now in image form. this is bad, folks.

(CVE-2026-111943)

$ curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'

whoops

(CVE-2026-111943)

The immediate workaround is to yank these roots. That is what we ship on unstable-small and nixos-26.05-small right now.

{
security.pki.caCertificateBlacklist = [
# CVE-2026-111943
"Comodo AAA Services root"
# https://hg-edge.mozilla.org/projects/nss/rev/26d38a0c3fb81e7fb2acedbaf4c42dd21dce0517
"emSign ECC Root CA - G3"
# https://hg-edge.mozilla.org/projects/nss/rev/8159223c48ceeb1273a1915bca95a517294ab0e0
"emSign Root CA - C1"
"emSign ECC Root CA - C3"
];
}

New Go security releases added explicit distrust for some specific intermediate CA certificates belonging to eMudhra Technologies Limited. Interestingly, this is tracked as CVE-2026-111943 but no details on why this was done are provided.

https://github.com/golang/go/commit/7f86f957633ee31a1c17a1eb8452ca7a3d9bc141

#pki #CVE_2026_111943 #infosec #cybersecurity

Mitigating CVE-2026-111943 on #Debian:

- sudo dpkg-reconfigure ca-certificates

- Select "ask" and deselect the following entries:
mozilla/emSign_ECC_Root_CA_-_C3.crt
mozilla/emSign_ECC_Root_CA_-_G3.crt
mozilla/emSign_Root_CA_-_C1.crt
mozilla/emSign_Root_CA_-_G1.crt
mozilla/Comodo_AAA_Services_root.crt

- Hit <Ok>

Alternatively you can edit /etc/ca-certificates.conf manually and add the specific entries:

!mozilla/emSign_ECC_Root_CA_-_C3.crt
!mozilla/emSign_ECC_Root_CA_-_G3.crt
!mozilla/emSign_Root_CA_-_C1.crt
!mozilla/emSign_Root_CA_-_G1.crt
!mozilla/Comodo_AAA_Services_root.crt

...and sudo update-ca-certificates

Please do note that disabling these certificates may also result in collateral damage. That is, sites that happen to use intermediate certificates signed by these root certificates will cease to validate.

#CVE_2026_111943

Mitigating CVE-2026-111943 on macOS:

- Launch KeyChain Access and remove trust for "emSign *" and "AAA Certificate Services" roots in System Keychains/System Roots
- Edit /etc/ssl/cert.pem and remove all eMudhra certificates and "CN=AAA Certificate Services" certificate

NOTE: Some applications may still include their own, embedded ca-bundle files.

#CVE_2026_111943

Taking bets on cve-2026-111943...

certifi has a ghsa tho :)
https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2

CVE-2026-111943 appears to be an unpublished "reserved but public" CVE

Official ca-certificates security update for Debian Trixie is available now to address the eMudhra incident (CVE-2026-111943)

Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.

PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619

Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35

All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.

https://www.php.net/archive/2026.php#2026-10-20-1

We are aware of the upcoming critical vulnerability disclosures in PHP. Watch this post for updates as they are available.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel #ThreatIntelligence #IFIN

🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow

The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.

PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.

Source: https://www.php.net/archive/2026.php#2026-10-20-1

Word on the street is there are 2 new PHP core RCE path traversal vulns #threatintel #CVE

CVE-2026-109618
CVE-2026-109619

End of life PHP shows up everywhere so when they say everything since version 5 it is quite concerning 🫣

https://news.ycombinator.com/item?id=50167754
„A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0.
I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.
These CVEs reportedly relate to rce in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announ:
CVE-2026-109618
CVE-2026-109619”
#infosec

Get ready for PHP security updates tomorrow to address CVE-2026-109618 and CVE-2026-109619 (the leaked RCE CVEs with CVSSv4 9.2 scores)

https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018/

#PHP #CVE

Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.

PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619

Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35

All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.

https://www.php.net/archive/2026.php#2026-10-20-1

We are aware of the upcoming critical vulnerability disclosures in PHP. Watch this post for updates as they are available.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel #ThreatIntelligence #IFIN

🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow

The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.

PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.

Source: https://www.php.net/archive/2026.php#2026-10-20-1

Word on the street is there are 2 new PHP core RCE path traversal vulns #threatintel #CVE

CVE-2026-109618
CVE-2026-109619

End of life PHP shows up everywhere so when they say everything since version 5 it is quite concerning 🫣

https://news.ycombinator.com/item?id=50167754
„A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0.
I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.
These CVEs reportedly relate to rce in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announ:
CVE-2026-109618
CVE-2026-109619”
#infosec

Get ready for PHP security updates tomorrow to address CVE-2026-109618 and CVE-2026-109619 (the leaked RCE CVEs with CVSSv4 9.2 scores)

https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018/

#PHP #CVE

Source: Palo Alto Unit 42
Read: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
More cyber news: https://cyzo.io/news?utm_source=social&utm_medium=social&utm_campaign=cyzo_news
#Cyzo #Cybersecurity

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257

Ransomware operators including Qilin and Inc are actively exploiting CVE-2026-0257, a GlobalProtect authentication bypass in Palo Alto Networks PAN-OS, Unit 42 reports in an October 19 update. Attackers use the flaw to establish VPN sessions that bypass MFA, and in one case moved from the gateway to the victim’s vCenter to dump domain credentials from a virtual disk. https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/

Ransomware gangs exploit CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to slip past MFA and open VPN sessions. Patch now.

#CVE20260257 #PANOS #GlobalProtect #Ransomware #Qilin #Unit42 #ReliaQuest #Cybersecurity

https://securityonline.info/cve-2026-0257-globalprotect-ransomware/?utm_source=mastodon&utm_medium=jetpack_social

Party like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape. https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744

Siemens Software Center vulnerability CVE-2026-110936 is exploited in the wild by ClickFix attackers via DLL sideloading. Update to 4.0.9.8.

#Siemens #SiemensSoftwareCenter #CVE2026110936 #ExploitedInTheWild #ClickFix #DLLSideloading #Malware #CyberSecurity

https://securityonline.info/siemens-software-center-cve-2026-110936-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Siemens has released version 4.0.9.8 of Siemens Software Center to address a high-severity vulnerability tracked as CVE-2026-110936 with a CVSS v4 score of 8.4.

The flaw allows an authenticated local attacker to place a crafted DLL in a searched directory, leading to arbitrary code execution with application privileges.

Researchers discovered genuine copies of the software were leveraged in campaigns.

Organizations ar…

https://en.hacks.gr/i-siemens-diorthonei-keno-asfaleias-poy-axiopoiithike-se-epitheseis/

#Siemens #SoftwareCenter #CVE2026110936 #Malware

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, that it said has been exploited in ClickFix attacks. The flaw could allow an attacker to place a specially crafted DLL in a directory the application loads from, The Hacker News reports. https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html

Security researchers released a proof-of-concept exploit for a severe path traversal vulnerability in Fortinet FortiSIEM, tracked as CVE-2026-106173 with a CVSS score of 9.4.

The flaw affects unauthenticated remote code execution via unsafe path construction in the gRPC service.

Fortinet issued patches last week for version 7.5.0 and advises upgrading to version 7.5.1 or higher, while confirming that version 7.6 is not affec…

https://en.hacks.gr/ereynites-edeixan-pos-mporei-na-ektelestoyn-entoles-sto-fortisiem-7-5-0-choris-syndesi/

#Fortinet #FortiSIEM #Vulnerability #Patch

lol. lmao.

https://nvd.nist.gov/vuln/detail/cve-2026-77932

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.

CVE-2026-77932 | eosphoros-ai DB-GPT ≤0.8.2 has a CRITICAL RCE flaw via /api/v1/chat/react-agent. Unauthenticated attackers can gain root on the container & DB. Restrict endpoint now; patch status pending. https://radar.offseq.com/threat/cve-2026-77932-missing-authentication-for-critical-function-in-eosphoros-ai-db-gpt-cadf6cb00dbfb5cd #OffSeq #CVE #RCE #Infosec

Interesting sev:CRIT vuln impacting Signal.

https://nvd.nist.gov/vuln/detail/cve-2026-113380

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

CVE-2026-113380 | CRITICAL: Signal RingRTC <2.72.0 has a flaw in FSM queue handling — remote peers can block call teardown, causing DoS for call sessions. Patch to 2.72.0+ now. https://radar.offseq.com/threat/cve-2026-113380-cwe-754-improper-check-for-unusual-or-exceptional-conditions-in-signal-ringrtc-7b225fb333cf31fe #OffSeq #CVE2026113380 #Signal #InfoSec

Nutzt wer den #AnyDesk Linux Client?

https://borncity.com/blog/2026/10/20/schwachstelle-cve-2026-109390-cvss-v3-1-9-8-im-anydesk-client-fuer-linux/