Vulnerabilities and CVEs

02:00 Patch

Brotli2Shell: Beyond Node(2Shell) and HTTP(2Shell)

CVE-2026-111497JFrog Security Research

00:29 Patch

CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input

CVE-2025-60493oss-security

00:27 Patch

PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)

CVE-2026-109618CVE-2026-109619oss-security

00:25 Vulnerability

Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)

CVE-2026-107080oss-security

00:23 Patch

CVE-2026-111813 etc: Multiple vulnerabilities in Apache Traffic Server prior to 9.2.16/10.1.5/10.2.1

CVE-2026-111813oss-security

00:00 Patch

DSA-6585-1 thunderbird - security update

Debian Security

00:00 Patch

DSA-6584-1 varnish - security update

Debian Security

20:58 Vulnerability

Pierluigi Paganini answers questions about the PHP2Shell flaws

Security Affairs

18:53 Exploited

U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

18:15 Vulnerability

[oss-security][CVE-2026-115557] Distrust compromised intermediate certificates in Python ssl module

CVE-2026-115557oss-security

17:30 Vulnerability

PHP-ocalypse: How two critical web bugs almost broke the internet

TechCrunch

16:17 Vulnerability

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

BleepingComputer

15:56 Vulnerability

CVE-2026-114629: Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters

CVE-2026-114629oss-security

14:19 Patch

Re: Upcoming Node.js security release 2026/10/21

oss-security

13:54 Vulnerability

Re: eMudhra Intermediates Compromise

oss-security

11:22 Patch

jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions

oss-security

10:45 Vulnerability

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

CVE-2026-111497The Hacker News

10:30 Exploited

U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

08:25 Exploited

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

CVE-2026-110447The Hacker News

00:29 Vulnerability

CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder

CVE-2026-115936oss-security