt inference (CVE-2026-48705)
https://helix.ml/threat-watch/i/pydicom-ds-is-nan-inf-validation-bypass-monailabel-crash-silent-inference-corruption-cve-2026-48705 · Vulnerabilities · partial · since 2026-10-27 · CVE-2026-48705
A DICOM file with NaN or inf in its spacing or position fields passes pydicom's DS and IS checks, because pydicom accepts those values silently in its default validation mode. MONAI's PydicomReader then builds an affine matrix from them without finite-value checks. The result is that a single unauthenticated upload to MONAILabel's default REST datastore endpoint (about 132 KB) makes inference return HTTP 500 after roughly 16 seconds of wasted compute, and the file stays in the datastore so later requests keep failing. Where the writer does not crash, the output can be a geometrically wrong segmentation returned with HTTP 200. The advisory includes a proof of concept and reports 17 of 17 test vectors against MONAI 1.5.2 and pydicom 3.0.2. MONAI 1.6.1, uploaded to PyPI on 2026-09-27, fixes the MONAI side. pydicom 3.0.2 is still the latest PyPI release, so the pydicom side is unfixed. No known in-the-wild exploitation.
Fixed: monai 1.6.1 (PyPI upload 2026-09-27)
Do: Upgrade MONAI to 1.6.1 or later immediately; Restrict network access to MONAILabel port 8000 and enable authentication on the REST API; Purge/audit datastore entries for DICOM files with NaN/inf in PixelSpacing or ImagePositionPatient (they permanently crash inference); Add input validation on DICOM spatial metadata before ingestion if running custom pipelines; Monitor for HTTP 500 inference errors and unexpected datastore uploads; Track pydicom for a fix to DS/IS validation; consider RAISE validation mode as a mitigation

### [critical] better-auth: OAuth state accepted as a Magic Link token enables account takeover by email (CVE-2026-114607)
https://helix.ml/threat-watch/i/better-auth-oauth-state-usable-as-magic-link-token-to-take-over-any-account-by-email-address-cve-2026-114607 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-114607
In better-auth from 1.4.0-beta.18 up to 1.7.7, the value that an OAuth sign-in creates as its state can be used as a Magic Link token. An unauthenticated attacker who knows a victim's email address can start an OAuth sign-in for that address, reuse the state value to complete a Magic Link sign-in, and receive a full session for the account without ever reading that mailbox. The attacker can also create an account that is wrongly marked as email verified when the address is not yet registered and Magic Link sign-up is enabled. The bug needs three conditions: Magic Link enabled with the default plain token storage (or hashed tokens with hashed identifiers), at least one social or Generic OAuth provider, and database-backed OAuth state, which is the default. Fixed in 1.7.7. Upgrade every Better Auth adapter and plugin together, and move shared verification storage in the same cutover. Until then, the advisory's workarounds are cookie-backed OAuth state, hashed Magic Link tokens with plain identifiers, or turning off Magic Link or OAuth sign-in. No known in-the-wild exploitation.
Fixed: better-auth 1.7.7 (npm publish 2026-09-30)
Do: Upgrade better-auth and all Better Auth adapters, plugins, and integrations to 1.7.7 together; upgrade servers sharing verification storage in the same cutover; Until upgraded, set account.storeStateStrategy to "cookie" (with a dedicated OAuth Proxy secret if using OAuth Proxy), or set Magic Link storeToken to "hashed" with verification.storeIdentifier unset/plain, or disable Magic Link or OAuth sign-in; Request new Magic Links and restart pending OAuth/SAML sign-ins after upgrading; pre-upgrade links and state cannot complete; Update custom verification.storeIdentifier.overrides rules to match the magic-link: and auth-state: prefixes; Audit accounts for falsely verified emails and review permissions granted based on verified email addresses or domains

### [critical] Authlib: unsigned JWS JSON accepted as verified when the signatures array is empty (CVE-2026-96760)
https://helix.ml/threat-watch/i/authlib-jws-empty-signatures-bypass-authlib-deserialize-json-accepts-unsigned-payloads-as-verified-cve-2026-96760 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-96760
In Authlib before 1.9.0, JsonWebSignature.deserialize_json() reports success before it checks anything. An attacker can submit a JWS JSON object with an empty signatures array and get the payload back as verified, with no key used, even when the caller supplies the right key. Any service that trusts this call on attacker-supplied input will accept forged identity or authorisation claims, which makes it an unauthenticated authentication bypass. The advisory includes a reproduction on Authlib 1.8.0 and notes that joserfc rejects the same input. Fixed in Authlib 1.9.0 (PyPI upload 2026-10-14), which rejects empty signatures arrays. The advisory reports no in-the-wild exploitation.
Fixed: authlib 1.9.0 (PyPI upload 2026-10-14)
Do: Upgrade authlib to 1.9.0 or later immediately; Audit code for use of JsonWebSignature.deserialize_json() on untrusted input and treat any such path as bypassable until patched; If upgrade is delayed, reject JWS JSON objects with empty or missing signatures arrays before passing to authlib, or switch to joserfc; Review logs for tokens/requests with empty signatures arrays that may have been accepted; Rotate or re-evaluate trust in any authorisation decisions made via JWS JSON verification on affected versions

### [critical] Agno: eval() on FunctionCall field_type runs arbitrary Python code (CVE-2026-35002)
https://helix.ml/threat-watch/i/agno-eval-code-injection-in-functioncall-field-type-arbitrary-python-code-execution-cve-2026-35002 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-35002
Agno, the Python agent framework, passed the field_type value of a FunctionCall input field to Python's eval(). Anyone who can influence that value, through an API, a web UI, or untrusted tool or model output, can run arbitrary Python inside the Agno process. Every deployment that feeds user-influenced FunctionCall inputs into Agno is exposed. The fix in Agno 2.3.24 replaces eval() with a fixed dictionary lookup and checks field_type against known keys or resolved type objects. There is no safe workaround besides keeping untrusted input away from that field. 2.3.24 was uploaded to PyPI on 2026-01-08, months before the advisory. NVD published the CVE on 2026-04-02 and the GHSA on 2026-10-27. EPSS is 0.842 percent as of 2026-10-27. No in-the-wild exploitation is reported.
Fixed: agno 2.3.24 (PyPI upload 2026-01-08)
Do: Upgrade agno to 2.3.24 or later. The PyPI latest release (3.1.10 at check time) includes the fix; the advisory's 2.6.x reference is out of date.; If upgrade is delayed, ensure no untrusted input can reach the field_type parameter of FunctionCall input fields; Audit deployments that expose Agno via APIs, web UIs, or untrusted tool/model output for exposure; Review logs for signs of exploitation of FunctionCall field_type values

### [critical] PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)
https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619 · Vulnerabilities · partial · since 2026-10-17 · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
On 2026-10-21 the PHP Foundation released emergency updates for two critical RCE vulnerabilities, CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), collectively tracked as PHP2Shell (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Attacks against the flaws are ongoing; Wordfence, which protects over 5 million WordPress sites, reports no confirmed compromises yet, suggesting complex exploitation. Cisco issued a Critical advisory listing affected products (e.g., Ultra-Reliable Wireless Backhaul, Expressway, Duo Access Gateway) with fixes pending or scheduled (e.g., URWB 27.1.1 in Feb 2027, Expressway 15.5.21), workarounds in bug trackers, and many products confirmed not vulnerable. Community backported patches exist for EOL PHP 5.4-5.6. All organisations running PHP should patch immediately.
Fixed: PHP security release of 2026-10-21 (per PHP Foundation); Cisco URWB 27.1.1 (Feb 2027); Expressway 15.5.21 (TBD); Duo Access Gateway 3.2.0
Do: Update PHP to the patched releases published by the PHP Foundation on 2026-10-21; if patching is delayed, apply mitigations/workarounds and restrict exposure of PHP-facing services; Check vendor advisories for embedded PHP (Cisco bug IDs CSCwx37073, CSCwx37062; Splunk advisory) and schedule the vendor fixed releases; If running EOL PHP 5.4-5.6, apply the community backported patch or migrate to a supported PHP version; Monitor logs for exploitation attempts and confirm no signs of compromise; continue monitoring as attack activity is ongoing

### [critical] HPE ArubaOS: 72 vulnerabilities patched, including eight max-severity unauthenticated RCE and auth bypass flaws (CVE-2026-79844 through CVE-2026-79851)
https://helix.ml/threat-watch/i/hpe-arubaos-72-vulnerabilities-patched-including-eight-max-severity-unauthenticated-rce-and-auth-bypass-flaws-cve-2026-7 · Vulnerabilities · patched · since 2026-10-23 · CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851
HPE released security updates on 2026-10-23 fixing 72 vulnerabilities in ArubaOS, the OS powering Aruba enterprise wireless infrastructure (controllers, gateways, access points, mobility conductors). Eight are maximum-severity, remotely exploitable without privileges via low-complexity attacks requiring no user interaction: authentication bypasses leading to RCE (CVE-2026-79844, CVE-2026-79850), PAPI protocol auth bypass (CVE-2026-79845), unauthenticated command injection (CVE-2026-79846), buffer overflows leading to RCE (CVE-2026-79847, CVE-2026-79851), and SQL injections leading to RCE (CVE-2026-79848, CVE-2026-79849). Multiple AOS-8 and AOS-10 versions are affected. HPE says no public exploit code or in-the-wild exploitation is known. Patches are available; HPE urges immediate patching and restricting management interfaces.
Do: Patch affected AOS-8 and AOS-10 devices immediately, prioritising the eight maximum-severity CVEs; Until patched, restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and enforce layer 3+ firewall policies; Enable accounting controls for logging and tracking user activity on management interfaces; Check for signs of compromise on internet-exposed or previously unmanaged Aruba devices; Review HPE's advisory for full affected-version lists and any additional mitigations

### [high] ChromeOS / ChromeOS Flex: Stable channel update fixes critical and high kernel/browser vulnerabilities (CVE-2026-106200)
https://helix.ml/threat-watch/i/chromeos-chromeos-flex-stable-channel-update-fixes-critical-and-high-kernel-browser-vulnerabilities-cve-2026-106200 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-102304, CVE-2026-102306, CVE-2026-102308, CVE-2026-102316, CVE-2026-102319, CVE-2026-102324, CVE-2026-103622, CVE-2026-103623, CVE-2026-103629, CVE-2026-106181, CVE-2026-106184, CVE-2026-106190, CVE-2026-106200, CVE-2026-106201, CVE-2026-106202, CVE-2026-106203, CVE-2026-106204, CVE-2026-106205, CVE-2026-106207, CVE-2026-106208, CVE-2026-106210, CVE-2026-106211, CVE-2026-106212, CVE-2026-106213, CVE-2026-106214, CVE-2026-106215, CVE-2026-106216, CVE-2026-106217, CVE-2026-106220, CVE-2026-106222, CVE-2026-106224, CVE-2026-106225, CVE-2026-106226, CVE-2026-106227, CVE-2026-106228, CVE-2026-106229, CVE-2026-106230, CVE-2026-106231, CVE-2026-106232, CVE-2026-106233, CVE-2026-106234, CVE-2026-106235, CVE-2026-106236, CVE-2026-106237, CVE-2026-106238, CVE-2026-106239, CVE-2026-106240, CVE-2026-106241, CVE-2026-106242, CVE-2026-106243, CVE-2026-106244, CVE-2026-106245, CVE-2026-106246, CVE-2026-106247, CVE-2026-106248, CVE-2026-106249, CVE-2026-106250, CVE-2026-106251, CVE-2026-106252, CVE-2026-106255, CVE-2026-106257, CVE-2026-106258, CVE-2026-106263, CVE-2026-106264, CVE-2026-106265, CVE-2026-106266, CVE-2026-106267, CVE-2026-106268, CVE-2026-106269, CVE-2026-106270, CVE-2026-106271, CVE-2026-106273, CVE-2026-106274, CVE-2026-106275, CVE-2026-106277, CVE-2026-106318, CVE-2026-106329, CVE-2026-106347, CVE-2026-106358, CVE-2026-106383, CVE-2026-106421, CVE-2026-106423, CVE-2026-110136, CVE-2026-110137, CVE-2026-110138, CVE-2026-110141, CVE-2026-110142, CVE-2026-110147, CVE-2026-110148, CVE-2026-110151, CVE-2026-110154, CVE-2026-110157, CVE-2026-110161, CVE-2026-110162, CVE-2026-110163, CVE-2026-110166, CVE-2026-110170, CVE-2026-110171, CVE-2026-110172, CVE-2026-110913
Google rolled out ChromeOS 16836.19.0 (browser 156.0.8078.42) to the Stable channel on 2026-10-20/21, fixing multiple vulnerabilities. These include a critical CVE (ID truncated in source), a high use-after-free in Track (CVE-2026-106200), a high arc-keymaster fall-off-end UB allowing guest-to-host wild indirect calls, a high mali_kbase double-free of dma_buf_attachment enabling kernel memory corruption, and a high mali page-migration UAF (kbase_vmap_phy_pages) allowing unprivileged kernel memory corruption on mt8196, plus a medium fix for compromised 3rd-party CA certificates affecting TLS. Android and Chrome browser security fixes are also included. No in-the-wild exploitation is reported. All ChromeOS and ChromeOS Flex devices on Stable should receive the update automatically.
Fixed: ChromeOS 16836.19.0 (browser 156.0.8078.42)
Do: Ensure managed ChromeOS/ChromeOS Flex devices have updated to version 16836.19.0 (browser 156.0.8078.42) or later; Verify fleet update status via the Google Admin console and force reboots where updates are pending; Review whether any devices use affected MediaTek mt8196 hardware and prioritize them; Confirm TLS trust chains are unaffected by the compromised 3rd-party CA certificate issue; Monitor Chrome Releases for follow-up stable or extended stable updates

### [critical] Wasmtime: two critical Cranelift sandbox-escape flaws let malicious Wasm modules break out (CVE-2026-115889, CVE-2026-115893)
https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889 · Vulnerabilities · patched · since 2026-10-19 · CVE-2026-115889, CVE-2026-115893
Wasmtime maintainers disclosed two critical Cranelift sandbox-escape flaws, both CVSS 9.9, fixed October 19-20, 2026. CVE-2026-115889 (all architectures): Cranelift packed SSA value indices into 24-bit fields that silently overflow in release builds, causing miscompilation and type confusion exploitable via a large or crafted Wasm function; fixed in 36.0.19 and 43.0.0. CVE-2026-115893 (ARM64 only): out-of-range br_table indexes used a branch with ~1 MiB reach, so jump tables with >~256,000 targets pointed to the wrong location, allowing arbitrary code jumps; present since 2020 ARM64 support; fixed in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Only the 36, 48, 49 and 50 release lines are supported; 24.x LTS and other lines got no fix. Because Wasmtime is embedded as a library, each dependent program must be rebuilt. No public exploitation reported; tracked as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.
Fixed: 36.0.19; 43.0.0 (CVE-2026-115889 only); 48.0.7; 49.0.4; 50.0.0
Do: Upgrade Wasmtime to a fixed release for your line immediately if you run untrusted Wasm modules: 36.0.19, 48.0.7, 49.0.4, or 50.0.0; unsupported lines (incl. 24.x LTS) must migrate to one of these; Rebuild every application or service that embeds Wasmtime as a library (e.g. Fastly Compute-style platforms, Spin serverless apps) against a fixed version — updating the CLI alone is insufficient; ARM64/aarch64 hosts: ensure both flaws are covered — 36.0.19 or 50.0.0; note 43.0.0-47.x and 48.0.0-48.0.6 remain affected by CVE-2026-115893; If upgrading is not immediately possible, restrict or sandbox which Wasm modules are executed and avoid compiling untrusted module bodies; no workarounds are listed in the advisories; Audit Cargo.lock files with cargo-audit (RUSTSEC-2026-0380, RUSTSEC-2026-0379); note Dependabot may not alert for CVE-2026-115893 as GitHub lacks a reviewed advisory entry; Monitor for suspicious Wasm module workloads or crashes that could indicate exploitation attempts

### [critical] Fortinet: critical/high fixes in FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator (Nov 10)
https://helix.ml/threat-watch/i/fortios-fortimanager-fortianalyzer-fortimail-fortiauthenticator-critical-high-severity-flaws-found-with-ai-assistance-de · Vulnerabilities · patched · since 2026-10-26
On 2026-10-21 Fortinet's CISO Collective post said its upcoming security hardening releases would include critical and high-severity fixes. The updates shipped on 2026-10-22 for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, and the fixed builds are listed in fixedVersions. Canadian Centre for Cyber Security advisory AV26-1081 (dated 2026-10-23; affected status as of 2026-10-21) gives the same branch thresholds. Fortinet has published no CVE, FG-IR or CVSS identifiers for these fixes; its PSIRT page says the public advisories will appear at the next Patch Tuesday, 2026-11-10. Help Net Security (2026-10-26) reports the flaws were uncovered with the help of AI models and validated by humans: Fortinet first tested products without source code and then ran source-code testing, which produced most findings. Of more than 100 tests across 30 product families, about 40% were real vulnerabilities, 30% false positives and 30% hardening improvements that are not exploitable flaws. Fortinet says some may be remotely exploitable without authentication and warns that AI can chain lower-severity flaws into an exploitable one. Fortinet and the national CERTs checked report no exploitation of these fixes as of 2026-10-23, and CISA KEV has no entry. This release does not address PHP2Shell, which Fortinet says does not affect these products. Upgrade internet-facing devices first, restrict admin access to trusted addresses, keep FortiManager off the internet, and enforce MFA on admin accounts until the builds are in place.
Fixed: FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14 (or above); FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13 (or above); FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13 (or above); FortiMail 8.0.2, 7.6.7, 7.4.9 (or above); 7.2 users move to 7.4 or later; FortiAuthenticator 8.0.4, 6.6.11 (or above)
Do: Upgrade internet-facing FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator devices to the fixed builds in fixedVersions first; Upgrade the remaining deployments before the 2026-11-10 public advisories; Restrict admin access to trusted IP addresses, keep FortiManager off the internet, use unique strong admin credentials, and enforce MFA for admin accounts until patched; Watch for exploitation after the 2026-11-10 advisories are published; the researchers say attackers will not wait for that date

### [critical] Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)
https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625 · Vulnerabilities · patched · since 2026-10-23 · CVE-2026-114625
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on Oct 23, 2026, which means attackers are exploiting it in the wild.
Fixed: VCO On-Prem 5.2.3.18; VCO On-Prem 6.1.3.10; VCO On-Prem 6.4.2.12
Do: Upgrade VeloCloud Orchestrator On-Prem to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later (hosted VCO was already patched by Arista); Block and review access from the IPs observed in ongoing exploitation: 74.82.197.86 and 38.54.50.151; Until patched, restrict the VCO web interface to administrative networks and monitor for attempts to reach internal or local services; Review VCO web access logs for URL-like path components, encoded characters and unusual request rates, and review recent administrator activity for privilege changes; If compromise is suspected, preserve VCO web, backend, system and database logs plus file-system timestamps before remediating

### [critical] Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)
https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447 · Vulnerabilities · unknown · since 2026-10-23 · CVE-2026-110447
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on Oct 23, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 26, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)
https://helix.ml/threat-watch/i/linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999 · Vulnerabilities · patched · since 2026-10-16 · CVE-2026-99999
PwnEscape (CVE-2026-99999) is a Linux host kernel flaw, despite the name: the bug is in the IPv4 stack, not KVM. A guest can hand the host virtio-net checksum metadata that points inside the IPv4 header; the host writes the completed checksum there, corrupting a header it has already validated and acted on. A guest that controls its own packets can therefore leak host kernel memory back to itself repeatedly, crash the host and every VM on it, and, as the researcher demonstrated in his own lab, get root code execution on the host. The vulnerable code dates to virtio header support in 2008, so every kernel shipped since is affected. Paulos Yibelo of PWNAI Research found it in Vercel's sandbox security challenge and reported it privately on 4 September; Michael Tsirkin's fix landed upstream on 14 October. Red Hat notes a local attacker can trigger it too, so the fix matters well beyond virtualization hosts. Patched kernels are in distribution repositories now.
Fixed: Upstream kernel commit 6785011f8b16 ('ipv4: validate checksum_start before completing checksum'); AlmaLinux 8 kernel-4.18.0-553.177.1.el8_10; AlmaLinux 9 kernel-5.14.0-687.59.1.el9_8; AlmaLinux 10 kernel-6.12.0-211.67.1.el10_2
Do: Update the kernel everywhere, not just on hypervisors: a local attacker can trigger this too (Red Hat's assessment); On AlmaLinux 8/9/10 install kernel-4.18.0-553.177.1.el8_10, kernel-5.14.0-687.59.1.el9_8 or kernel-6.12.0-211.67.1.el10_2 (or newer) and reboot, confirming with uname -r; Take the fix from your own distribution (RHEL 9/10, Debian, Ubuntu, Proxmox and other KVM-based products) and verify it is the upstream 6785011f8b16 fix, not an earlier kernel; On virtualization hosts, migrate or shut down guests before rebooting so the patch does not become an outage; Until patched, treat guests you do not fully trust as able to read host memory: there is no published workaround, so isolate them on hosts you are willing to lose

### [high] Echo (labstack/echo): three denial-of-service vulnerabilities in BodyDump, Decompress and WebSocket proxy middleware fixed in v4.16.1 / v5.4.1
https://helix.ml/threat-watch/i/echo-labstack-echo-three-denial-of-service-vulnerabilities-in-bodydump-decompress-and-websocket-proxy-middleware-fixed-i · Vulnerabilities · patched · since 2026-10-23
Three coordinated advisories against the popular Go Echo framework (17K dependent repos) were published 2026-10-23, all fixed in v4.16.1 (and v5.4.1 for the proxy issue). BodyDump middleware captured request and response bodies without size limits, allowing memory exhaustion DoS (GHSA-f48p-c9v4-h7xv). Decompress middleware allowed unbounded gzip expansion, letting a small compressed request consume excessive memory/CPU (GHSA-h7wr-284f-5qvc). The Proxy middleware could retain handlers, goroutines and connections after WebSocket client disconnect, accumulating resources (GHSA-9969-6676-49h5, regression in v4.15.0+). All are opt-in middleware, not enabled by default, and no in-the-wild exploitation is known. Fixes add configurable capture/decompression limits (5 MiB default for BodyDump, 100 MiB for Decompress) and proper connection teardown.
Fixed: github.com/labstack/echo/v4 4.16.1; github.com/labstack/echo/v5 5.4.1
Do: Upgrade github.com/labstack/echo/v4 to 4.16.1 (and echo/v5 to 5.4.1 if used); Audit which routes use BodyDump, Decompress and WebSocket proxy middleware and prioritize exposed ones; If upgrading is delayed, disable BodyDump on exposed routes, place BodyLimit after Decompress, or disable WebSocket proxy routes; Configure MaxRequestBytes/MaxResponseBytes and MaxDecompressedSize appropriately rather than relying on defaults; Apply request deadlines and concurrency limits as defense in depth

### [high] Time4Popcorn (Popcorn Time fork): abandoned updater allowed RCE via hijacked update domain (CVE-2026-30612)
https://helix.ml/threat-watch/i/time4popcorn-popcorn-time-fork-abandoned-updater-allowed-rce-via-hijacked-update-domain-cve-2026-30612 · Vulnerabilities · partial · since 2026-10-23 · CVE-2026-30612
Eye Security registered the abandoned popcorntimeupd.xyz domain used by the Time4Popcorn Popcorn Time fork, whose Windows and macOS updaters fetched executables over unencrypted HTTP without signature verification (CVE-2026-30612). Whoever controlled the domain could push updates executing code as SYSTEM on Windows or root on macOS; Eye observed up to 3 million Windows and 350,000 macOS clients, including corporate, government, and military networks, though users appeared inactive. Between November 2025 and March 2026 Eye used the mechanism to deliver a payload disabling the updater, cutting requests 98% by March 1, then transferred domains to the Shadowserver Foundation. No malicious exploitation is reported. Residual risk remains: Android users cannot be remediated remotely, and the app embeds an unsandboxed 2014-era Chrome engine; full removal is recommended.
Do: Search endpoints for the Time4Popcorn app and popcorntimeupd.xyz traffic; uninstall the app entirely, including on Android devices; Check EDR/AV logs for any update or execution activity tied to popcorntimeupd.xyz or the Time4Popcorn updater; If the app was ever run with elevated privileges, review affected hosts for signs of compromise; Block the popcorntimeupd.xyz domain and related infrastructure at the perimeter

### [critical] Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)
https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20 · Vulnerabilities · patched · since 2026-10-16 · CVE-2026-112393, CVE-2026-112398, CVE-2026-112403, CVE-2026-112900
Pillow, the most widely used Python image library (~436M downloads/month), fixed a batch of vulnerabilities in version 13.0.0 released 2026-10-16. The headline flaw, CVE-2026-112900, lets an attacker run OS commands by controlling the filename of an EPS image, which Pillow passes unvalidated to Ghostscript; it affects versions 2.6.0–12.3.0 and only hosts with the gs binary installed. Two maintainer-critical fixes cover a stale-image-data memory bug and JPEG decoding overflows, including an FPX flaw enabling RCE from a single Image.open() call when olefile is installed, and CVE-2026-112403, a lossless-JPEG thumbnail buffer overflow. CVE-2026-112393, present since 2013, overflows a buffer when saving compressed TIFFs to in-memory buffers. No exploitation is known; a public PoC exists for the TIFF flaw. One JPEG flaw was found by Anthropic using Claude and validated by Ada Logics.
Fixed: 13.0.0
Do: Upgrade to Pillow 13.0.0 and rebuild containers, wheels, and base images bundling older copies; note Python 3.10 is dropped, so ensure Python 3.11+; Until upgraded, keep the Ghostscript gs binary off hosts processing untrusted uploads and never pass attacker-controlled filenames to Image.open() for EPS; Avoid draft()/thumbnail() on untrusted JPEGs, or call load() first or pass reducing_gap=None; Treat saving user-supplied TIFF images to in-memory buffers (e.g. io.BytesIO) as a sensitive path

### [high] APT41 BlackX UEFI bootkit bypasses Secure Boot via unrevoked Baton Drop certificate (CVE-2022-21894)
https://helix.ml/threat-watch/i/apt41-blackx-uefi-bootkit-bypasses-secure-boot-via-unrevoked-baton-drop-certificate-cve-2022-21894 · Vulnerabilities · partial · since 2026-10-23 · CVE-2022-21894
Kaspersky reports a new UEFI bootkit, BlackX, used in an early-2026 espionage campaign against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan, attributed with medium confidence to China-linked APT41. BlackX is a copycat of BlackLotus, exploiting the Baton Drop flaw (CVE-2022-21894) on fully patched Windows systems where admins never manually applied Secure Boot DBX revocations of the 'Windows Production PCA 2011' certificate (which expired 2026-10-19 but still loads vulnerable binaries unless blocklisted). The bootkit enrolls Machine Owner Keys, injects a kernel driver signed with a now-revoked certificate to tamper with security software and ETW, and drops a cloud-C2 RAT plus OxiDLLRunner (Rust payload via googleupdate.exe sideloading, C2 archivetj[.]com). Full remediation requires manual Secure Boot revocation steps beyond installing updates.
Do: Manually apply Microsoft's Secure Boot revocation mitigations: add 'Windows Production PCA 2011' to the UEFI Forbidden Signature Database (DBX), following Microsoft's CVE-2022-21894 guidance; Verify DBX revocations are actually present on endpoints, since patch installation alone does not enforce them; Hunt for indicators: inst.exe under C:\ProgramData\Intel\, PVMDIJGKAX2 encrypted payload file, OxiDLLRunner, googleupdate.exe sideloading, and traffic to archivetj[.]com; Restrict and monitor administrator privileges and physical access, prerequisites for bootkit deployment; Monitor for tampering with security processes, registry callbacks, and ETW providers; ensure EDR tamper protection is enabled

### [critical] Linux KSMBD: Two CVSS 9.0 pre-auth/transport RCE flaws disclosed publicly before kernel fixes available
https://helix.ml/threat-watch/i/linux-ksmbd-two-cvss-9-0-pre-auth-transport-rce-flaws-disclosed-publicly-before-kernel-fixes-available · Vulnerabilities · unpatched · since 2026-10-22
Trend Micro's Zero Day Initiative publicly disclosed two CVSS 9.0 remote code execution flaws in the Linux kernel's KSMBD SMB server before fixes exist in the mainline kernel. ZDI-CAN-33774 is a protocol-dispatch race exploitable without authentication by any client reaching port 445, with a buffer-write path available to share users. ZDI-CAN-33549 is an integer underflow in the SMB Direct path requiring an RDMA-capable interface, a writable share, and SMB Direct negotiation. Neither flaw has a CVE or confirmed mainline fix; a fix for ZDI-CAN-33549 may land in the next dev cycle. Any Linux server running KSMBD is affected; RHEL does not ship it by default. No in-the-wild exploitation is known. Fixes will take weeks to reach stable and distribution kernels.
Do: Check whether KSMBD is actually in use: 'systemctl status ksmbd' or 'lsmod | grep ksmbd'; Red Hat Enterprise Linux does not ship it by default; If ksmbd is not needed, disable the service and unload the module — that removes both flaws entirely; If you must keep ksmbd, firewall port 445 to known client networks and block SMB Direct/RDMA where it is not deliberate; Make shares read-only where possible: ZDI-CAN-33774 needs share access for its write primitive, and ZDI-CAN-33549 requires a writable share; Watch kernel stable and distribution errata; CVE identifiers will be assigned only when a stable fix exists, so searching for a CVE will miss it for now; Consider Samba for exposed file sharing until kernel fixes reach your distribution

### [medium] Azure AI Foundry: SSRF allows authorized attacker to elevate privileges over a network (CVE-2026-108456)
https://helix.ml/threat-watch/i/azure-ai-foundry-ssrf-allows-authorized-attacker-to-elevate-privileges-over-a-network-cve-2026-108456 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-108456
Microsoft's October 2026 security guidance (published 2026-10-22) discloses CVE-2026-108456, a server-side request forgery vulnerability in Azure AI Foundry. An attacker who is already authorized to interact with the service can abuse the SSRF to elevate privileges over a network, potentially gaining access beyond their intended permissions. No exploitation in the wild or public proof-of-concept is reported. Microsoft has released a security update via the MSRC Update Guide; customers using Azure AI Foundry should apply the update and review service permissions and network access controls.
Do: Apply the Microsoft security update for Azure AI Foundry via the MSRC Update Guide; Review and restrict authorized user roles and permissions on Azure AI Foundry instances; Audit network egress/access controls around AI Foundry resources for signs of SSRF abuse; Monitor Azure activity logs for anomalous privilege changes

### [high] Microsoft Exchange Online: stack-based buffer overflow allows authorized attackers to execute remote code (CVE-2026-96185)
https://helix.ml/threat-watch/i/microsoft-exchange-online-stack-based-buffer-overflow-allows-authorized-attackers-to-execute-remote-code-cve-2026-96185 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-96185
Microsoft disclosed CVE-2026-96185, a stack-based buffer overflow in Microsoft Exchange Online that permits an authorized attacker to execute arbitrary code over a network. Because Exchange Online is a cloud service, Microsoft has remediated the flaw on its side; no customer-side patch is required. The vulnerability requires the attacker to already hold authorized access, which limits exposure compared with unauthenticated RCE, but successful exploitation could yield code execution within the service context. No exploitation in the wild or public proof-of-concept has been reported. Organizations using Exchange Online should review their tenant for signs of compromise and ensure they are on current service builds.
Do: Review Microsoft 365 audit and sign-in logs for anomalous activity by authorized accounts, especially privileged or service accounts; Verify your tenant is on the current Exchange Online service build and confirm Microsoft's advisory status; Tighten authorization controls: enforce MFA, least privilege, and conditional access for accounts with Exchange Online access; Monitor Microsoft MSRC and Message Center for updates on exploitation status or further guidance

### [critical] Microsoft: VM Inspector for Azure Virtual Machines elevation of privilege via link following (CVE-2026-110063)
https://helix.ml/threat-watch/i/microsoft-vm-inspector-for-azure-virtual-machines-elevation-of-privilege-via-link-following-cve-2026-110063 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-110063
Microsoft published an advisory on 2026-10-22 for CVE-2026-110063, an improper link resolution before file access ('link following') flaw in VM Inspector for Azure Virtual Machines. The vulnerability allows an unauthorized attacker to elevate privileges over a network, meaning an attacker with network access to a VM using the VM Inspector component could gain higher privileges. Azure Virtual Machines customers using VM Inspector are affected. Microsoft's Security Update Guide lists the issue as remediated via a security update; no in-the-wild exploitation is reported in the source. Organizations running affected Azure VMs should apply the update promptly and review VM access controls.
Do: Apply Microsoft's October 2026 security update for VM Inspector on affected Azure virtual machines; Audit which VMs have VM Inspector enabled and prioritise internet-exposed and multi-tenant hosts; Review Azure RBAC assignments and VM network rules for privilege changes you cannot account for; Track the MSRC entry for this CVE for an exploitation-status update before treating the estate as remediated

### [critical] Azure Kubernetes Configuration Service: missing authentication allows unauthorized attackers to elevate privileges over a network (CVE-2026-83938)
https://helix.ml/threat-watch/i/azure-kubernetes-configuration-service-missing-authentication-allows-unauthorized-attackers-to-elevate-privileges-over-a · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-83938
Microsoft published CVE-2026-83938 on 22 October 2026, a missing-authentication flaw in the Azure Kubernetes Configuration Service that let an unauthenticated attacker elevate privileges over the network. It affects tenants using AKS configuration features, where a rider on the service can reach things it should not. Microsoft reports no exploitation and no public disclosure, and the fix is applied to the Azure service rather than to a component you upgrade, so the work is verification: confirm the update reached your tenants and look for signs that someone used the gap.
Do: Confirm the October 2026 fix has reached your tenants via Azure Service Health rather than a patch calendar; Review Azure Kubernetes Configuration Service access and audit logs for unauthorised privilege elevation; Audit AKS cluster role bindings and node pool configuration for changes you cannot account for; Restrict network exposure of AKS management and configuration endpoints to known administration ranges

### [critical] Microsoft Entra Application Proxy: elevation of privilege via improper authentication (CVE-2026-97785)
https://helix.ml/threat-watch/i/microsoft-entra-application-proxy-elevation-of-privilege-via-improper-authentication-cve-2026-97785 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-97785
Microsoft disclosed CVE-2026-97785, an improper-authentication flaw in Microsoft Entra Application Proxy, on 22 October 2026. An unauthenticated attacker could elevate privileges over the network against tenants that publish internal applications through Application Proxy, which is the common way to expose on-premises apps to remote users. Microsoft reports no exploitation and no public disclosure. The fix lands on the connector and service side rather than as a version you install in your own stack, so the practical work is confirming your connectors are current and reviewing what the proxy exposes.
Do: Confirm every Application Proxy connector group runs a current build (connectors auto-update by default; check any group where that was disabled); Review which applications are published through Application Proxy and remove any that no longer need external exposure; Read connector and sign-in logs for anomalous or unauthenticated access patterns against published apps; Keep the proxy on the shortest path to the identity controls you rely on: conditional access, MFA and least-privilege app roles

### [high] Azure Pipelines: command injection allows unauthorized remote code execution (CVE-2026-105014)
https://helix.ml/threat-watch/i/azure-pipelines-command-injection-allows-unauthorized-remote-code-execution-cve-2026-105014 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-105014
Microsoft disclosed CVE-2026-105014 on 22 October 2026: a command-injection flaw in Azure Pipelines that lets an unauthenticated attacker run code over the network, rated 9.1 with the full confidentiality and integrity impact of a build-system compromise. Microsoft reports no exploitation and no public disclosure, and fixes the service on its own side, so there is no version to pin or patch yourself. The consequence for defenders is downstream: a compromised pipeline can execute in your build agents, read your source, and use the service connections those pipelines hold. Treat any unexplained pipeline run, changed variable group or new service connection as worth investigating.
Do: No version to pin: Microsoft fixed this in the service. Confirm your tenant has received the October 2026 update through Azure Service Health rather than a patch calendar; Review Azure Pipelines run history and audit logs for runs, agent jobs or service-connection uses nobody authorised; Rotate pipeline service connections, PATs and deployment credentials if you find unexplained runs, then re-scope them to least privilege; Reduce the blast radius: keep production service connections behind approvals and separate from pipelines that build untrusted pull requests

### [high] Twisted: Three unauthenticated remote memory-exhaustion DoS vulnerabilities in words IRC, XMPP XML stream, and conch telnet parsers (CVE-2026-115776, CVE-2026-115775)
https://helix.ml/threat-watch/i/twisted-three-unauthenticated-remote-memory-exhaustion-dos-vulnerabilities-in-words-irc-xmpp-xml-stream-and-conch-telnet · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115775, CVE-2026-115776, CVE-2026-115778
On 2026-10-22/23 Twisted published three reviewed GitHub advisories for unauthenticated remote denial-of-service flaws fixed in 26.10.0rc1, all affecting versions <= 26.4.0. (1) CVE-2026-115776: the words IRC server's dataReceived buffers line-feed-free input with no length cap; 60 MB sent grew a test server from ~47 MB to ~2966 MB RSS, crashing the single-threaded process and dropping all users. (2) CVE-2026-115775: the xish domish XML element stream (used by XMPP servers) materialises an unbounded element tree when a peer never closes a container, parsed before authentication. (3) A third advisory covers the conch telnet transport, where an unclosed IAC SB subnegotiation grows a per-connection buffer without limit. All are CWE-770/CWE-400 allocation-without-limits issues requiring no credentials; no confidentiality, integrity, or code-execution impact. Fixes are in Twisted 26.10.0rc1.
Fixed: Twisted 26.10.0rc1
Do: Upgrade Twisted to 26.10.0rc1 or later wherever it is installed, prioritising hosts running twistd words (IRC/XMPP) or conch telnet services exposed to untrusted networks; If upgrading is not immediately possible, restrict network access to Twisted IRC/XMPP/telnet endpoints (firewall, VPN, or reverse proxy limits) and add connection/memory limits or rate limiting at the perimeter; Monitor Twisted-based services for abnormal memory growth and set process memory limits (e.g. ulimit, container limits) so a single connection cannot exhaust the host; Inventory dependent applications (8500+ dependent repos) for bundled or vendored Twisted and schedule their updates

### [high] gitoxide gix: untrusted .git/config can disable .git path-protection checks, enabling hook/config overwrite (GHSA-q54r-jf2p-rfr2)
https://helix.ml/threat-watch/i/gitoxide-gix-untrusted-git-config-can-disable-git-path-protection-checks-enabling-hook-config-overwrite-ghsa-q54r-jf2p-r · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-40034
The gix crate's Cache::protect_options() read core.protectHFS, core.protectNTFS and gitoxide.core.protectWindows with an unfiltered config accessor instead of the trust-aware boolean_filter() used elsewhere, so settings from an untrusted repository-local .git/config (Trust::Reduced, e.g. ownership mismatch on shared filesystems) were honored. An attacker controlling a repo's .git/config on a shared or CI filesystem can disable these protections; crafted tree entries (NTFS short names, alternate data streams, HFS+ ignorable code points) then resolve to .git on case-insensitive filesystems during checkout, index build, merge or tree edit, allowing overwrite of hooks/config and plausibly arbitrary command execution via hook execution. Affects gix 0.88.0–0.89.0; fixed in gix 0.90.0. No in-the-wild exploitation known; a PoC test is public.
Fixed: gix 0.90.0
Do: Upgrade gix to 0.90.0 or later and rebuild any tools or binaries that depend on the affected versions; Audit dependencies and lockfiles for gix 0.88.0–0.89.0 across Rust projects and CI images; Avoid opening untrusted repositories with gix-based tools on shared, network-mounted, or reused CI workspaces until patched; Treat checkouts from other users on multi-user hosts as untrusted; verify .git/hooks and .git/config integrity after opening shared repos

### [high] multer: DoS process crash via pending async fileFilter after request teardown (CVE-2026-113872)
https://helix.ml/threat-watch/i/multer-dos-process-crash-via-pending-async-filefilter-after-request-teardown-cve-2026-113872 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-113872
A high-severity denial-of-service vulnerability (CVE-2026-113872, GHSA-q7qp-rjg7-q26m) in multer 2.0.0–2.4.x lets a single unauthenticated request crash the Node.js process. When an asynchronous fileFilter is configured, aborting a request (e.g. one file rejected) while another file's async fileFilter is pending causes the callback to resume a parsing stream multer has already torn down; busboy then emits an error on a stream with no error listener, triggering an unhandled 'error' event and process exit. Any app using multer with an async fileFilter is affected regardless of storage engine; sync fileFilter usage is unaffected. Fixed in multer 2.5.0 (released Oct 22, 2026); workaround is using a synchronous fileFilter. No in-the-wild exploitation reported.
Fixed: multer 2.5.0
Do: Upgrade multer to 2.5.0 or later and redeploy; If upgrading is not immediately possible, switch to a synchronous fileFilter or remove async fileFilter usage; Add process-level monitoring/restarts (e.g. PM2, Kubernetes liveness probes) to limit DoS impact; Review upload endpoints for exposure to unauthenticated multipart requests

### [high] virtualenv: bash activator stores unescaped --prompt in PS1, enabling command execution on later prompt expansion (CVE-2026-115586)
https://helix.ml/threat-watch/i/virtualenv-bash-activator-stores-unescaped-prompt-in-ps1-enabling-command-execution-on-later-prompt-expansion-cve-2026-1 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115586
A regression in virtualenv 21.14.9 (introduced by the fix for GHSA-6w3r-xr62-4xcp) removed unconditional escaping of $ and backticks from the bash bin/activate script. When promptvars is off at activation time, the caller-supplied --prompt value is stored raw in PS1; since promptvars and posix mode are runtime shell state, re-enabling prompt expansion (shopt -s promptvars, set -o posix) or spawning an interactive child bash that inherits exported PS1 causes bash to expand the stored value and execute embedded command substitution. An attacker controlling the prompt value (e.g. via project metadata or tool config) gains command execution as the user sourcing bin/activate. Fixed in 21.14.13; 21.14.8 is not affected.
Fixed: virtualenv 21.14.13
Do: Upgrade virtualenv to 21.14.13 or later and recreate any virtual environments created with 21.14.9–21.14.12; Audit CI pipelines and tooling that pass --prompt sourced from project metadata or untrusted config; treat such prompts as attacker-controlled; Avoid sourcing bin/activate in shells where promptvars/posix mode may later be enabled, and unset/scrub exported PS1 in non-interactive contexts; Check whether any environments were activated in shells with prompt expansion re-enabled; investigate for signs of executed command substitution

### [high] toml (npm): Three high-severity CPU DoS vulnerabilities in toml.parse() allow event-loop blocking via crafted TOML documents (CVE-2026-114144, CVE-2026-114143)
https://helix.ml/threat-watch/i/toml-npm-three-high-severity-cpu-dos-vulnerabilities-in-toml-parse-allow-event-loop-blocking-via-crafted-toml-documents · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-114141, CVE-2026-114143, CVE-2026-114144
Three coordinated advisories published Oct 22, 2026 describe denial-of-service flaws in the toml npm package (<= 5.0.0), all fixed in 5.0.1. CVE-2026-114144: unbounded-length integer literals are passed to BigInt() before the 64-bit range check, so a ~5MB hex/decimal literal burns ~6s of CPU. CVE-2026-114143: quadratic O(n²) work in assign(), deepRef(), and setNestedKey() when recomputing dotted-key path prefixes; a ~100KB dotted key hangs for ~6.8s and ~200KB crashes the process with OOM. A third advisory describes quadratic rescans in addTableArray() for many [[name]] headers (~10.3s for a 321KB document). All paths synchronously block the Node.js event loop, stalling every request in the process. Any service parsing attacker-supplied TOML (config uploads, CI/CD, linters, editors) is exposed. Public PoCs exist; no in-the-wild exploitation reported. Fix: upgrade to toml 5.0.1.
Fixed: toml 5.0.1
Do: Upgrade toml to 5.0.1 or later immediately (npm audit / lockfile update); Audit dependencies for anything that calls toml.parse() on untrusted or third-party input (config upload endpoints, CI/CD pipelines, linters, editors/language servers); Until patched, add input-size limits and timeouts around TOML parsing, or run parsing in an isolated worker/child process so the main event loop is not blocked; Monitor for signs of DoS attempts: long CPU spikes correlated with TOML-parsing requests

### [high] Strands Agents SDK: A2A server leaks conversation history across tenants (CVE-2026-115419)
https://helix.ml/threat-watch/i/strands-agents-sdk-a2a-server-leaks-conversation-history-across-tenants-cve-2026-115419 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115419
The Agent2Agent (A2A) server in Strands Agents SDK failed to isolate conversation state between callers, sharing conversation history across callers with different context_id values. In multi-tenant deployments, an authenticated remote user could read another caller's conversation history or influence model behavior for other callers (CWE-488). Any deployment where an A2A server is reachable by more than one user or tenant is affected. No in-the-wild exploitation is known. Fixed versions use an agent factory so conversation state is isolated per A2A context_id; there is no full workaround other than running a separate A2A server instance per user or tenant.
Fixed: strands-agents 1.43.0; @strands-agents/sdk 1.5.0
Do: Upgrade strands-agents to 1.43.0 or later (Python) and @strands-agents/sdk to 1.5.0 or later (TypeScript); Until upgraded, do not expose an A2A server to more than one user or tenant; run a separate A2A server instance per user or tenant if multiple callers need access; Patch any forked or derivative code to incorporate the upstream fixes; Review logs for signs of cross-tenant conversation access in multi-tenant deployments

### [high] body-parser: single unauthenticated request crashes Node apps via trailing bytes after gzip body (CVE-2026-111181)
https://helix.ml/threat-watch/i/body-parser-single-unauthenticated-request-crashes-node-apps-via-trailing-bytes-after-gzip-body-cve-2026-111181 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-111181
A high-severity DoS vulnerability (CVE-2026-111181, GHSA-27r3-jxmh-p828) in the ubiquitous body-parser middleware lets any unauthenticated client crash a Node.js process with a single crafted request. When a request carries Content-Encoding (e.g. gzip), body-parser pipes it into a decompression stream and leaves it piped with no error listener after the body is read; a valid compressed frame followed by trailing bytes triggers an error on the finished decoder that is re-thrown as an uncaught exception, terminating the process. Parsing runs before routing, so no matching route or authentication is needed. Affects body-parser >=2.0.0,<2.4.0 and <1.20.9. Fixed in 2.4.0 and 1.20.9; no exploitation reported (EPSS 0.366%).
Fixed: body-parser 2.4.0; body-parser 1.20.9
Do: Upgrade body-parser to 2.4.0 (or 1.20.9 on the 1.x line) and redeploy affected services; As an interim mitigation, pass inflate: false to body-parser middleware where compressed request bodies are not needed; Audit Express/Node services for body-parser usage and add process-level crash recovery/restarts (e.g. health checks, auto-restart) as defense in depth; Monitor for crash loops or uncaught exceptions that could indicate probing

### [critical] Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)
https://helix.ml/threat-watch/i/pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-96639
Pillow multi-frame image loaders (PSD, MPO/JPEG, DCX, MIC) can retain native ImagingCore storage allocated for one frame while a later frame changes the image mode and decoder tiles. ImageFile.load_prepare() only reallocates storage when _im is None and does not verify the retained buffer matches the current mode/size, so a crafted file with frame 0 in a narrow mode (e.g. L) and frame 1 in a wider mode (RGB/CMYK) causes native out-of-bounds writes, crashes, and over-reads. The researcher demonstrated command execution via the documented ImageSequence.Iterator + frame.load() path, including a one-request unauthenticated web-upload exploit. All Pillow users processing untrusted images (web upload services especially) are affected. Fixed in Pillow 13.0.0, published 2026-10-22.
Fixed: 13.0.0
Do: Upgrade Pillow to 13.0.0 immediately, prioritising internet-facing services that process user-uploaded images; If upgrade is not immediate, restrict or sandbox image processing of untrusted uploads (e.g. isolate in containers/worker processes with limited privileges); Block or reject multi-frame MPO/PSD/DCX/MIC uploads at ingestion until patched; Audit image-processing pipelines for Pillow versions >= 11.0.0, < 13.0.0 and monitor for crash anomalies indicating exploitation attempts

### [critical] mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)
https://helix.ml/threat-watch/i/mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115324
A SQL injection vulnerability (CVE-2026-115324) was disclosed on 2026-10-22 in mem0ai's Databricks vector store (mem0/vector_stores/databricks.py). Versions 0.1.117 through before 1.0.8 pass attacker-influenced memory text, metadata, or message names into unescaped string interpolation in insert() and update() calls, allowing injection of arbitrary SQL against the configured Databricks SQL warehouse. Any application storing untrusted user content in mem0 memories backed by the Databricks vector store is affected, with high confidentiality, integrity, and availability impact. No in-the-wild exploitation is reported. Fixed in mem0ai 1.0.8 (commit a2ffca3), which escapes/parameterizes the affected queries.
Fixed: mem0ai 1.0.8
Do: Upgrade mem0ai to 1.0.8 or later immediately if you use the Databricks vector store; If upgrading is delayed, restrict or disable the Databricks vector store path and sanitize/validate memory text, metadata, and message names before storage; Review Databricks SQL warehouse logs for signs of injected or anomalous queries; Limit the SQL warehouse credentials used by mem0 to least privilege to contain potential injection impact; Audit any stored memories for suspicious content that may have been used as an injection vector

### [critical] Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)
https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-20011, CVE-2026-20043, CVE-2026-20218, CVE-2026-20221, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76445, CVE-2026-76524
Cisco's Snort 3 engineering team completed an internal security review and released hardening updates addressing multiple internally discovered vulnerabilities, grouped by CWE with one CVE per class: CVE-2026-20043 (out-of-bounds write, CWE-787), CVE-2026-20236 (incorrect calculation, CWE-682), CVE-2026-20291 (improper privilege management, CWE-269) and CVE-2026-20356 (uncontrolled resource consumption, CWE-400), with a maximum CVSS of 9.0. Affected products include Cisco Cloud-delivered Firewall, Cyber Vision, Meraki MX, Secure Access, Secure Firewall Threat Defense and UTD on IOS XE; Snort 2 is not affected. The flaws were found in internal testing and are not known to be exploited. Snort 3.12.4.0, Cyber Vision 5.6.0 and various FTD releases contain fixes; CDFW, CSA and Meraki instances were updated automatically on 2026-10-21. No workarounds exist.
Fixed: Snort 3.12.4.0; Cyber Vision 5.6.0; FTD 7.0.10 / 7.2.12 / 7.4.8 / 7.6.6 / 7.7.13 / 10.0.2 / 10.1.0
Do: Upgrade Open Source Snort 3 to 3.12.4.0 or later; Upgrade Cisco Cyber Vision to 5.6.0 (or migrate from older releases); Upgrade Cisco Secure FTD to the first fixed release for your train (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0); Update UTD on Cisco IOS XE per the advisory's fixed release table; Verify CDFW, CSA and Meraki MX devices are online so automatic Snort 3 package updates have applied

### [critical] x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)
https://helix.ml/threat-watch/i/x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat · Vulnerabilities · patched · since 2026-10-22
Security firm V12 disclosed three critical flaws in the x402 payment SDKs used by AI agents to pay for API calls. The default client set no spending limit, letting a malicious API request an agent's full token balance; the TypeScript Solana facilitator accepted token approvals (moving no tokens) as valid payments, enabling complete payment bypass; and the SIWx sign-in client signed login messages without verifying the destination site, enabling relayed authentication. All three were fixed in August 18 releases (2.23.0+), which add $1-per-payment caps, stablecoin-only defaults, instruction-type checks, and domain verification. No attacks reported, but npm/PyPI audits give no warning to upgrade. Latest versions: 2.28.0 (TypeScript/Go), 2.25.0 (Python).
Fixed: @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios 2.28.0; Go v2.28.0; Python 2.25.0; minimum 2.23.0 for the three critical fixes
Do: Upgrade @x402/fetch, @x402/axios, @x402/extensions, @x402/svm to 2.23.0+ (latest 2.28.0); Python to 2.25.0; Go to v2.28.0; If unable to upgrade, register a payment policy (registerPolicy / register_policy max_amount) that drops payment options above a set amount; Do not pass spendControls: false; review any apps that disable spend controls; Verify SIWx login messages identify the site being contacted before signing; Audit agent wallets for unexpected balance drains or unauthorized approvals

### [high] pypdf: Crafted PDFs with repeated malformed cross-reference entries cause long runtimes / DoS (CVE-2026-115585)
https://helix.ml/threat-watch/i/pypdf-crafted-pdfs-with-repeated-malformed-cross-reference-entries-cause-long-runtimes-dos-cve-2026-115585 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-115585
A follow-up advisory (GHSA-jr96-gvgh-j3r4) for pypdf describes a denial-of-service flaw where an attacker can craft a PDF with cross-reference streams containing repeated malformed cross-reference entries, causing long runtimes when parsed. It is a follow-up to GHSA-55h5-xmcq-c37v, whose fix still reloaded the whole stream despite caching. All pypdf versions before 6.21.2 are affected; any service parsing untrusted PDFs with pypdf is exposed. No in-the-wild exploitation is reported. Fixed in pypdf 6.21.2 (commit 68a0e50, PR #4240); organisations unable to upgrade can apply the PR #4240 changes as a workaround.
Fixed: pypdf 6.21.2
Do: Upgrade pypdf to 6.21.2 or later wherever it parses untrusted PDFs; If immediate upgrade is not possible, apply the changes from upstream PR #4240; Audit dependencies and services that process user-supplied PDF files for exposure; Add timeouts/resource limits around PDF parsing to blunt DoS attempts

### [high] Cisco IOS XR (ASR 9000/9900 Series): crafted IPv4 packets can reset or shut down line card network processors, causing DoS (CVE-2026-76505)
https://helix.ml/threat-watch/i/cisco-ios-xr-asr-9000-9900-series-crafted-ipv4-packets-can-reset-or-shut-down-line-card-network-processors-causing-dos-c · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76505
Cisco published a High-severity advisory (CVE-2026-76505, CWE-20, CVSS 7.5) for a denial-of-service vulnerability in the IPv4 packet-processing path of IOS XR on ASR 9000 and 9900 Series routers with Lightspeed- or Lightspeed-Plus-based line cards, and on ASR 9902/9903 compact routers. An unauthenticated remote attacker can send crafted IPv4 packets processed as for-us traffic to trigger network processor resets; repeated resets can leave the NP in a persistent shutdown state requiring a line card reload. Transit IPv4 and IPv6 traffic do not trigger it; IPv6-only configurations are unaffected. Cisco has released fixed software; no workarounds exist, but an iACL dropping UDP port 1701 traffic destined to infrastructure addresses is a proven mitigation. No exploitation reported in the wild.
Do: Upgrade ASR 9000/9900, ASR 9902/9903 routers running vulnerable IOS XR releases to a fixed release from the advisory; Until patched, deploy an ingress iACL on edge/external interfaces denying UDP destination port 1701 to local router addresses while permitting transit traffic; Inventory affected devices with show platform and confirm Lightspeed/Lightspeed-Plus line cards and IPv4-enabled interfaces via show ipv4 vrf all interface brief; Check logs with show logging | include "NP.*reset" for signs of exploitation or prior NP resets; Restrict exposure of router infrastructure addresses at the network edge generally

### [high] Cisco Secure Client Secure Firewall Posture module: local privilege escalation via crafted IPC messages (CVE-2026-76462)
https://helix.ml/threat-watch/i/cisco-secure-client-secure-firewall-posture-module-local-privilege-escalation-via-crafted-ipc-messages-cve-2026-76462 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76462
Cisco published a High-rated advisory for a privilege escalation vulnerability (CVE-2026-76462, CWE-20) in the IPC channel of the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux. Insufficient validation of user-supplied input lets an authenticated local attacker send crafted IPC messages to a local socket and perform limited file writes with SYSTEM or root privileges; on macOS and Linux this can yield full root, which is why Cisco rated it High despite the 5.5 CVSS. No workarounds exist and no public exploitation is known. Fixed in Cisco Secure Client 5.1.20.333; earlier releases are vulnerable. Bug ID CSCwu48192.
Fixed: 5.1.20.333
Do: Upgrade Cisco Secure Client to 5.1.20.333 or later on all endpoints running the Secure Firewall Posture module; Prioritise macOS and Linux hosts, where exploitation yields full root privileges; Restrict local access to devices running the Posture module until patched; Check with Cisco TAC for fixed software if lacking a valid service contract

### [medium] Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96652
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 3, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)
https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481, CVE-2026-76487
Cisco published a critical hardening release on 2026-10-21 addressing multiple internally discovered vulnerabilities across Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. Issues are grouped by CWE into eight CVEs (CVE-2026-76473 through CVE-2026-76481) covering injection (CWE-74, max 9.8), improper authentication (CWE-287, 9.8), XSS (9.3), input validation, SQL injection, access control (all 8.8), path traversal (7.8), and exceptional-condition handling (7.5). Vulnerabilities affect the products regardless of configuration, were found during internal testing including use of frontier AI models, and are not known to be exploited. No workarounds exist; fixed software is available — release 15SU5, while release 14 users must migrate to a fixed release.
Fixed: 15SU5 (Release 14: migrate to a fixed release)
Do: Upgrade Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, Emergency Responder, and Prime Collaboration Deployment to the first fixed releases (15SU5 for release 15; migrate off release 14); Prioritise internet-exposed Unified CM and Unity Connection instances given 9.8 unauthenticated network-attack vectors; Check for follow-up Cisco advisories detailing individual vulnerabilities and apply Snort rules 67356/67358 for detection; Since no workarounds exist, restrict network access to management interfaces until patching is complete

### [critical] Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)
https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76435, CVE-2026-76466, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497
Cisco published advisories on 2026-10-21 for Cisco Expressway Series (Expressway-C/E). CVE-2026-76466 (CVSS 9.8, CWE-798) is a critical unauthenticated remote RCE: use of persistent cookies plus insufficient client-certificate validation in clustering lets an attacker with network access connect to the database service and invoke RPC commands to execute arbitrary OS commands as root. It affects devices running X15.5.3 or earlier when configured in a cluster; no workarounds exist. A companion hardening advisory (cisco-sa-exwy-hardening-FhcqBVcs, max CVSS 8.6) fixes eight internally discovered issues (CVE-2026-76490 through -76497) covering out-of-bounds write, reachable assertions, null derefs, code injection, link following, insecure temp files and permission flaws, found partly using frontier AI models. Neither is known to be exploited. Fixed in X15.5.20; X14 and earlier must migrate.
Fixed: X15.5.20
Do: Upgrade clustered Expressway-C/E devices to X15.5.20 or later immediately, prioritising internet-facing Expressway-E; Migrate devices on X14 or earlier to a fixed release; Restrict network access to the database service and clustering ports (firewall/ACL) as interim mitigation until patched; Audit cluster configurations and TLS Verify Mode settings; review logs for suspicious RPC connections to the database service; Apply the October 2026 hardening release fixes to all Expressway deployments regardless of clustering configuration

### [critical] Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)
https://helix.ml/threat-watch/i/fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-106173
Researchers at Horizon3.ai published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM allowing unauthenticated remote code execution. The gRPC QueryResultReq handler on TCP port 27918 processes a user-supplied 'query-id' without validation, letting attackers traverse directories and embed a NUL byte to truncate the appended filename and overwrite arbitrary files. The PoC overwrites /opt/charting/redishb.sh, a Redis health-check script run by cron every 60 seconds, converting the arbitrary-file-write into code execution. Fortinet patched the flaw last week: FortiSIEM 7.5.0 users must upgrade to 7.5.1 or above; 7.6 is not affected. With a public PoC available, organisations running affected versions face imminent exploitation risk.
Fixed: FortiSIEM 7.5.1 or above (7.6 not affected)
Do: Upgrade FortiSIEM 7.5.0 to 7.5.1 or above immediately; Restrict network access to TCP port 27918 (gRPC service) from untrusted networks; Check /opt/charting/redishb.sh and similar cron-run scripts for tampering; Hunt for signs of exploitation, including unexpected writes or cron-executed script modifications; Monitor Fortinet advisories for additional affected branches

### [high] Happy DOM: unsanitized ESM import alias enables host code execution (CVE-2026-115895)
https://helix.ml/threat-watch/i/happy-dom-unsanitized-esm-import-alias-enables-host-code-execution-cve-2026-115895 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-115895, CVE-2026-33943
Happy DOM's ESM compiler fails to validate import binding aliases before interpolating them into generated JavaScript, an incomplete fix for CVE-2026-33943. An invalid import alias is transformed into a valid destructuring default initializer that executes, letting attacker-controlled HTML or module source escape the sandbox and reach Node.js host APIs (e.g., node:fs) to execute arbitrary code. Confirmed affected in v17.0.0 through v21.0.3; v16.8.1 is not affected. Exploitation requires enableJavaScriptEvaluation: true and attacker-controlled HTML/module input, affecting SSR, preview, scraping, and testing services. Fixed in happy-dom 21.0.4. A public PoC exists; no in-the-wild exploitation known.
Fixed: happy-dom 21.0.4
Do: Upgrade happy-dom to 21.0.4 or later immediately; If upgrade is not possible, disable enableJavaScriptEvaluation or ensure it never processes attacker-controlled HTML/module source; Audit SSR, preview, scraping, and testing services that evaluate untrusted HTML with happy-dom for exposure; Check hosts for artifacts such as a HAPPY_DOM_RCE_PROOF directory or unexpected process/node:fs access; Review dependent repositories and CI pipelines that render untrusted content via happy-dom

### [high] Atlassian: October bulletin patches 75 third-party CVEs across Data Center and Server products (multiple CVEs incl. CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, CVE-2026-75595, CVE-2026-77185)
https://helix.ml/threat-watch/i/atlassian-october-bulletin-patches-75-third-party-cves-across-data-center-and-server-products-multiple-cves-incl-cve-202 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-21589, CVE-2026-58062, CVE-2026-65182, CVE-2026-65637, CVE-2026-65905, CVE-2026-68525, CVE-2026-75595, CVE-2026-77185
Atlassian's October 2026 security bulletin lists 176 vulnerability entries (162 high, 14 critical), covering 75 unique CVEs, all in third-party dependencies such as Apache Tomcat, Bouncy Castle, Netty, Apache SSHD, Jackson, Axios, Spring, Struts and ActiveMQ. Affected products include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. Critical unique CVEs include Tomcat issues CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525, Bouncy Castle CVE-2026-58062, Netty CVE-2026-75595 and Apache SSHD CVE-2026-77185; Atlassian assesses its use of these components as lower, non-critical risk. Flaw types include DoS, crypto weaknesses, auth issues, SSRF, information disclosure and code execution. No exploitation is reported. Fixes are available in the latest or bulletin-listed releases; a separate critical Tomcat flaw CVE-2026-65905 appears on the disclosure portal.
Fixed: Latest product versions or fixed releases listed in the October 2026 bulletin
Do: Update all affected Atlassian Data Center/Server products to the latest versions or the fixed releases listed in the October 2026 bulletin, prioritising internet-facing Confluence, Jira and Crowd instances; Check the Atlassian vulnerability disclosure portal for CVE-2026-65905 (critical Apache Tomcat flaw in Data Center and Crowd) and ensure the corresponding fix is applied; Inventory which third-party components (Tomcat, Netty, Bouncy Castle, SSHD, Struts, ActiveMQ) your instances expose and review exposure to DoS, SSRF and code execution flaws; Monitor Atlassian advisories and threat intel, as attackers have rapidly exploited Atlassian flaws in the past (e.g. CVE-2026-21589)

### [high] EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVE-2026-106931)
https://helix.ml/threat-watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-106931
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 23, 2026 (BOD 22-01); treat that as the outer limit.

### [high] Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96656 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96656
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. CISA added CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 23, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96655)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96655 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96655
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 3, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVE-2026-96654)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96654 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96654
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 23, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVE-2026-110936)
https://helix.ml/threat-watch/i/siemens-software-center-cve-2026-110936 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-110936
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 3, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)
https://helix.ml/threat-watch/i/apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling · Vulnerabilities · patched · since 2026-10-20 · CVE-2025-31699, CVE-2025-55702, CVE-2026-111804, CVE-2026-111805, CVE-2026-111808, CVE-2026-111813, CVE-2026-111816
The Apache Software Foundation announced fixes for 15 vulnerabilities in Apache Traffic Server, addressed in versions 9.2.16, 10.1.5 and 10.2.1. The most severe (CVE-2026-111813, CVSS 10.0) lets an unauthenticated client control ImageMagick convert arguments via the experimental magick plugin's default configuration. Other issues include a wasm plugin use-after-free and unvalidated metric IDs (CVE-2026-111804), request smuggling via reused origin connections owed a request body (CVE-2025-31699) and unread Expect: 100-continue bodies (CVE-2025-55702), cache poisoning via a malformed 302 bypassing parse-error rejection (CVE-2026-111816), and HTTP/2-triggered origin worker-pool exhaustion (CVE-2026-111805, CVE-2026-111808). All ATS versions 9.0.0 through 10.2.0 are affected; no in-the-wild exploitation is reported. Fixes are available in the new releases.
Fixed: 9.2.16; 10.1.5; 10.2.1
Do: Upgrade to ATS 9.2.16, 10.1.5 or 10.2.1 immediately, prioritising internet-facing deployments; Disable or remove the experimental magick and wasm plugins if not strictly needed, especially on unpatched instances; Review access controls and front-end proxy connection sharing given the request smuggling and cache poisoning flaws; Monitor for signs of cache poisoning or request desync in logs after upgrading

### [critical] Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)
https://helix.ml/threat-watch/i/laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509 · Vulnerabilities · patched · since 2026-10-19 · CVE-2026-114509
A critical authentication bypass (CVE-2026-114509, CVSS 9.2) was disclosed in Laravel's built-in TokenGuard. When a standard token-based API guard is configured, an unauthenticated attacker can submit a specially crafted non-string credential value that is mishandled during the authentication lookup; under certain MySQL/MariaDB database configurations the query matches an unintended user record, letting the attacker authenticate as an arbitrary existing user without knowing their API token. Any route protected by the affected guard is exposed to account takeover. Fixes were released in laravel/framework 12.68.0 and 13.29.0 on 2026-10-19/23; no in-the-wild exploitation is known.
Fixed: laravel/framework 13.29.0; laravel/framework 12.68.0
Do: Upgrade laravel/framework to 12.68.0 (Laravel 12) or 13.29.0 (Laravel 13) immediately; Audit applications for use of token-based API guards and treat those routes as exposed until patched; Review auth logs for anomalous API token authentication or unexpected user sessions; If immediate upgrade is not possible, add middleware or validation rejecting non-string API token credentials; Verify database configuration (MySQL/MariaDB collation/type coercion behaviour) and consider hardening token column comparisons

### [critical] OpenCode: Malicious MCP servers can execute PowerShell commands during OAuth sign-in on Windows/WSL (no CVE assigned)
https://helix.ml/threat-watch/i/opencode-malicious-mcp-servers-can-execute-powershell-commands-during-oauth-sign-in-on-windows-wsl-no-cve-assigned · Vulnerabilities · patched · since 2026-10-19 · CVE-2025-6514
A command-injection flaw in OpenCode's browser-launch helper let a malicious or later-hijacked remote MCP server supply an OAuth authorization endpoint that was passed unescaped into a PowerShell command, executing attacker code with the developer's privileges when the developer ran 'opencode mcp auth' on Windows or WSL. macOS and Linux are unaffected. Pillar Security disclosed it on October 19 after private reporting on August 29; Anomaly fixed it in 1.18.33 (September 28) as an unannounced refactor, declined a CVE on the grounds that user-configured MCP servers are outside its trust model, so scanners won't flag vulnerable builds. The underlying 'open' npm package fixed similar behavior in v11 in 2023. No in-the-wild exploitation reported. Separate from the OpenCode Console breach that may have exposed API keys.
Fixed: 1.18.33
Do: Upgrade OpenCode to 1.18.33 or later on all Windows and WSL machines; Run 'opencode mcp list' and remove any unvetted remote MCP servers from configuration; Audit remaining MCP servers for trustworthiness, including domains that could change hands; Check OpenCode versions directly since no CVE exists for scanner detection; Rotate API keys if potentially exposed via the related OpenCode Console breach

### [high] postal-mime: Quadratic CPU DoS when decoding headers with many joinable RFC 2047 base64 encoded words (no CVE)
https://helix.ml/threat-watch/i/postal-mime-quadratic-cpu-dos-when-decoding-headers-with-many-joinable-rfc-2047-base64-encoded-words-no-cve · Vulnerabilities · patched · since 2026-10-18
postal-mime versions 3.0.0 through 4.0.7 suffer from a quadratic CPU consumption flaw (CWE-400/CWE-407) when decoding headers containing long runs of joinable RFC 2047 base64 encoded words, e.g. repeated =?utf-8?B?...?= tokens in Subject, From, To, filenames or descriptions. The join check ran a regex over the accumulated text for every word, so a single well-formed ~1.6 MB message could block the event loop for 1–20 seconds, and inline message/rfc822 parts multiplied the cost via per-message header budgets. Any application parsing untrusted mail with affected versions, including the exported decodeWords() helper, is exposed; no confidentiality or integrity impact. Fixed in 4.0.8 with linear-time decoding, plus stricter limits on nested message parts and header sizes. No exploitation known.
Fixed: postal-mime 4.0.8
Do: Upgrade postal-mime to 4.0.8 or later; Until upgraded, lower maxHeadersSize from the 2 MiB default to bound per-message cost; Parse untrusted mail in a terminable worker process to contain event-loop blocking; Audit mail-parsing paths, including use of the exported decodeWords() helper, for exposure to untrusted input

### [high] Pillow: decompression bomb check bypass in SpiderImagePlugin.seek() enables multi-GB allocation DoS (CVE-2026-96637)
https://helix.ml/threat-watch/i/pillow-decompression-bomb-check-bypass-in-spiderimageplugin-seek-enables-multi-gb-allocation-dos-cve-2026-96637 · Vulnerabilities · patched · since 2026-10-17 · CVE-2026-96637
Pillow's SpiderImagePlugin.seek() bypasses the decompression bomb check: seek() calls _open() directly, which re-parses an attacker-controlled SPIDER header and reassigns image size without any bounds validation, so ImageFile.load_prepare() allocates memory at an unchecked size. A crafted SPIDER stack file under 1KB can cause ~6.4GB allocation (mode F, e.g. 40000x40000) on im.load(), enabling denial of service. Sibling multi-frame plugins (GIF, TIFF, ICNS, ICO) do re-check on alternate paths; SpiderImagePlugin did not. All versions before 13.0.0 are affected. Fixed in Pillow 13.0.0 (commit 7cb0e02). A public PoC exists; no in-the-wild exploitation reported. Credit: Yazan Balawneh, CyStack Security Team.
Fixed: pillow 13.0.0
Do: Upgrade pillow to 13.0.0 or later wherever it is installed, especially in services that process untrusted image uploads; Until upgraded, restrict or reject SPIDER-format images (.stk/.hdr) from untrusted sources, or run image processing with memory limits (ulimit, container memory caps); Audit dependency manifests and lockfiles for pillow < 13.0.0 and rebuild/redeploy affected images; Monitor for memory-exhaustion/OOM events in image-processing workloads

### [high] filelock: local attacker can plant symlinks/journal files to overwrite or unlink lock user's files via SQLite-backed ReadWriteLock (CVE-2026-112940)
https://helix.ml/threat-watch/i/filelock-local-attacker-can-plant-symlinks-journal-files-to-overwrite-or-unlink-lock-user-s-files-via-sqlite-backed-read · Vulnerabilities · patched · since 2026-10-17 · CVE-2026-112940
The filelock library's SQLite-backed ReadWriteLock and AsyncReadWriteLock pass SQLite a path they do not control: on Linux the lock validates its database via a descriptor and connects through /proc/self/fd/<n>, which SQLite reopens by name, following symlinks, and on POSIX it also acts on -journal, -wal and -shm side files. A different local user who can create or rename entries in the lock database's directory (a 0777 or group-writable directory without the sticky bit) can make the lock user's read_lock()/write_lock() write attacker-chosen bytes into the lock user's files, create or unlink files, admit a reader beside a writer, or kill the holder; in sticky directories a planted -wal file makes every acquire fail. Affected versions 3.20.4–4.2.0; fixed in 4.2.1. No in-the-wild exploitation reported.
Fixed: filelock 4.2.1
Do: Upgrade filelock to 4.2.1 or later wherever ReadWriteLock/AsyncReadWriteLock is used; Audit where lock databases are placed; avoid 0777 or group-writable directories without the sticky bit; Verify kernel hardening: fs.protected_regular=1/2 and fs.protected_hardlinks=1 on hosts running multi-user workloads; Check downstream dependencies (filelock has ~58K dependent repos, e.g. tox, virtualenv tooling) for updated requirements

### [high] Pillow: four high-severity DoS/memory-safety flaws in PDF append, TarIO, PNG eXIf, and WMF/EMF rendering (CVE-2026-96640, CVE-2026-96642)
https://helix.ml/threat-watch/i/pillow-four-high-severity-dos-memory-safety-flaws-in-pdf-append-tario-png-exif-and-wmf-emf-rendering-cve-2026-96640-cve · Vulnerabilities · patched · since 2026-10-17 · CVE-2026-96640, CVE-2026-96642, CVE-2026-96643, CVE-2026-96644, CVE-2026-96778
Four high-severity advisories were published for Pillow on 2026-10-17/22, all fixed in 13.0.0. CVE-2026-96640: a malformed PDF /Pages tree with repeated child references makes PdfParser.linearize_page_tree() expand duplicates exponentially, causing CPU resource exhaustion via Image.save(..., append=True) with attacker-supplied PDFs (affects >=5.1.0). CVE-2026-96642: TarIO.TarIO() spins forever at 100% CPU on a crafted tar header with a negative size field. A third flaw makes EXIF parsing quadratic via repeated markers in PNG eXIf chunks (affects >=11.0.0). A fourth, Windows-only, heap over-read in WMF/EMF rendering stems from 16-bit dimension truncation in display.c. All are denial-of-service or memory-safety issues reachable with small crafted files; no exploitation reported. Upgrade to Pillow 13.0.0.
Fixed: Pillow 13.0.0
Do: Upgrade Pillow to 13.0.0 across all environments and rebuild/redeploy dependent images; Audit services that accept untrusted PDFs and use Pillow's PDF append path; restrict or sandbox until patched; Identify apps calling PIL.TarIO.TarIO() directly on untrusted archives and remove or gate that path; On Windows hosts, avoid processing untrusted WMF/EMF files with Pillow until upgraded; Add or verify dependency-scanning rules for these CVEs in CI and pin >=13.0.0

### [high] @azure/msal-node: authorization code flow may disclose auth parameters to attacker-controlled endpoint (CVE-2026-109461)
https://helix.ml/threat-watch/i/azure-msal-node-authorization-code-flow-may-disclose-auth-parameters-to-attacker-controlled-endpoint-cve-2026-109461 · Vulnerabilities · patched · since 2026-10-16 · CVE-2026-109461
Microsoft patched an origin validation error (CWE-346) in MSAL for Node.js, disclosed publicly on 2026-10-16 and reviewed 2026-10-23. In the authorization code flow, an unauthorized attacker can cause sensitive parameters to be disclosed to an attacker-controlled endpoint over a network, with high confidentiality impact and no integrity or availability impact. All versions from 5.0.0-beta.0 through before 7.1.0 are affected. No in-the-wild exploitation is known (EPSS 0.348%, 27th percentile). Version 7.1.0 contains the fix; as a workaround, applications should pass only the auth_code to acquireTokenByCode. Given the library's wide use (84.8M monthly downloads, ~8,050 dependent repos), Node.js apps using MSAL auth code flow should upgrade promptly.
Fixed: @azure/msal-node 7.1.0
Do: Upgrade @azure/msal-node to 7.1.0 or later; Until upgraded, ensure acquireTokenByCode is called with only the auth_code and no other sensitive parameters; Audit apps using the auth_code flow for exposure of tokens or other parameters to redirect endpoints; Check transitive npm dependencies for vulnerable msal-node versions

### [critical] BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)
https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764 · Vulnerabilities · unknown · since 2026-10-16 · CVE-2026-102764
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 19, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)
https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-61624 · Vulnerabilities · unknown · since 2026-10-16 · CVE-2025-61624
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 19, 2026 (BOD 22-01); treat that as the outer limit.

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.