This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
Tag: Vulnerability
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day…
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been…
OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery
New York, United States, 28th October 2026, CyberNewswire
Why Vulnerability Management Fails Without Reliable Asset Data
Vulnerability management depends on knowing what needs protecting. Asset management provides that foundation by maintaining a current picture of IT…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by…
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand,…
Cloud isolation bypass via Kubernetes vulnerability chain
Security researchers have disclosed a critical vulnerability chain in a major cloud provider’s managed Kubernetes service that enabled complete bypass of…
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
A Kaspersky expert presents a cloud isolation bypass case honored at Russian Pentest Award 2026. Learn how vulnerabilities in Kubernetes, Konnectivity,…
CVE-2026-118029 – Unverified ownership of the default Athena query result location in AWS SDK for pandas
Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for…
CVE-2026-119115 – Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
Bulletin ID: 2026-156-AWS Publication Date: 10/29/2026 09:30 AM PDT Description: We are aware of CVE-2026-119115, an incorrect authorization issue in the…
Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to…
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to…
Black Duck launches AI agent for vulnerability remediation
Application security vendor Black Duck has introduced Signal Agentic Fix, an AI agent designed to accelerate vulnerability remediation from discovery to…
CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical…
Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense
China-linked Volt Typhoon hackers have used a covert network called Silent Train to hide zero-day attacks against U.S. government agencies, defense…
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys…
Millions of security cameras at risk: DoS vulnerability in Intelbras devices
During our research, we discovered a denial-of-service vulnerability that could affect millions of Intelbras IP camera systems built on the platform…
Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to…