Posts

The Office Suite Installed the Webshell: Collabora CVE-2026-110447 and the Nextcloud Backdoors

The Cache Returns Shells: Next.js’s October Out-of-Band Fixes Two Unauthenticated RCEs and a Server Actions DoS

Vercel shipped Next.js 16.4.1 and 15.5.28 on 14 October 2026 with three advisories: an unauthenticated use-cache RCE, an Image Optimization SVG RCE via upstream librsvg CVE-2026-96889, and a Server Actions DoS. We read the Vercel advisory, the NVD record and the npm registry first-hand: the 15.x line can silently keep a vulnerable sharp, and the GHSA records were still absent from the global database at publication.

The Firewall Fetches Its Own Exploit: OPNsense’s GeoIP Importer Takes a Filename From the Feed

Five OPNsense CVE records landed at NVD on 15 October 2026, all patched on 1 July. The headline is CVE-2026-57155 (CVSS 9.9): the Firewall Alias GeoIP importer downloads a database from a user-supplied URL, unpacks it as root, and uses an unvalidated country_code column as the output filename. A delegated alias-editor becomes root via the default hourly newsyslog cron. The fix is a two-line length check.

Admin Was Supposed to Be the Ceiling: PAN-OS CVE-2026-0322 Turns Firewall Logins Into Root

Palo Alto Networks published CVE-2026-0322 on 14 October 2026: a code-injection flaw in the PAN-OS management interface that gives an authenticated attacker arbitrary code execution as root on the firewall. CVSS 4.0 8.6 with exploit maturity ATTACKED and urgency Red, found by an internal reporter, no workarounds, and in CISA KEV the same day with a 17 October deadline. The only vendor mitigation requires decrypting your own management traffic.

The Validator Trusted Exactly the Hosts It Should Have Feared: Portkey Gateway SSRF

NVD published CVE-2026-110719 against Portkey-AI/gateway on 14 October 2026. An unauthenticated caller can send /v1 requests with a crafted x-portkey-custom-host header and have the gateway call loopback and Docker-host services, because the default trusted-host set short-circuits before the SSRF blocks run. No fixed release exists.

The Config Came From the Internet: Four Renovate CVEs Turn Shared Presets Into a Policy Bypass

Four CVE records published 14 October 2026 cover Renovate, the dependency bot that reads configuration from repositories and runs package managers with your credentials. A shared preset could set env (LD_PRELOAD, NODE_OPTIONS) past allowedEnv, inject HTTP headers past allowedHeaders, point the HTTP client at the EC2 metadata service, and a rebase checkbox could skip minimumReleaseAge. Three advisories say Workarounds: None.

Six CVEs on the Box That Watches: Ubiquiti Patches the UniFi Protect AI Key

Ubiquiti Security Advisory Bulletin 070, published 14 October 2026, discloses six CVEs in the UniFi Protect AI Key — an unauthenticated command injection at 8.1, an access-control flaw at 8.6, and four more the vendor marks as chainable. Every record is CVSS PR:N. All six are credited to Andy Gill of ZephrSec, and the fixed firmware shipped before the bulletin did.

glob.os.system: The Module Nobody Blocked, and the Sandbox Rewrite That Followed

No Login, No Shell, No Trace: The Ivanti Zero-Day Chain That Ran as Root and Cleaned Up After Itself

Volexity disclosed on 13 October 2026 that an unknown actor, UTA0576, chained three Ivanti Connect Secure flaws — a welcome.cgi routing bypass, a wu.cgi file-write race, and a dsinvoked privilege escalation — to run commands as root on a fully patched 22.8R2.4 appliance from 3 October. CVE-2026-104935 (CVSS 8.6) covers the first two and was patched on disclosure day; the privilege escalation fix is weeks away. Stolen LAPS passwords, BitLocker keys, and Kerberoast material followed, with no web shell left behind.

A Tenant Annotation Decides Where Kubeflow’s Controller Sends Its Cluster Token

CVE-2026-110220, published to NVD on 13 October 2026 and scored 7.1 (CWE-918), lets any namespace tenant who can create a KServe InferenceService name the host that the Kubeflow Model Registry controller talks to — and the controller attaches its own Kubernetes ServiceAccount bearer token to that request. We read the chain first-hand at tag v0.3.17 and at main: the annotation is read unvalidated at controller.go:111, the token goes into the request context at :88-90, and the generated OpenAPI client adds the Authorization header at client.go:420-423. The shipped manifest binds the controller to a ClusterRoleBinding with patch and update on inferenceservices cluster-wide. v0.3.17 is the newest release. There is no fix.

Buffer Everything, Expire Nothing: Three New CVEs in the Official MCP Python and Java SDKs

CVE-2026-109527, CVE-2026-59951 (Python SDK) and CVE-2026-108395 (Java SDK) reached NVD on 14 October 2026: unauthenticated remote denial of service via unbounded request bodies and sessions that are never reclaimed. Fixes shipped in August and September; the CVE records arrived today.

1,413 CVEs in One Tuesday: Microsoft’s Record Patch Batch and the Mark-of-the-Web Zero-Day Already Being Exploited

Microsoft’s October 2026 Patch Tuesday fixed a record 1,413 CVEs — more than in all of 2025, pushing the 2026 total past 4,000 in a surge SecurityWeek attributes largely to AI. The exploited zero-day is CVE-2026-96951 (CVSS 8.8), a Windows Shell flaw that evades Mark-of-the-Web protections, reported by Fujitsu, Anthropic, and an independent researcher, and added to CISA KEV on 13 October with a 16 October federal deadline.

The Cookie Jar Goes to the Tool Server: Open WebUI’s Five-CVE 0.11.4 Batch Hands Your Authority to Everyone It Talks To

Five CVEs published 12 October 2026 against Open WebUI, all fixed in 0.11.4: CVE-2026-109292 forwards browser session cookies to third-party tool and terminal servers, CVE-2026-109572 lets any terminal user reach the admin Terminals API through the proxy, CVE-2026-109296 reaches disabled model backends by naming an index, and CVE-2026-109295/109298 turn model-invoked grep tools into event-loop stalls. Fix commits read first-hand.

One Annotation Beats Every Flag: Podman’s CVSS 10.0 Sandbox Bypass Was a 2022 Feature, Found by Claude

CVE-2026-94603 reached NVD on 13 October 2026 at CVSS 10.0: any OCI image carrying the io.podman.annotations.checkpoint.runtime.name annotation made podman run silently discard the operator’s own sandbox flags, including --cap-drop=ALL. The cause was a convenience feature merged in December 2022 and shipped in v4.4.0, whose early return skipped the function that applies user security options. The fix is a revert, a breaking change, and a green e2e test turned red. Credited to ADA Logics using Anthropic’s Claude models.

The Mapping Moved but the Cache Stayed: Vghost, the AI-Found vhost Flaw With a Root Exploit and a VM Escape

A Dot Is All You Need: Visual Studio Copilot Gets an 8.8 RCE via Trailing-Dot Path Bypass

The File Name Is the Argument: Eighteen Command-Injection CVEs in Nineteen Seconds, Nine With No Fix

VulnCheck published eighteen CWE-78 records between 15:16:59 and 15:17:18 UTC on 14 October 2026 — transcription wrappers, PDF and video converters, archive extractors — all the same bug: an attacker-controlled file name interpolated into a shell string. We read every record and all nineteen fix PRs: one researcher filed them, nine were merged, nine are still open, and two maintainers shipped fixes in the final hours before publication.

The Socket Is the Authorisation: Xoscar’s Actor Pool Unpickles Whatever Connects, and Xinference Ships It

CVE-2026-49950 reached NVD on 13 October 2026 at CVSS 4.0 9.3: Xorbits Xoscar’s actor-pool channel calls cloudpickle.loads on data from any peer that can open the socket, with no authentication and no message check before reconstruction. We read recv() and unpickle_buffers at v0.11.2 — there is no fixed version, no repository advisory, and Xinference 4.0.0 requires the library.

The Loop Runs Whatever the Model Asks: agno’s Fourth and Fifth CVEs

Retire the Lock, Skip the Cooldown: Ten CVEs Rebuild the BEAM Toolchain’s Threat Model in One Afternoon

On 12 October 2026 the Erlang Ecosystem Foundation CNA published ten CVEs against Hex, hex_core, rebar3 and Gleam in seven hours. One registry field reached three build tools in three languages and became a directory they delete. A second record turns the cooldown — the ecosystem’s own answer to compromised releases — off by retiring the release it protects.