Pangram verdict · v3.3
We believe that this text is a mix of AI and human-written content.
AI likelihood · overall
MixedArticle text · 1,005 words · 12 segments analyzed
// live feedWhat's getting pwned right nowOngoing security incidents, newest first: CVEs, what's affected, which versions fix it, and the advisories and posts behind each one.live34critical15not fully patched17## 190 incidents in the last yearthrough Oct 22, 2026crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmoreGet an email when a new major security incident drops. No spam, unsubscribe any time.criticallivepatchedsince Oct 21, 2026updated Oct 22, 2026, 16:00 UTCGitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)› GitLab CE/EE (self-managed)GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab.
CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.CVE-2026-110264#Dev tools & CI#GitLab#RCEcriticalliveunpatchedsince Oct 21, 2026updated Oct 22, 2026, 16:20 UTCLinux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)› Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmetOn Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to [email protected] but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5.
No exploitation reported.
Only machines running ksmbd are exposed to the RCEs.#Linux#ksmbd#ZDI#RCEcriticallivepatchedsince Oct 21, 2026updated Oct 22, 2026, 16:00 UTCLiteLLM 1.107.0 PyPI/Docker supply-chain compromise› LiteLLM (PyPI + official Docker/GHCR images)On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.MAL-2026-2144#Python#PyPI#Docker#AI / LLM tooling#LiteLLM#Supply chainhighlivepartial fixsince Oct 21, 2026updated Oct 22, 2026, 15:59 UTCISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)› ISC BIND 9 (named) DNS serverISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named.
CVSS 8.1 (High).
No workaround.
Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26.
Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix.
ISC knows of no active exploitation.
Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.CVE-2026-94300#Linux#BIND#DNS#RCEhighlivepatchedsince Oct 21, 2026updated Oct 22, 2026, 11:18 UTCNode.js October 2026 security releases (Brotli RCE + TLS/DNS highs)› Node.jsOn Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.CVE-2026-111497CVE-2026-105482CVE-2026-105483CVE-2026-106069+6 more#Node.js#eMudhra#TLS#RCEhighlivepartial fixsince Oct 21, 2026updated Oct 22, 2026, 16:00 UTCRailway discloses unauthorized access to customer environment variables› Railway (hosted platform)On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.#Cloud & hosting#Railwaycriticallivepatchedsince Oct 20, 2026updated Oct 22, 2026, 15:19 UTCSignal calls can stay live after hang-up (RingRTC CVE-2026-113380)› Signal (RingRTC calling library, @signalapp/ringrtc)A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended.
Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0.
Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.CVE-2026-113380#Rust#npm#iOS#Android#SignalOct 20highEG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerabilitypatched› EG Secure Solutions SiteGuard Server Edition patchedEG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.open incident →CVE-2026-106931Oct 20highGMO Onamae Desktop Cloud malware on customer VPSpartial fix› Onamae Desktop Cloud (GMO Internet) partial fixGMO Internet’s Japanese VPS service Onamae Desktop Cloud said an attacker installed malicious programs in customer environments, forcing shutdown of as many as ~26,739 servers with no immediate restart date (mid-October 2026 reporting).Oct 20highSiemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerabilitypatched› Siemens Software Center patchedSiemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.