Threat Advisories & Vulnerability Intelligence

Actively exploited vulnerability in Linux Kernel (CVE-2026-46300)

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

HIGHOctober 28, 2026

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared first on SecurityWeek .

MEDIUMOctober 27, 2026

Apple backports CoreGraphics zero-day patches to older iPhones

Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in “extremely sophisticated” targeted attacks on iOS devices.

MEDIUMOctober 27, 2026

Actively exploited unrestricted file upload vulnerability in Adobe Commerce and Magento (CVE-2026-48356)

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session.

CRITICALOctober 27, 2026

Actively exploited memory corruption vulnerability in Google Brotli (CVE-2026-111497)

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

CRITICALOctober 27, 2026

Actively exploited access control vulnerability in Oray Pugongying X5 Pro 7 (CVE-2026-116236)

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler.

HIGHOctober 26, 2026

Critical vulnerability in Oracle Java SE and 2 other products (CVE-2026-114820)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2.

CRITICALOctober 24, 2026

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.

HIGHOctober 23, 2026

Actively exploited command injection vulnerability in Collabora Online – Built-in CODE Server (CVE-2026-110447)

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn’t running.

CRITICALOctober 23, 2026

Actively exploited SQL injection vulnerability in Arista VeloCloud Orchestrator on-prem (CVE-2026-114625)

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

CRITICALOctober 23, 2026

Command injection vulnerability in Azure Pipelines (CVE-2026-105014)

Improper neutralization of special elements used in a command (‘command injection’) in Azure Pipelines allows an unauthorized attacker to execute code over a network.

CRITICALOctober 22, 2026

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication.

CRITICALOctober 22, 2026

Cookie	Duration	Description
__cfduid	1 month	The cookie is used by CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
cookielawinfo-checkbox-advertisement	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Advertisement".
cookielawinfo-checkbox-analytics	1 year	This cookies is set by GDPR Cookie Consent WordPress Plugin. The cookie is used to remember the user consent for the cookies under the category "Analytics".
cookielawinfo-checkbox-functional	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	1 year	No description
cookielawinfo-checkbox-performance	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
pll_language	1 year	The cookie stores the language code of the last browsed page.

Cookie	Duration	Description
_clck	1 year	Used by Microsoft Clarity to store a unique user ID
_clsk		Microsoft Clarity analytics application
_ga	2 years	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga_L2RPNQR0FJ	2 years	This cookie is set by Google Analytics 4 to persist session state and count sessions for this property.
_gat_gtag_UA_44752404_1	1 minute	No description
_gid	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_lfa	2 years	This cookie is set by the provider Leadfeeder. This cookie is used for identifying the IP address of devices visiting the website. The cookie collects information such as IP addresses, time spent on website and page requests for the visits.This collected information is used for retargeting of multiple users routing from the same IP address.
CLID	1 year	Microsoft Clarity
of.tracking	1 year
ofs
SL_C_23361dd035530_KEY		Outfunnel Campaign
SL_C_23361dd035530_SID		Outfunnel Campaign
SL_C_23361dd035530_VID		Outfunnel Campaign
SM	session	Used in synchronizing the MUID across Microsoft domains.
SRM_B	1 year 24 days	Identifies unique web browsers visiting Microsoft sites
vuid	2 years	This domain of this cookie is owned by Vimeo. This cookie is used by vimeo to collect tracking information. It sets a unique ID to embed videos to the website.

Cookie	Duration	Description
__oppref	30 days	Cookie used by OpenAI Ads to measure the performance of ads on ChatGPT.
_gcl_au	3 months	This cookie is set by Google Tag Manager and Google Ads to measure how well advertising performs and to attribute conversions to ad clicks.
ANONCHK	10 minutes	This cookie is used for storing the session ID for a user. This cookie ensures that clicks from advertisement on the Bing search engine are verified and it is used for reporting purposes and for personalization.
MUID	1 year 24 days	Used by Microsoft as a unique identifier. The cookie is set by embedded Microsoft scripts. The purpose of this cookie is to synchronize the ID across many different Microsoft domains to enable user tracking.
oaacct	30 days	Stores which EXEO OpenAI ads account referred the visit, so that conversions are measured in the right account. Set only after advertising consent.

Threat advisories that tell you what to do next

Actively exploited vulnerability in Linux Kernel (CVE-2026-46300)

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple backports CoreGraphics zero-day patches to older iPhones

Actively exploited unrestricted file upload vulnerability in Adobe Commerce and Magento (CVE-2026-48356)

Actively exploited memory corruption vulnerability in Google Brotli (CVE-2026-111497)

Actively exploited access control vulnerability in Oray Pugongying X5 Pro 7 (CVE-2026-116236)

Critical vulnerability in Oracle Java SE and 2 other products (CVE-2026-114820)

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Actively exploited command injection vulnerability in Collabora Online – Built-in CODE Server (CVE-2026-110447)

Actively exploited SQL injection vulnerability in Arista VeloCloud Orchestrator on-prem (CVE-2026-114625)

Command injection vulnerability in Azure Pipelines (CVE-2026-105014)

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Get in touch