CVSSv4.0

Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL

Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophos’s bug bounty program by an external researcher.

Critical CVE-2026-111497 Out-of-Bounds Write Flaw in Google Brotli Decoder Impacts Broad Range of Environments

A severe vulnerability has been identified in the Google-developed Brotli decoder used for decompressing data in web communications and other applications. The flaw, tracked as CVE-2026-111497, allows out-of-bounds writes when processing specially crafted compressed data, potentially enabling arbitrary code execution, information disclosure, or denial of service. It carries a CVSS v4.0 base score of 9.2 and is rated Critical. Google has released patched versions 1.2.1, 1.1.1, and 1.0.10 of the library. Node.js incorporated the fix in its updates, while Microsoft issued an out-of-band patch for .NET on October 25, 2026, to address the issue. The vulnerability affects any environment relying on the Brotli C implementation for data decompression.

Two Critical RCE Vulnerabilities Patched in PHP with CVSS 9.2 Scores

The PHP development team has disclosed two severe remote code execution vulnerabilities affecting the widely used scripting language. Both issues, tracked as CVE-2026-109618 and CVE-2026-109619, received a CVSSv4.0 base score of 9.2 and were rated Critical. The flaws stem from improper memory handling during request processing and cleanup phases. Exploitation could allow attackers to execute arbitrary code by manipulating uninitialized or residual data in worker processes. Security updates addressing both vulnerabilities were released on October 21, 2026, and users are strongly urged to apply the patches immediately. The advisories were previewed the previous day, highlighting the urgency of the fixes.

Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21

The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.

Multiple Vulnerabilities Found in nginx Web Server, Three Rated Critical by F5

F5 disclosed an out-of-band security advisory on October 14, 2026, revealing a total of 11 vulnerabilities across nginx and related products. Five issues affect the core open-source nginx server while six more impact associated offerings including NGINX Gateway Fabric and NGINX Ingress Controller. The flaws can lead to denial of service, remote code execution, authentication bypass, and sensitive information disclosure. Although the official nginx project rates all five core vulnerabilities as Medium severity, F5 assigns a CVSS v4.0 base score of 9.2 to three of them, classifying them as Critical. One example is CVE-2026-15176, a heap buffer overflow in the ngx_http_core_module that triggers under specific URL rewrite and file-path configuration settings.

Palo Alto Networks Discloses Seven PAN-OS Vulnerabilities Including One Already Exploited in the Wild

Palo Alto Networks has published seven security advisories addressing vulnerabilities in its PAN-OS operating system used on PA-series and VM-series firewalls as well as the Panorama management platform. One flaw tracked as CVE-2026-0322 allows authenticated remote code execution with root privileges through the management interface and has already been observed in limited exploitation attempts. The company rated the issue with a CVSS v4.0 base score of 8.6 and assigned it the highest remediation priority. Four additional medium-severity issues and two low-severity issues were also fixed in the same set of advisories. Products such as Cloud NGFW and Prisma Access are confirmed to be unaffected. Palo Alto Networks urges immediate patching for all impacted PAN-OS deployments.

Critical CVE-2026-21589 Affects Eight Atlassian Products with CVSS 9.3 Score

Atlassian has disclosed a critical vulnerability tracked as CVE-2026-21589 that impacts eight of its products. The flaw allows unauthenticated access to specific files located in the web application's root directory when an attacker already knows the file name and path. Products affected include Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian rates the issue Critical with a CVSSv4.0 base score of 9.3 and warns that Data Center editions face elevated risk due to potential exposure of sensitive files. The company released patches for all affected products and urges immediate updates, while also providing mitigation steps and indicators of compromise for organizations unable to patch right away.

ServiceNow AI Platform Affected by Five Vulnerabilities Including Critical SQL Injection Flaws

ServiceNow disclosed five vulnerabilities in its AI Platform on September 24, 2026, through a security advisory. Two of the issues received CVSS v4.0 base scores of 9.3 and were rated Critical. CVE-2026-13016 allows unauthenticated remote attackers to perform SQL injection and manipulate database contents under specific conditions. CVE-2026-86860 stems from improper authorization checks that enable data exfiltration and privilege escalation without authentication. The flaws were identified via internal testing, coordinated disclosure, and the company's bug bounty program. ServiceNow urges customers to apply the provided updates immediately to mitigate the risks.

F5 BIG-IP APM Vulnerability CVE-2026-94127 Allows Remote Code Execution, Already Exploited in the Wild

F5 has disclosed a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager that is already being actively exploited. The flaw, tracked as CVE-2026-94127, affects systems configured as an OAuth authorization server with both an access policy and OAuth profile applied to a virtual server. Successful exploitation can result in arbitrary code execution from crafted network traffic. The issue also impacts appliance mode configurations. F5 rates the vulnerability 9.3 under CVSS v4.0 and 9.8 under CVSS v3.1, classifying it as Critical. The company discovered the flaw internally and has confirmed real-world exploitation, urging immediate patching and compromise assessment.

WordPress 7.0.3 Addresses 12 Vulnerabilities Including Reflected XSS Leading to PHP Execution

WordPress has released version 7.0.3 to fix multiple security issues discovered in the content management system. The update, announced on August 6, 2026, resolves 12 vulnerabilities covering cross-site scripting, privilege escalation, information disclosure, and server-side request forgery. One issue tracked as CVE-2026-64638 is a reflected XSS flaw on the login page that can be exploited without authentication. Under specific conditions the vulnerability allows an attacker to execute PHP code on the affected site. The flaw received a CVSS v4.0 base score of 8.9 and is rated High severity. Administrators are urged to apply the update immediately.