Serial number: AV26-1067 Date: October 20, 2026 As of October 19, 2026, Craft CMS is affected by vulnerabilities in the following product: Craft CMS Prior to 4.18.8 Prior to 5.11.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Read the full article at Canadian Centre for Cyber Security →
Source attribution: headline and facts are from Canadian Centre for Cyber Security (cyber.gc.ca). Summary method: excerpt of the source description. See our source attribution policy.
Eight max-severity security defects could lead to remote code execution and authentication bypass.
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere.
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could…
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four…
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.