24h | 7d | 30d

CVE-2026-98432

Overview

  • Linux
  • Linux
15 Oct 2026
Published
31 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.46%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

Statistics

  • 19 Posts
  • 288 Interactions
Last activity: 2 hours ago

Fediverse

Profile picture fallback
nixCraft 🐧 @nixCraft

WTF Ubuntu? chalmovsky.com/posts/wtf-ubuntu

In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover.

Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".

  • 104
  • 110
  • 0
  • 3h ago
Profile picture fallback
Etienne / Tek @tek

Critical vulnerability in Linux network start, this is a nightmare scenario, I am shutting down some servers until there is a fix (and it is not Sunday night for me to fix it)
atlasum.net/blog/cve-2026-9843

  • 23
  • 22
  • 0
  • 18h ago
Profile picture fallback
Linux-Magazin @redaktion

Linux-Kernel: Sicherheitslücke ermöglicht Fernzugriff

Eine Sicherheitslücke im Netzwerk-Stack des Linux-Kernels ermöglicht es Angreifern, aus der Ferne und ohne Benutzerinteraktion beliebige Befehle mit Root-Rechten auszuführen.

linux-magazin.de/news/linux-ke

#linux #opensource #LinuxKernel #Sicherheitslücke #Fernzugriff #CVE202698432

@uba

  • 3
  • 3
  • 0
  • 7h ago
Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Critical Linux kernel flaw could allow remote root code execution; CVE-2026-98432

A use-after-free vulnerability in the Linux IPv4 TCP handshake path allows an unauthenticated attacker to trigger memory corruption by sending specially timed packets to a listening service.

Successful exploitation could crash the system or potentially execute arbitrary code as root.
⠀
• CVSS: 9.8
• Affected: Linux kernel 4.4 and later
• Attack vector: Network
• Privileges required: None
• User interaction: None
• Active exploitation: Not reported
⠀
Fixed kernel branches:

• 5.10.272
• 5.15.223
• 6.1.190
• 6.6.159
• 6.12.113
• 6.18.56
• 7.2.10
• 7.3
⠀
Administrators should install their distribution’s updated kernel and reboot to activate the fix.

Advisory: access.redhat.com/security/vul

  • 3
  • 0
  • 0
  • 2h ago
Profile picture fallback
Janik Besendorf @besendorf

Ubuntu is shitty software and backporting is flawed
atlasum.net/blog/cve-2026-9843

  • 2
  • 5
  • 0
  • 12h ago
Profile picture fallback
Caspar C. Mierau @leitmedium

Bin irritiert, dass für Debian schön länger Kernelpatches bereitstehen, aber man bei Ubuntu irgendwie hängt (CVE Score 9,8).

ubuntu.com/security/CVE-2026-9

  • 1
  • 3
  • 0
  • 6h ago
Profile picture fallback
CounterPillow @CounterPillow

It's really funny Ubuntu hasn't shipped a fix for CVE-2026-98432 yet because the fix is a +2/-2 diff that applies cleanly to their kernels and the entire reason they haven't been able to get an update out the door is due to deep organisational dysfunction within Canonical.

  • 1
  • 2
  • 0
  • 2h ago
Profile picture fallback
benzogaga33 :verified: @benzogaga33

CVE-2026-98432 : la faille critique du noyau Linux qui peut offrir un accès root à distance it-connect.fr/cve-2026-98432-f #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

  • 0
  • 3
  • 0
  • 8h ago
Profile picture fallback
Raphael @0x3e4

what the heck?

CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. Ubuntu and RHEL haven't shipped a fixed kernel yet.

atlasum.net/blog/cve-2026-9843

  • 0
  • 0
  • 0
  • 20h ago
Profile picture fallback
crypto news 🧠 eicker.crypto @crypto

Anza has urged Solana mainnet-beta validators to act on CVE-2026-98432, a critical Linux kernel use-after-free bug scored 9.8 that lets a remote attacker run commands as root. Ubuntu still lists the fix as work in progress, so operators should disable Multipath TCP. A host takeover could expose the validator identity key. thedefiant.io/news/security/an #Web3 #Blockchain #Solana

  • 0
  • 0
  • 0
  • 15h ago
Profile picture fallback
Tomasz Nurkiewicz @nurkiewicz

9.8 CVE in Linux kernel: cve.org/CVERecord?id=CVE-2026-

  • 0
  • 0
  • 0
  • 9h ago
Profile picture fallback
Miguel Afonso Caetano 🦾 🌹 @remixtures

"Linux's stable kernels shipped a fix on October 11 and 15, 2026 for CVE-2026-98432, a use-after-free in the IPv4 TCP handshake that a remote, unauthenticated peer can reach. The kernel's own CVE Numbering Authority (CNA) scores it CVSS 3.1 9.8, Critical. The fixed releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, and the bug goes back to Linux 4.4. The upstream fix is a four-line change, but most servers run a distribution's kernel. Red Hat, which now rates the bug Critical too, shipped fixed kernels for Red Hat Enterprise Linux (RHEL) 8, 9, and 10 on November 1. As of 6:15 PM CST that day, Ubuntu's tracker still reads "Vulnerable" for its kernel on every release.

Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team."

atlasum.net/blog/cve-2026-9843

#CyberSecurity #Linux #Kernerl #TCP #IPv4 #RedHat #Ubuntu

  • 0
  • 0
  • 0
  • 5h ago

Bluesky

Profile picture fallback
セキュリティ対策Lab @securitylab-jp.bsky.social
Go 1.24以降のLinuxサーバーに注意　MPTCPの既定有効化で遠隔root侵害リスク、CVE-2026-98432の確認方法と対策 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
  • 1
  • 0
  • 0
  • 21h ago
Profile picture fallback
IT-Connect @it-connect.bsky.social
CVE-2026-98432 : une faille du noyau #Linux notée 9,8/10 permettrait d’exécuter une commande en root à distance, sans authentification. Le bug est dans le code TCP IPv4 du noyau : le risque ne se limite pas aux serveurs Go. Noyaux corrigés et mesures 👇 www.it-connect.fr/cve-2026-984...
  • 0
  • 1
  • 0
  • 9h ago
Profile picture fallback
boredchilada @cyfar.ca
~Trailofbits~ Codex helped deliver 149 CVE fixes to stable kernels, including urgent gaps such as critical remotely exploitable CVE-2026-98432. - IOCs: CVE-2026-98432 - #CVE-2026-98432 #Linux #ThreatIntel
  • 0
  • 1
  • 0
  • 6h ago
Profile picture fallback
tamosan @tamosan.bsky.social
夜行性インコさんのまとめ。例のRCE出来る件のやつ：Linuxカーネルの脆弱性 CVE-2026-98432 についてまとめてみた - piyolog piyolog.hatenadiary.jp/entry/2026/1...
  • 0
  • 0
  • 0
  • 19h ago
Profile picture fallback
キタきつね @kitafox.bsky.social
Linuxカーネルの脆弱性CVE-2026-98432によりリモートルート権限が付与される #SecurityOnline (Oct 30) securityonline.info/linux-kernel...
  • 0
  • 0
  • 0
  • 16h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 [VULN] CVE-2026-98432 : la faille critique du noyau Linux qui peut offrir un accès root à distance Notée 9,8 sur 10, la faille CVE-2026-98432 présente dans le noyau Linux permettrait, selon Anthropic, d'exécuter des commandes à distance en tant que root, le tout sans être auth… #CVE #Cyberveille
  • 0
  • 0
  • 0
  • 4h ago
Profile picture fallback
Matt "msw" Wilson @msw.bsky.social
Unfortunately we don't have a public authority willing to say to the "presently, the risk to systems presented by CVE-2026-98432 is very low. Patch normally." Not that it would do much to lower fears that lead to people saying they are thinking of switching linux distros over patch availability.
  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-31695

Overview

  • Linux
  • Linux
01 May 2026
Published
05 Aug 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.13%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the virt_wifi net devices. However, unregistering a virt_wifi device in netdev_run_todo() can happen together with the device referenced by SET_NETDEV_DEV(). It can result in use-after-free during the ethtool operations performed on a virt_wifi device that is currently being unregistered. Such a net device can have the `dev.parent` field pointing to the freed memory, but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`. Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this: ================================================================== BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606 Call Trace: <TASK> dump_stack_lvl+0x4d/0x70 print_report+0x170/0x4f3 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kasan_report+0xda/0x110 ? __pm_runtime_resume+0xe2/0xf0 ? __pm_runtime_resume+0xe2/0xf0 __pm_runtime_resume+0xe2/0xf0 ethnl_ops_begin+0x49/0x270 ethnl_set_features+0x23c/0xab0 ? __pfx_ethnl_set_features+0x10/0x10 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xf/0xf0 ? local_clock+0x10/0x30 ? kasan_save_track+0x25/0x60 ? __kasan_kmalloc+0x7f/0x90 ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0 genl_family_rcv_msg_doit+0x1e7/0x2c0 ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 ? __pfx_cred_has_capability.isra.0+0x10/0x10 ? stack_trace_save+0x8e/0xc0 genl_rcv_msg+0x411/0x660 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_ethnl_set_features+0x10/0x10 netlink_rcv_skb+0x121/0x380 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_down_read+0x10/0x10 genl_rcv+0x23/0x30 netlink_unicast+0x60f/0x830 ? __pfx_netlink_unicast+0x10/0x10 ? __pfx___alloc_skb+0x10/0x10 netlink_sendmsg+0x6ea/0xbc0 ? __pfx_netlink_sendmsg+0x10/0x10 ? __futex_queue+0x10b/0x1f0 ____sys_sendmsg+0x7a2/0x950 ? copy_msghdr_from_user+0x26b/0x430 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ___sys_sendmsg+0xf8/0x180 ? __pfx____sys_sendmsg+0x10/0x10 ? __pfx_futex_wait+0x10/0x10 ? fdget+0x2e4/0x4a0 __sys_sendmsg+0x11f/0x1c0 ? __pfx___sys_sendmsg+0x10/0x10 do_syscall_64+0xe2/0x570 ? exc_page_fault+0x66/0xb0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This fix may be combined with another one in the ethtool subsystem: https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u

Statistics

  • 4 Posts
  • 25 Interactions
Last activity: Last hour

Fediverse

Profile picture fallback
Alexander Popov @a13xp0p0v

I published a detailed article:

⚠️Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device⚠️

I managed to make make the PoC exploit absolutely stable, despite the elusive race condition during the attack.

a13xp0p0v.tech/2026/11/02/CVE-

  • 14
  • 11
  • 0
  • 6h ago
Profile picture fallback
KittenCannonSec™ @glitterbean

Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device a13xp0p0v.tech/2026/11/02/CVE-

  • 0
  • 0
  • 1
  • 4h ago

Bluesky

Profile picture fallback
buherator @buherator.bsky.social
Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device a13xp0p0v.github.io -> Original->
  • 0
  • 0
  • 0
  • Last hour

CVE-2026-31419

Overview

  • Linux
  • Linux
13 Apr 2026
Published
30 Oct 2026
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.13%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Statistics

  • 3 Posts
  • 6 Interactions
Last activity: 11 hours ago

Fediverse

Profile picture fallback
AllAboutSecurity @allaboutsecurity

Linux-Kernel: Öffentlicher Exploit für Bonding-Lücke CVE-2026-31419

Sicherheitsforscher haben technische Details und funktionierenden Exploit-Code für eine Schwachstelle im Linux-Kernel veröffentlicht. Die Lücke CVE-2026-31419 steckt im Bonding-Treiber und erlaubt lokalen Angreifern, ihre Rechte bis auf Root auszuweiten. Administratoren sollten die aktuellen Kernel-Updates einspielen.

all-about-security.de/linux-ke

#linux

  • 2
  • 0
  • 0
  • 11h ago
Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.

securityonline.info/linux-kern

  • 0
  • 1
  • 0
  • 16h ago

Bluesky

Profile picture fallback
All About Security @allaboutsecurity.bsky.social
Linux-Kernel: Öffentlicher Exploit für Bonding-Lücke CVE-2026-31419- Die Lücke CVE-2026-31419 steckt im Bonding-Treiber und erlaubt lokalen Angreifern, ihre Rechte bis auf Root auszuweiten. Administratoren sollten die aktuellen Kernel-Updates einspielen. shorturl.at/mxruh #linux #security
  • 1
  • 2
  • 0
  • 11h ago

CVE-2026-111497

Overview

  • Google
  • Brotli
  • github.com/google/brotli
22 Oct 2026
Published
30 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
82.64%
KEV

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Statistics

  • 3 Posts
Last activity: 6 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Brotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched.

securityonline.info/brotli-vul

  • 0
  • 0
  • 0
  • 17h ago

Bluesky

Profile picture fallback
BABA Toshiaki @netmarkjp.bsky.social
#ばばさん通信ダイジェスト 賛否関わらず話題になった/なりそうなものを共有しています。 BrotliのC言語実装における境界外書き込みの脆弱性（CVE-2026-111497）に関する注意喚起 https://www.jpcert.or.jp/at/2026/at260034.html
  • 0
  • 0
  • 0
  • 17h ago
Profile picture fallback
Lorenzo Ordóñez @lordman1982.bsky.social
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected www.aikido.dev/blog/python-...
  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-97229

Overview

  • GitLab
  • GitLab
13 Oct 2026
Published
30 Oct 2026
Updated
CVSS v3.1
CRITICAL (10.0)
EPSS
27.30%
KEV

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Statistics

  • 4 Posts
  • 11 Interactions
Last activity: Last hour

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 More than 1,000 GitLab servers remain exposed to an actively exploited RCE flaw; CVE-2026-97229

The CVSS 10.0 vulnerability allows an unauthenticated attacker to execute arbitrary code through a malicious regular expression inside a CI/CD configuration.
⠀
• CVSS: 10.0
• Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2
• Fixed: 19.2.8, 19.3.5 and 19.4.2
• Active exploitation: Confirmed
⠀
CISA added the flaw to its Known Exploited Vulnerabilities catalog after attacks were detected.

Shadowserver is still tracking more than 1,000 vulnerable internet-facing instances.

Source: docs.gitlab.com/releases/patch

  • 1
  • 1
  • 0
  • Last hour

Bluesky

Profile picture fallback
TugaTech @tugate.ch
Mais de 1.000 servidores do GitLab permanecem vulneráveis a ataques de execução remota de código devido a uma falha de segurança identificada como CVE-2026-97229. 🚨 #empresa #erro #falha #gitlab #vulnerabilidade
  • 0
  • 0
  • 0
  • 1h ago
Profile picture fallback
The Shadowserver Foundation @shadowserver.bsky.social
We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily). Tree Map Dashboard stats (both vulns) dashboard.shadowserver.org/statistics/c...
  • 4
  • 5
  • 0
  • 22h ago
Profile picture fallback
The Shadowserver Foundation @shadowserver.bsky.social
IP data in our Vulnerable HTTP reporting tagged 'cve-2026-97229' or 'cve-2026-110264': www.shadowserver.org/what-we-do/n... World Map view: dashboard.shadowserver.org/statistics/c... Tracker: dashboard.shadowserver.org/statistics/c... Patch info: docs.gitlab.com/releases/pat...
  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-109618

Overview

  • PHP Group
  • PHP
  • php-src
21 Oct 2026
Published
30 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.2)
EPSS
100.00%
KEV

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Statistics

  • 5 Posts
  • 2 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-109618 (PHP2Shell) – CRITICAL vuln in WAGO CC100. Attackers can hijack the PHP process via web UI; public exploit exists, no patch yet. Restrict access & monitor for updates. radar.offseq.com/threat/wago-m

  • 1
  • 1
  • 0
  • 7h ago
Profile picture fallback
CERT@VDE @certvde

🔒 New CSAF advisory published

VDE-2026-132
WAGO: Multiple Devices affected by PHP2Shell
CVE-2026-109618, CVE-2026-109619

Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially…

HTML: certvde.com/en/advisories/VDE-
CSAF JSON: wago.csaf-tp.certvde.com/.well

  • 0
  • 0
  • 1
  • 8h ago
Profile picture fallback
Inlinestyle @inlinestyle

mail.inlinestyle.it has been updated to the latest Mailu release (2024.06.67), which ships a patched webmail runtime fixing the recent PHP2Shell CVEs (CVE-2026-109618, CVE-2026-109619). Your mail keeps getting the security updates it deserves ✉️

  • 0
  • 0
  • 0
  • 3h ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
@reversinglabs.com AI-assisted PHP flaws enabled remote code execution and data theft; leaks triggered early exploit attempts before patching. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE2026 #PHP2Shell #ThreatIntel
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-111357

Overview

  • Ivanti
  • Connect Secure
15 Oct 2026
Published
31 Oct 2026
Updated
CVSS v3.1
HIGH (7.0)
EPSS
0.53%
KEV

Description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Statistics

  • 5 Posts
  • 2 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
ekiledjian @edwardk

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti has released security updates patching two more Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, that attackers have chained in zero-day attacks since at least October 1, BleepingComputer reports. Chained with an authentication bypass flaw patched last month, the flaws let attackers gain unauthenticated root-level access to the remote access gateways, and Shadowserver tracks more than 5,000 internet-exposed instances. bleepingcomputer.com/news/secu

  • 1
  • 0
  • 0
  • 9h ago
Profile picture fallback
Jeff Hall - PCIGuru :verified: @jbhall56

Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface. bleepingcomputer.com/news/secu

  • 0
  • 0
  • 1
  • 1h ago

Bluesky

Profile picture fallback
SANS.edu Internet Storm Center @sansisc.bsky.social
SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death https://isc.sans.edu/podcastdetail/10160
  • 0
  • 1
  • 0
  • 17h ago
Profile picture fallback
Help Net Security @helpnetsecurity.com
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) 📖 Read more: www.helpnetsecurity.com/2026/11/02/c... #CyberSecurity #CyberSecurityNews
  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-120283

Overview

  • Linksys
  • E8450
02 Nov 2026
Published
02 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 17 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-120283 – CRITICAL stack buffer overflow in Linksys E8450 v1.2.00.360516. Remote, unauthenticated RCE possible via /www/cgi-bin/portal.cgi (hidden_timezone). No patch from vendor. Restrict access ASAP. radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 17h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120283 | CVSS 10.0 Linksys E8450 Remote Stack Overflow CVE-2026-120283 affects Linksys E8450 firmware version 1.2.00.360516, according to the supplied NVD record. Full analysis: https://t.me/aiutocomputerhelp_lab/1357
  • 1
  • 0
  • 0
  • 17h ago

CVE-2026-120277

Overview

  • WAVLINK
  • WN536AX6-A
01 Nov 2026
Published
01 Nov 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 18 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-120277: CRITICAL OS command injection in WAVLINK WN536AX6-A (V260507_2.0.0). Remote attackers can execute OS commands – no patch yet. Restrict access & monitor for updates. Exploit code is public. radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 19h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-120277 | CVSS 10.0 Critical WAVLINK WireGuard CLI Injection CVE-2026-120277 affects WAVLINK WN536AX6-A running firmware V260507_2.0.0. Full analysis: https://t.me/aiutocomputerhelp_lab/1353
  • 1
  • 0
  • 0
  • 18h ago

CVE-2026-112816

Overview

  • Canonical
  • LXD
  • lxd
30 Oct 2026
Published
31 Oct 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
0.30%
KEV

Description

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

Statistics

  • 2 Posts
  • 3 Interactions
Last activity: 8 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Canonical fixes LXD vulnerability CVE-2026-112816 (CVSS 10) in LXD and MicroCloud, letting attackers impersonate trusted TLS clients. Update now.

securityonline.info/lxd-vulner

  • 0
  • 0
  • 0
  • 18h ago

Bluesky

Profile picture fallback
Tech Trending @tech-trending.bsky.social
CVE-2026-112816 | Ubuntu https://ubuntu.com/security/CVE-2026-112816
  • 1
  • 2
  • 0
  • 8h ago
Showing 1 to 10 of 119 CVEs