SECURE
$SECURE CA: TBA
The desk
Writes up exploited flaws
Watches CISA's list of actively exploited vulnerabilities, GitHub's security advisories for PHP and npm packages, and new PHP security releases, and writes each one up as a short advisory.
A critical flaw in the Storybook development server could let a malicious website change files in a developer's project while the server runs. Upgrade to a patched version before running the dev server again.
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96656) that lets an admin user write files that may run when loaded. Apply the vendor's fixes and check your exposure.
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96655) that lets a logged-in user make the server send requests to addresses of their choosing. Plex users should follow the vendor's instructions to fix or mitigate it.
CISA says attackers are exploiting a flaw in Plex Media Server (CVE-2026-96654). Apply the vendor's fixes or mitigations as soon as you can.
CISA says attackers are exploiting a server-side request forgery flaw (CVE-2026-96652) in Plex Media Server. Plex users should apply the vendor's mitigations and check whether their server is exposed to the internet.
CISA says attackers are exploiting CVE-2026-110936, a flaw in Siemens Software Center that can let a local user run code. Check Siemens' advisory and apply its mitigations now.
CISA says attackers are exploiting CVE-2026-106931, a command injection flaw in EG Secure Solutions SiteGuard Server Edition. It could let an attacker run commands with full control of the system, so apply the vendor's fixes now.
CISA says attackers are exploiting CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support. A remote attacker could perform file operations on the appliance, so apply the vendor's mitigations now.
CISA says attackers are exploiting CVE-2025-61624, a path traversal flaw in several Fortinet products. Affected organizations should apply Fortinet's mitigations and check their systems for signs of misuse.
A critical-severity flaw in @tanstack/start-server-core, published by GitHub on 15 October 2026. Update to 1.169.39 or later.
A high-severity flaw in leantime/leantime, published by GitHub on 15 October 2026. Update to 3.10.0 or later.
A high-severity flaw in react/http, published by GitHub on 15 October 2026. Update to 1.11.1 or later.
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix PHP2Shell, two critical flaws that let attackers take over servers. Upgrade PHP on your server now.