Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate

Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.

Security NEXTOctober 26, 2026Translated from Japanese

Read at source

Security NEXT has released its ranking of the ten most-read articles published on the site during the week of October 18–24, 2026. The list is dominated by vulnerability disclosures and security updates affecting widely deployed development and server software.

The top story reported a critical vulnerability in GitLab that received patches for both current and legacy branches. Second place went to multiple flaws in the nginx web server, three of which were rated critical. PHP appeared twice in the ranking with several serious vulnerabilities, including two remote-code-execution issues, prompting an update release and a U.S. government advisory recommending immediate remediation or offline operation if patching proved difficult.

Node.js issued a security update addressing ten vulnerabilities, one of which could allow remote code execution when processing Brotli-compressed data. U.S. authorities also issued alerts regarding active exploitation of vulnerabilities in Fortinet and BeyondTrust products. Google released Chrome 156, fixing 353 vulnerabilities including six rated critical.

The full top-ten list is as follows:

1. GitLab critical vulnerability – fixes also provided for older branches
2. Multiple vulnerabilities in nginx web server – three rated critical
3. Multiple serious vulnerabilities in PHP – fixed version scheduled for October 21
4. Node.js security update – release planned after October 21
5. Two serious RCE vulnerabilities in PHP – update released
6. U.S. authorities warn of exploitation of Fortinet and BeyondTrust vulnerabilities
7. Chrome 156 released, fixes 353 vulnerabilities including six critical
8. Ten vulnerabilities in Node.js – RCE risk via Brotli compression handling
9. U.S. authorities urge immediate patching of PHP vulnerabilities – take systems offline if necessary
10. PHP vulnerability showed signs in 2024 but remediation proved difficult – confusion before disclosure

All articles appeared on Security NEXT and were dated October 26, 2026.

Fortinet NGINX Chrome GitLab Node.js PHP BeyondTrust

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.

Security NEXTOct 29, 2026Translated from Japanese