Attackers stole Bitcoin and Litecoin from hot wallets on self-hosted BTCPay Server instances running 2.4.1 (released July 23, 2026) or earlier. BTCPay says they used a different method to exploit the vulnerability fixed in 2.4.2 (August 7) and logged in as an administrator on hit servers. It has seen no impact on servers already on 2.4.2 or later and no credible drain reports on the latest 2.4.7. Bitquery counted about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. Operators on 2.4.1 or earlier should sweep remaining hot-wallet funds to a new wallet with a new seed, move to a fresh server on the latest release, and rotate every credential the old server could reach, even if no theft was noticed. Wallets with spending keys held off the server were not affected.
2026-11-05: VulnCheck publishes CVE-2026-119757 (CVSS 3.1 9.8 / CVSS 4.0 9.3) for the issue fixed in 2.4.2: unauthenticated remote retrieval of LND .macaroon credential files, giving full control of the Lightning node and its funds. (source)
2026-11-03: Bitquery counts about $1.62M (18.38 BTC and 3,405 LTC) stolen across 682 sweeps, 87% of it on November 1, as reported by The Hacker News. (source)
2026-11-02: BTCPay publishes its investigation: attacks targeted 2.4.1 and earlier; operators on those versions should move to a fresh server with a new wallet and rotate credentials. (source)
On October 27 CISA published ICS advisory ICSA-26-300-01 for EPICS Base, the open source control-system toolkit used to run particle accelerators, fusion experiments and other large research facilities. EPICS Base 7.0.10 and earlier have four bugs in network message handling: CVE-2026-114595 (CVSS 3.1 9.8, critical), an integer overflow in network request processing that allocates memory with the wrong size and can lead to memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (8.2), an integer overflow from improper message length validation that causes an out-of-bounds write; CVE-2026-114597 (7.5), out-of-bounds reads from insufficient bounds checking; and CVE-2026-114598 (7.5), a type confusion that can cause denial of service and expose adjacent memory. Shubham Raj of Causal Security reported them, and The Register reports the company's autonomous AI agent Cipher found all four in under four hours. The EPICS community released EPICS Base 7.0.11 with the fixes; CISA's advisory does not mention exploitation. Update to 7.0.11 and keep EPICS networks isolated from untrusted access.
2026-10-28: SecurityWeek: Causal Security says all four bugs are reachable without authentication over Channel Access (TCP 5064) or pvAccess (TCP 5075). Its Cipher system demonstrated the out-of-bounds heap write and crash, but no working RCE exploit was built, and no exploitation has been reported to CISA. Maintainers were notified on June 9 and merged fixes in July and August. (source)
2026-10-27: The EPICS community releases EPICS Base 7.0.11 with the fixes. (source)
2026-10-27: CISA publishes ICSA-26-300-01 for EPICS Base, rating CVE-2026-114595 9.8 and the other three bugs 7.5 to 8.2, and tells users to update to 7.0.11. (source)
CVE-2026-109469 is an authorization bypass through a user-controlled key in Microsoft Entra Device Registration that Microsoft rates Critical with CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It lets an unauthorized attacker elevate privileges over a network against the Entra Device Registration service. Microsoft says the vulnerability has already been fully mitigated in the hosted service, customers need no action, and the CVE is published for transparency under Microsoft's cloud-service CVE program. Not known to be exploited or publicly disclosed before publication; Exploitation Less Likely per MSRC.
Fixed in
Entra Device Registration as mitigated by Microsoft (no customer action required; CVE for transparency)
2026-11-06: NVD lists CVE-2026-109469 as awaiting analysis with Microsoft's Critical 10.0 vector and exclusively-hosted-service tag. (source)
2026-11-05: Microsoft publishes CVE-2026-109469 for an Entra Device Registration elevation of privilege (Critical, CVSS 10.0); FAQ says the cloud service is already fully mitigated and customers need no action. (source)
Red Hat disclosed a flaw in Keycloak's SAML HTTP-Redirect binding (keycloak-services): the server accepts percent-encoded parameter names such as %53AMLResponse, while the signature check only looks at the literal parameter names. An unauthenticated attacker can use that mismatch to slip in a crafted, unsigned SAML message that Keycloak processes instead of the legitimately signed one, which leads to full takeover of federated user accounts. Red Hat rates it Important with a CVSS 3.1 score of 9.1 and lists the Red Hat Build of Keycloak as affected; Red Hat Single Sign-On 7 is not affected. Keycloak 26.8.2, released on Nov 5 2026, fixes it (the commit "Verify the SAML redirect binding message that is processed" closes CVE-2026-117691); Red Hat had not listed a fixed Red Hat Build of Keycloak release when the CVE was published. No exploitation has been reported.
2026-11-05: Red Hat publishes CVE-2026-117691 (CVSS 3.1 9.1, Important): percent-encoded parameter names skip SAML signature verification, allowing unsigned messages to be processed and federated accounts taken over. Red Hat says no mitigation currently meets its criteria; no fixed version is listed yet. (source)
2026-11-05: Keycloak 26.8.2 is released with the fix (the commit "Verify the SAML redirect binding message that is processed" closes CVE-2026-117691), alongside fixes for other SAML flaws including CVE-2026-110931 and CVE-2026-107602. (source)
2026-10-26: Mayssen Aidoudi (Think-it GmbH) reports the SAML redirect-binding signature bypass to Red Hat. (source)
Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2.
2026-11-06: NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint. (source)
NVD published four JupyterLab Desktop CVEs on 2026-11-06 for issues patched in the Jul 22 2026 v4.6.2-1 security release (first Desktop release in two years). Two are critical remote code execution: CVE-2026-102530 (CVSS 9.4) — unsanitized remote-server URLs in the Connect dialog / Welcome view enable XSS that abuses the privileged Electron IPC bridge; and CVE-2026-86044 (CVSS 9.6) — a MathJax link in an untrusted notebook plus a getServerInfo IPC leak lets one click hand the local Jupyter server token to an attacker site for RCE (requires JupyterLab < 4.4.8 in the managed environment). Two medium macOS-only TCC bypasses (CVE-2025-54991 / CVE-2025-55002, CVSS 5.5) need existing local code execution. Affected: Desktop <= v4.2.5-1. Upgrade to 4.6.2-1.
Fixed in
JupyterLab Desktop 4.6.2-1, Partial workaround for CVE-2026-86044: upgrade JupyterLab in-environment to >= 4.4.8
2026-11-06: NVD receives CVE-2026-102530 (CVSS 9.4), CVE-2026-86044 (CVSS 9.6), CVE-2025-54991 and CVE-2025-55002 (both CVSS 5.5) from security-advisories@github.com, linking the Jul 2026 Desktop security release. (source)
2026-07-24: GitHub Security Advisories published for the four Desktop issues (CVE assignment noted as pending at the time for the two critical RCE advisories). (source)
2026-07-22: JupyterLab Desktop v4.6.2-1 released with patches for GHSA-vrj4-r4fw-9rfh (XSS→RCE via Connect URL), GHSA-2mr8-962v-wc67 (one-click token leak→RCE), GHSA-8cvf-4977-r95v (CVE-2025-54991 TCC), and GHSA-5c3f-5gj7-p9xh (CVE-2025-55002 TCC). (source)
On Nov 6 2026 Canonical published a wave of critical LXD advisories (CVSS 9.9) for host escapes. Already tracked: GHSA-jpf8-86f3-wp38 / CVE-2026-48752 (templates/ symlink AFRW) and GHSA-9j25-mm2h-2f76 / CVE-2026-48750 (exec-output symlink AFW). Same-day additions: GHSA-vghh-5rfx-xhq8 / CVE-2026-48749 (rootfs/ symlink AFRW in a crafted image); GHSA-pjff-c2wc-f6jm / CVE-2026-48769 (arbitrary file write via trusted Incus-Image-Hash path traversal on source.type=url downloads); GHSA-fmc8-p6q7-75cc / CVE-2026-48755 (backup compression_algorithm argument injection leading to AFW/ACE). All were reported from the Incus fork. Fixes are in the github.com/canonical/lxd Go module; upgrade to fixed builds that include the advisory commits / firstPatched versions. Also folded GHSA-47w9-6r3f-938g / CVE-2026-48751: instance snapshots ignore `restricted.containers.lowlevel=block`, allowing abuse of raw.lxc / raw.qemu hooks for host ACE after moving a crafted snapshot into a restricted project; LXD >= 4.12 affected; patched in 6.9 / 5.21.5 / 5.0.7 (reported from Incus GHSA-48q5-w887-33wv; originally published Jun 26 2026, resurfaced in the Nov 6 critical GHSA wave). Further folded high-severity project-restriction bypasses GHSA-7mr3-28h5-m5vx (custom volume copy across projects) and GHSA-qx75-2p3r-pwm5 (instance copy across projects): authenticated caller knowing source project/volume or instance names can copy secrets they should not view; LXD >= 4.12; patched in 5.0.7 / 5.21.5 / 6.8 (note 6.8, not only 6.9); GHSA firstPatched Go module 0.0.0-20260630083100-c5184be310b1; reported from Incus GHSA-64f3-v33m-w89f and GHSA-c9f5-j9c3-mhrg; no CVE IDs assigned on the GitHub Advisory records as of this fold.
Fixed in
github.com/canonical/lxd 0.0.0-20260203144152-d1c8ba15d160 or later (templates/ fix per GHSA-jpf8-86f3-wp38), github.com/canonical/lxd 0.0.0-20260626085134-124f90100640 or later (exec-output fix per GHSA-9j25-mm2h-2f76), github.com/canonical/lxd 0.0.0-20260630083100-c5184be310b1 or later (GHSA-vghh-5rfx-xhq8 / GHSA-pjff-c2wc-f6jm / GHSA-fmc8-p6q7-75cc / GHSA-47w9-6r3f-938g / GHSA-7mr3-28h5-m5vx / GHSA-qx75-2p3r-pwm5), lxd-5.21.5 referenced by GHSA-9j25-mm2h-2f76; upgrade to fixed LXD releases that include the advisory commits, LXD 6.9, 5.21.5, 5.0.7 (GHSA-47w9-6r3f-938g / CVE-2026-48751 restricted project bypass), LXD 6.8, 5.21.5, 5.0.7 (GHSA-7mr3-28h5-m5vx / GHSA-qx75-2p3r-pwm5 project restriction bypasses; note 6.8 for these High advisories)
2026-11-06: Canonical publishes GHSA-9j25-mm2h-2f76 (CVE-2026-48750): arbitrary file write on host via exec-output symlink in a crafted image; CVSS 9.9; firstPatched Go module 0.0.0-20260626085134-124f90100640; references lxd-5.21.5 and Incus GHSA-73hr-m85f-64v9. (source)
2026-11-06: Canonical publishes GHSA-jpf8-86f3-wp38 (CVE-2026-48752): arbitrary file read+write on host via templates/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260203144152-d1c8ba15d160; reported from Incus GHSA-vxp5-584q-c479. (source)
2026-11-06: Canonical publishes GHSA-vghh-5rfx-xhq8 (CVE-2026-48749): host AFRW via rootfs/ symlink in a malicious image; CVSS 9.9; firstPatched Go module 0.0.0-20260630083100-c5184be310b1. (source)
A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker run code by getting an application to open a single crafted file with Image.open(). Pillow detects FPX files by their OLE2 content, not their extension, so any service that opens or thumbnails untrusted uploads with the optional olefile package installed can be hit with no user interaction. The advisory includes a working proof of concept (shown on Pillow 12.2.0 with ASLR disabled). Pillow 12.3.0 and earlier are affected; upgrade to 13.0.0. GitHub rates it critical (CVSS 4.0 score 9.2). The same 13.0.0 release (Oct 16) also fixes other critical bugs: CVE-2026-112900, where an EPS filename starting with - or @ is passed to Ghostscript as an option and can lead to code execution (2.6.0 through 12.3.0); CVE-2026-112393, a heap overflow when saving TIFF to BytesIO (public reproducer); and CVE-2026-112403, a JPEG heap overflow with draft()/thumbnail() on libjpeg-turbo 3.x builds.
2026-10-23: Pillow publishes GHSA-5x8w-8jj5-q52h (CVE-2026-112398) with a proof of concept; the fix ships in Pillow 13.0.0. (source)
2026-10-23: GitHub publishes GHSA-w889-685w-c8fh (CVE-2026-112900): attacker-controlled EPS filenames beginning with - or @ are parsed as Ghostscript options, potentially RCE even with -dSAFER; fixed in 13.0.0. (source)
2026-10-16: Pillow 13.0.0 is released with fixes for several critical bugs, including CVE-2026-112900 (Ghostscript argument injection via EPS filenames), CVE-2026-112393 (TIFF save to BytesIO heap overflow) and CVE-2026-112403 (JPEG draft-scale heap overflow). (source)
Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.
2026-10-30: Rapid7 merges a Metasploit exploit module for CVE-2026-97229 (GitLab RCE via the CI Lint endpoint), making a ready-made public exploit available. Patch GitLab and, for self-built installs, Ruby now. (source)
2026-10-29: CISA adds CVE-2026-97229 (GitLab CE/EE integer overflow or wraparound) to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. GitLab 19.4.2, 19.3.5 and 19.2.8 or later fix it. (source)
2026-10-29: Alpine Linux reopens its GitLab, upgraded to 19.3.7 after the rebuild; users must set a new password and accept new SSH host key fingerprints. (source)
INCIBE-CERT coordinated disclosure of seven vulnerabilities in TPC Software's MatchPoint sports-facility management platform (INCIBE-2026-841, posted 2026-11-05). Three are critical: CVE-2026-111489 (CVSS v4 9.9) — a static credential embedded in the mobile app that returns an 'autorizado' token granting unauthenticated API access; CVE-2026-111490 (CVSS v4 9.9) — IDOR via the actingasuser HTTP header letting attackers reach personal, banking, and financial data, private messages, physical-access QR codes, and perform account takeover / balance transfers; CVE-2026-111494 (CVSS v4 9.1) — Android TrustManager accepts any TLS certificate and the app allows cleartext HTTP. Also high: local SQLi in the FCM push handler (CVE-2026-111492) and unauthenticated Images.ashx profile-photo enumeration (CVE-2026-111493). Medium: plaintext credentials in SQLite/SharedPreferences (CVE-2026-111491) and embedded APK config/keys (CVE-2026-111495). Vendor has already deployed server fixes for CVE-2026-111490 and CVE-2026-111493; INCIBE says install the latest app version for the rest. Reported by Sergi García Tárraga. No known exploitation stated in the advisory.
Fixed in
Server-side fixes for CVE-2026-111490 and CVE-2026-111493 already deployed by the vendor (apply regardless of app version), Latest available MatchPoint app version for the remaining CVEs (per INCIBE)
2026-11-05: INCIBE-CERT publishes INCIBE-2026-841 coordinating disclosure of seven MatchPoint (TPC Software) flaws: three critical (CVE-2026-111489 static mobile-app credential → 'autorizado' API token; CVE-2026-111490 IDOR via actingasuser header exposing personal/banking data and account takeover; CVE-2026-111494 Android TLS TrustManager accepts any cert / allows HTTP), plus high SQLi and unauth Images.ashx photo enum and medium plaintext-credential / embedded-config issues. Server fixes for CVE-2026-111490 and CVE-2026-111493 already deployed; remaining issues need the latest app version. Reported by Sergi García Tárraga. (source)
Apache OFBiz 24.09.08 fixes 46 vulnerabilities in every earlier release, several of them critical. Unauthenticated attackers can run code on the server through login-page widget injection (CVE-2026-83542), attacker-controlled Screen definition loading (CVE-2026-68524) and a saved-view authorization bypass (CVE-2026-73578). They can also take over a full user session by replaying a captured externalLoginKey (CVE-2026-82907). On 24.09.06 and 24.09.07 deployments upgraded from older releases, a forged JWT signed with the old default key gives admin access (CVE-2026-105330). The batch also includes a password-reset account takeover, a REST auth bypass when the auth attribute is omitted, SQL injection, XXE, SSRF and many missing-authorization bugs. No exploitation has been reported, but older OFBiz bugs have been exploited in the wild.
2026-11-05: CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important. (source)
2026-11-04: Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08. (source)
NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets.
2026-11-06: NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches. (source)
2026-09-06: GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure). (source)
2026-07-19: Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards. (source)
A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5).
Fixed in
EDK II master at fa78907 (PR #13302, no stable tag yet), Fedora edk2 20260812-6 (fix backported)
2026-10-28: Hetzner posts a status notice on CVE-2026-97631: an official patch isn't available yet, running systems aren't directly at risk, and it recommends avoiding reboots of hosts that use PXE boot until further notice while it analyzes its environment. (source)
2026-10-27: Ars Technica reports the bug affects firmware from most server vendors. The finders had planned a coordinated disclosure in January, but the public fix broke the embargo. Intel says none of its supported commercial products are known to be affected; Arm says it isn't directly applicable to its portfolio. (source)
2026-10-26: Fedora backports the fix into edk2 20260812-6 (updates-testing). Debian still lists its edk2 packages as vulnerable. (source)
A critical (CVSS 9.8) flaw in Rails Active Storage lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file, and, when attachments use the Disk service, read any file the app can read, including secret_key_base and credentials for other systems, which may lead to remote code execution. Active Storage put no limits on which ImageMagick coders an upload could reach, and its ImageMagick analyzer runs on attach, so simply attaching the upload is enough; the reported chain used an SVG reaching the MSL scripting coder. Apps are affected if they use ImageMagick for Active Storage (variant_processor :mini_magick, the default for load_defaults 6.1 or earlier), run a host ImageMagick policy that doesn't block those coders (Debian and Ubuntu's policies don't), and accept untrusted uploads. Fixed in activestorage 8.1.4.1 and 8.0.5.2, which ship a restrictive ImageMagick policy and need mini_magick 5.1 or later; series before 8.0 get no fix. No CVE yet; the advisory does not say whether it has been exploited.
Fixed in
activestorage 8.1.4.1, activestorage 8.0.5.2 (requires mini_magick >= 5.1 when using :mini_magick), Rails before 8.0: no fix; copy the shipped policy.xml rules (deny MSL, Ghostscript coders and the gs delegate) into the system ImageMagick policy
Latest updates (3)
2026-11-06: Socket publishes a free Certified Patch for GHSA-f3w6-w445-fwh9 as an interim remediation while teams upgrade to Rails 8.1.4.1 or 8.0.5.2; does not cover the other November 4 Rails security fixes. (source)
2026-11-04: Rails publishes GHSA-f3w6-w445-fwh9 (critical, CVSS 9.8) and releases Rails 8.1.4.1 and 8.0.5.2, which ship an ImageMagick security policy; reported via HackerOne by RyotaK (GMO Flatt Security). (source)
2026-11-04: The Hacker News reports the flaw; the same releases fix a second Active Storage issue, GHSA-v924-7rp8-4mxh (high, CVSS 8.8), and 21 security issues in total. (source)
Alpine Linux warned that sshd built without PAM can be logged into without a password. On those builds sshd checks a password by running crypt() and comparing the result to the stored password field, borrowing another account's salt when the stored field has none. musl's crypt() returns "*" as an error when the password is longer than 256 bytes, and "*" is exactly what the stored field holds for accounts with no password, so the comparison matches. An attacker who can reach the SSH port and knows the name of such an account can log in with one connection by sending a 257 to 1024 byte password, as long as the machine has at least one other account with a $5$ or $6$ hash. Affected setups are Alpine's openssh-server package (or openssh-server-pam with UsePAM no) with PasswordAuthentication yes, on every release Alpine checked from 3.16 through 3.24 and edge. OpenSSH released 10.6p2 on Nov 5 2026 to avoid the bug in sshd, and Alpine shipped fixed packages for 3.16 to 3.24 and edge. The bug was assigned CVE-2026-123158 later the same day. On Nov 6 2026 Previdian reported successful root access on an Alpine/OpenSSH honeypot within about nine hours of CVE publication (reconnaissance from 89.116.89.18), and watchTowr said it was observing botnet and crypto-miner exploitation.
2026-11-06: SecurityWeek covers OpenSSH's emergency SSHole patches (CVE-2026-123158) and quotes Damien Miller on rushing the release because AI agents have been rediscovering bugs within hours. (source)
2026-11-06: Help Net Security reports Previdian observed exploitation of CVE-2026-123158 less than nine hours after CVE publication, including confirmed successful root access on an Alpine Linux OpenSSH honeypot and reconnaissance commands from 89.116.89.18; CISA has not added the CVE to KEV. (source)
2026-11-06: watchTowr says its Intel feed is observing SSHole (CVE-2026-123158) exploitation, so far attributed to botnets and crypto miners. (source)
On October 25 the Atlantis project (the Terraform pull request automation server) released v0.49.0 and published 12 GitHub security advisories fixed in it. The worst, GHSA-6mjf-4m52-m5cq (CVSS 9.8, critical), comes from Atlantis checking only the path of a pull request's clone URL and not its host, while trusting the head repository name from the webhook body: a forged webhook can point Atlantis at an attacker's git server, pass the --allow-fork-prs=false gate and --repo-allowlist, and have Atlantis fetch and plan a Terraform tree the attacker controls. Servers without a GitHub webhook secret accept that forged webhook from anyone without authentication. Other fixes cover a Gitea dismissed-approval bypass of apply_requirements (GHSA-fm5f-jg8p-x2vw, 8.8), an allowed_workflows allow-list bypass in multi-project atlantis.yaml files (GHSA-56q6-8vmp-v2qm, 8.2), a plan-hijack apply-approval bypass (GHSA-5vwh-xc92-8h64), a pull request symlink that makes Terraform run outside the checkout (GHSA-9q39-mgw7-5789), unauthenticated lock metadata on /api/locks (GHSA-xgrg-fpp6-q6fm), timing attacks on Basic Auth and API secrets plus path traversal on /api/plan and /api/apply, an arbitrary file read via --var-file, secrets leaking into PR comments when output hiding errors, and a CSRF in the GitHub App setup callback. The advisories do not mention exploitation. v0.49.0 is a breaking release: GitHub and GHES webhooks whose clone URL host differs from --gh-hostname are now rejected, and the Docker images no longer bundle Terraform or OpenTofu. Anyone upgrading from v0.47.0 or earlier also picks up the v0.47.1 fix for CVE-2026-116676, a PR-controlled workspace name that was passed unquoted into a shell command. Upgrade to 0.49.0 and set a GitHub webhook secret.
Fixed in
Atlantis 0.49.0, Atlantis 0.47.1 for CVE-2026-116676
2026-10-25: Atlantis releases v0.49.0, a breaking release that fixes 12 security advisories, led by the critical forged-webhook fork-protection bypass GHSA-6mjf-4m52-m5cq. (source)
2026-08-25: Atlantis publishes GHSA-rjh2-4xgw-p2hj, a shell command injection through a PR-controlled Terraform workspace name, fixed in 0.47.1 and now tracked as CVE-2026-116676. (source)
A remote code execution vulnerability exists in the Field UI module in Drupal core. It isn't directly exploitable with core alone, but the Drupal Security Team says multiple serious exploit paths exist with contributed modules, at least one without authentication, and custom code may also expose it. Rated Critical (19/25). Update to Drupal 11.4.10, 11.3.19 or 10.6.19; uninstalling the core Field UI module (field_ui) mitigates it until then.
2026-10-14: Drupal Security Team publishes SA-CORE-2026-014: Critical RCE in the core Field UI module, fixed in 10.6.19, 11.3.19 and 11.4.10; uninstalling field_ui mitigates. (source)
imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895.
Puppet by Perforce and the OpenVox fork released coordinated fixes on Nov 3 2026 for two critical bugs found by Neodyme that affect all known Puppet and OpenVox versions, going back at least to open-source Puppet 6.24.0 from July 2021. CVE-2026-115731 lets any client holding a CA-signed agent certificate run arbitrary code on the Puppet/OpenVox server as its service user by submitting a report with a crafted rich-data event, because the event is deserialized into Ruby code. CVE-2026-115732 is a flaw in trapperkeeper-authorization's certificate-name matching that lets a certificate such as evil.target.example.com be authorized as target.example.com, exposing that node's catalog and secrets, and in Puppet Enterprise it can lead to CA administration and commands on managed nodes. Where the CA autosigns certificate requests without strong verification, an unauthenticated attacker can get the certificate both bugs need. Neodyme's writeup shows the server RCE being used to steal the CA signing key and run commands as root on managed agents. Upgrade OpenVox to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0 and openvoxdb 8.18.0 or 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 (Puppet Core 9.1.3, Puppet Server 9.0.24.1), then restart the server. OpenVox says open-source Puppet will not get security updates and recommends migrating.
2026-11-03: OpenVox publishes critical advisories GHSA-ffr6-rwpm-p5wq (server RCE via report event deserialization) and GHSA-q4hm-33rc-572g (client impersonation via flawed hostname check) and releases fixed agent, server and OpenVoxDB versions, coordinated with Puppet by Perforce. (source)
2026-11-03: CVE-2026-115731 and CVE-2026-115732 are published; Puppet ships Puppet Server 9.0.24.1 with Puppet Core 9.1.3 patched for both. (source)
2026-11-03: Neodyme publishes its technical writeup, showing the RCE works back to Puppet 6.24.0 and can be chained to steal the CA key and run commands as root on managed agents in Puppet Enterprise. (source)
Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops. Fly.io published an Oct 16 2026 postmortem of a ~10-hour fleet-wide host reboot after the CVE, saying customer data exposure was unlikely but advising rotation of credentials sent over HTTP or unencrypted 6PN between Oct 15 and 17.
Fixed in
Upstream commit 6785011f8b16 and matching stable backports; vendor kernels as listed by distros
2026-10-16: Fly.io begins an emergency fleet-wide host reboot for CVE-2026-99999 (PwnEscape), completing the patched-kernel rollout in about 10 hours; later postmortem says customer data exposure was unlikely but advises rotating credentials sent over HTTP or unencrypted 6PN Oct 15–17. (source)
Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes.
2026-11-04: CVE-2026-121802 is published and GitHub's advisory database lists it as critical (CVSS 9.1). (source)
2026-11-03: Better Auth publishes GHSA-4wq4-2ppv-q3hg and releases 1.7.16 and 1.8.0-beta.5, fixing the Expo authorization proxy signing, an open redirect and loose wildcard trusted-origin matching; it tells users to rotate the application secret after upgrading. (source)
Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).
Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.
2026-10-28: SecurityWeek covers FoxIO's findings; FoxIO has released proof-of-concept code and fingerprints for spotting internet-facing GoAhead servers and their TLS library, and stresses that device fixes depend on each manufacturer. (source)
2026-10-26: FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated. (source)
2026-10-12: Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection. (source)
Laravel's built-in TokenGuard, when configured as a standard token-based API guard, can be bypassed to log in as an arbitrary existing user without their API token. On some database configurations (MySQL/MariaDB), a crafted non-string credential is mishandled during the lookup so the query matches an unintended user instead of failing. An unauthenticated attacker can take over accounts on any route protected by that guard. Upgrade laravel/framework to 12.68.0 or 13.29.0. GitHub rates it critical (CVSS 4.0 score 9.2).
Self-managed Airbyte before 2.2.0 let Connector Builder / Manifest Server load unintended Python classes from a declarative manifest custom component, even when AIRBYTE_ENABLE_UNSAFE_CODE was off, so a user who could submit a test-read manifest could run commands inside those containers. On Airbyte 2.x that needs Workspace Reader or Organization Reader (or higher); on Airbyte 1.x with the legacy Helm chart the Connector Builder ignored global.auth.enabled, so anyone who could reach that service could exploit it unauthenticated. Successful exploitation may expose credentials and secrets in the container and reach internal services. Fixed in Airbyte 2.2.0 (manifest-server 7.23.7); Airbyte 1.x will not get a fix and should upgrade to 2.2.0+. Airbyte Cloud is not affected. JVN#12040144 (published Nov 4 2026) states the flaw has been confirmed exploited in the wild. Workarounds until you upgrade: restrict network access to Connector Builder / Manifest Server to the Airbyte server only, and limit Reader roles to trusted users.
2026-11-04: JVN#12040144 publishes the Airbyte arbitrary code execution issue and states the vulnerability has been confirmed to be exploited in the wild; upgrade self-managed deployments to the latest version. (source)
2026-10-17: Airbyte publishes GHSA-g35w-6r6v-h4r7 describing Connector Builder / Manifest Server arbitrary command execution via unrestricted custom-component class loading, fixed in 2.2.0; Airbyte 1.x will not receive a fix. (source)
2026-08-10: Airbyte 2.2.0 is released for self-managed deployments, shipping manifest-server 7.23.7 and rejecting Connector Builder custom components unless AIRBYTE_ENABLE_UNSAFE_CODE=true. (source)
