Topics
cve
Google Patches Actively Exploited Chrome XML Use-After-Free (CVE-2026-125350)
Chrome 157.0.8103.50/.51 fixes CVE-2026-125350, a high-severity use-after-free in the XML component that Google says is already exploited in the wild; reported anonymously on November 6.
Zyxel GS1900 Patched Switches Stay Exposed: New Patch 3 Firmware Fixes It as CVE-2026-107441
Binarly found the June patch for an exploited Zyxel GS1900 switch flaw leaves the same pre-auth root RCE open; firmware 2.90 Patch 3, fixing it as CVE-2026-107441, is out for ten models after roughly 996 switches were looted.
Xen XSA-523: Grant Copy Flaws Let One VM Read and Write Any Other VM’s Memory
XSA-523: two grant-copy flaws (CVE-2026-102703/102704) let a malicious VM read and write other VMs’ memory including dom0 across Xen 4.6+; no mitigation, fixed upstream for 4.18–4.19 and via XCP-ng/Qubes builds.
APT Flaw (CVE-2026-109518) Lets On-Path Attacker Run Code as Root During Package Installs
A high-severity APT flaw (CVE-2026-109518, CVSS 7.7) lets an on-path attacker swap verified packages and run code as root on Debian 12+ and Ubuntu 22.04+ defaults. Fixed builds are out for all supported Ubuntu releases.
SSHole: OpenSSH Password Bypass Flaw Exploited Within Hours of Disclosure
OpenSSH flaw CVE-2026-123158 ("SSHole") lets an oversized password log into passwordless accounts on musl-based systems like Alpine. Exploitation began within hours of disclosure; update to 10.6p2 and restart sshd.
WordPress CVE-2026-119977: Patching an Exploited Updater Race Condition Can Briefly Reopen It
CVE-2026-119977 — a WordPress updater race now on CISA KEV — is fixed in 7.1.4 and branch backports to 4.7.39; the fixing update itself unpacks with old code, so block wp-content/upgrade access before patching.
CISA Adds SonicWall SonicOS SSL-VPN MFA Bypass (CVE-2026-19868) to KEV Catalog
SonicWall patched CVE-2026-19868 — an SSL-VPN flaw where an alternate authentication method slips past SAML and MFA; CISA added it to KEV on evidence of active exploitation.
PHP2Shell: Critical RCE Vulnerabilities in PHP Core
The PHP Group patched two critical core flaws (CVE-2026-109618, CVE-2026-109619, rated 9.2) that allow unauthenticated remote code execution; exploitation in the wild is confirmed and CISA urges immediate patching.
CVE-2024-3094: Critical RCE Vulnerability in XZ Utils
A critical supply chain compromise has been detected in XZ Utils versions 5.6.0 and 5.6.1, which may lead to remote code execution (RCE) via SSH authentication on affected distributions.