The Textpattern CMS project released Textpattern 4.9.2 on 2 November 2026 as a patch release with security fixes, and says versions before 4.9.2 are affected unless stated. The issues, reported by third-party researchers, are: an authentication issue with concurrent logins and cookies; content sandboxing of preview frames (with a new admin-side Content Security Policy layer); unsanitised 'sort' attributes in the authors and file_download tags; inconsistent sanitising of the 'url_title' attribute; a user-privilege cross-site request forgery mitigated with CSP; cross-site request forgery in the theme import workflow; missing validation of administrative user status on the Users panel; and an arbitrary file write through XML-RPC, which the project links to CVE-2026-5344. The project gives no severity ratings and says it will update the post with CVE assignments. (source: Textpattern)
Textpattern — Textpattern 4.9.2 released: security fixes, patches and tweaks (2 Nov 2026)
Google published the Android Security Bulletin for November 2026 on 2 November 2026. It lists 208 vulnerabilities across two security patch levels: 113 at 2026-11-01 (Android runtime, Framework and System) and 95 at 2026-11-05 (kernel components and Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components), and says devices on patch level 2026-11-05 or later are protected against all of them. Google says the most severe is a Critical flaw in the Framework component that could lead to remote code execution with no additional execution privileges and no user interaction; that entry is CVE-2026-58868 (Android 14 to 17). Of the 208, 23 are rated Critical: at 2026-11-01, CVE-2026-58868 (Framework, remote code execution) and, in System, CVE-2026-58876 and CVE-2026-58936 (remote code execution), CVE-2026-55275, CVE-2026-55283 and CVE-2026-58984 (privilege escalation) and CVE-2026-58814 and CVE-2026-58882 (denial of service); at 2026-11-05, six upstream Linux kernel flaws in Bluetooth (CVE-2026-53256, CVE-2026-89774), pKVM (CVE-2026-59044, CVE-2026-59045, CVE-2026-59048) and HID (CVE-2026-80604), eight MediaTek modem flaws (CVE-2026-20499, CVE-2026-20519, CVE-2026-20520, CVE-2026-20545 to CVE-2026-20549) and one Qualcomm closed-source flaw (CVE-2026-25285). Google says the most severe kernel-component issue could lead to remote escalation of privilege with no user interaction. Some fixes also ship as Google Play system updates (Media Codecs, MediaProvider, Profiling, Telephonycore and Wi-Fi). The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours of publication. (source: Android Security Bulletin)
Android Security Bulletin — November 2026 (published 2 Nov 2026)
BTCPay Server, the open-source self-hosted cryptocurrency payment processor, said on 2 November 2026 that it received reports on 1 November of Bitcoin and Litecoin being stolen from hot wallets on BTCPay Server instances, and that its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier. The project says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (released 7 August 2026); it has not named a CVE. Its timeline, converted to Perth time, records a wallet drain at 21:46 on 1 November, the first theft report by email at 04:56 on 2 November, and a warning on X at 06:25 on 2 November asking operators to shut down their servers; it also asked VPS hosting providers, including LunaNode, to take BTCPay Server instances offline as a precaution. BTCPay says it has seen no impact on servers that were already running 2.4.2 or later when it issued that warning, that funds in wallets whose spending keys are held off the server, including hardware wallets, were unaffected, that it has not established when exploitation began, and that activity at the reported destination addresses should not be treated as a confirmed total of losses. (source: BTCPay Server) According to BleepingComputer, on 29 October BTCPay disclosed a critical vulnerability discovered through Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update, and BTCPay says it has no credible reports of hot wallet drains for users running 2.4.7. (source: BleepingComputer) Correction (02 Nov 2026): removed BTCPay Server's posts on X as a source; removed details no other source gives. (source: BTCPay Server; BleepingComputer)
BTCPay Server — Security Incident Affecting BTCPay Server 2.4.1 and Earlier (2 Nov 2026)
Apache's CVE record for CVE-2026-118636, published on 1 November 2026 (4:17 am Perth), is marked 'UNSUPPORTED WHEN ASSIGNED'. It says JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain remote code execution. The record lists Apache MINA 3.0.0 through 3.0.0-M2 as affected, describes the severity as critical and gives a CVSS 3.1 base score of 9.8. Apache says that as the 3.0.0 branch is inactive it does not plan to release a version that fixes the issue, and recommends users move to the latest Apache MINA 2.2.x branch; MINA's download page lists Apache MINA 2.2.10 as the stable release (Java 8+). (sources: CVE-2026-118636 record; Apache MINA downloads page)
CVE.org — CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (CNA: Apache; published 1 Nov 2026, Perth)
ClickHouse says in its security changelog that an issue discovered in ClickHouse Server could, under certain conditions, allow an unauthenticated user with network access to execute arbitrary code on the server. It lists the fix under 'Fixed in ClickHouse v26.10.3.7, 2026-10-30' and says the fix has been pushed to the open-source versions v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable, and that a fix has been applied to all ClickHouse Cloud and BYOC deployments; it credits Elshad Toklayev. ClickHouse, as the CVE Numbering Authority, published CVE-2026-116366 on 30 October 2026 (11:00 UTC; 7:00 pm Perth) under the title 'Unauthenticated RCE vulnerability against ClickHouse Server', classed as CWE-190 (integer overflow or wraparound), with a CVSS 4.0 base score of 9.5 (Critical; network attack vector, high attack complexity, no privileges or user interaction). The CVE record lists open-source ClickHouse 26.3 before 26.3.62.3-lts, 26.8 before 26.8.36.3-lts, 26.9 before 26.9.27.3-stable and 26.10 before 26.10.3.7-stable as affected, and also lists ClickHouse Cloud builds before 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597 and 26.10.2.84. Neither ClickHouse's changelog nor the CVE record describes the conditions needed or reports exploitation. (source: ClickHouse security changelog; CVE record)
ClickHouse — Security changelog (Fixed in ClickHouse v26.10.3.7, 2026-10-30: CVE-2026-116366)
ServiceNow published CVE records on 29 October 2026 (UTC) for three ServiceNow AI Platform issues, each pointing to its knowledge base article KB3228994, titled 'October 2026 CVE Advisory Notification'. ServiceNow says CVE-2026-103093 (CVSS 4.0 9.4, Critical), 'Sandbox Escape via Table Rotation', could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system. CVE-2026-103094 (CVSS 4.0 7.1, High) could cause a user's plaintext password to be persisted in a system table, exposing it to a user not otherwise entitled to view it. CVE-2026-6877 (CVSS 4.0 5.3, Medium) is a domain separation bypass in the SR – CSM – Task Plan Templates Store application that could let a user with a specific role create records in domains they cannot access. ServiceNow says it deployed an update to hosted instances, provided the update to partners and self-hosted customers, and is not currently aware of malicious exploitation. The knowledge base article itself did not render for the desk; details here are from ServiceNow's CVE records. (source: ServiceNow CVE records via cve.org)
CVE-2026-103093 record (ServiceNow CNA) — Sandbox Escape via Table Rotation in ServiceNow AI Platform (published 29 Oct 2026 UTC)
Synology said in a notice dated 29 October 2026 that it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DiskStation Manager (DSM), in attacks that aim to encrypt data and extort ransom. Synology strongly urges all users running vulnerable versions to update DSM immediately, recommends enabling automatic updates, and refers customers to its advisory Synology-SA-24:20. That advisory, rated Critical by Synology (published 5 Nov 2024, last updated 28 Mar 2025), covers three flaws: CVE-2024-10441 (remote code execution in the system plugin daemon, CVSS 9.8), CVE-2024-50629 (limited file read, 5.3) and CVE-2024-10445 (limited file write, 4.3). Synology has not said which of the three is being exploited. (source: Synology) According to BleepingComputer, the attacks deploy C3RB3R ransomware, Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, and users are advised to block internet access to the DSM management web interface.
Synology — Synology urges users to update DSM following ransomware attacks on outdated DSM versions (29 Oct 2026)
Researcher Mark B (GitHub: MarkBlah) published a write-up on 29 October 2026 at smsofdeath.com of 'SMS of Death', a zero-click remote denial-of-service flaw in Android's telephony framework (WapPushOverSms, frameworks/opt/telephony). The researcher says WapPushOverSms.decodeWapPdu() reads a WAP Push header length, casts it to a signed 32-bit integer with no range check and uses it as an array size, so an eight-byte message (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948 throws an uncaught NegativeArraySizeException that kills com.android.phone. Per the researcher, the message never appears in the inbox, active calls drop (including emergency calls), each message causes 1-2 seconds without service, carrier redelivery re-crashes the phone, about 20 messages can make a device unusable for an extended period, and the queued message can crash the phone on every boot; on an Android 12 test device this produced a reboot into recovery roughly every 90 seconds. The researcher says the crash was reproduced from Android 12 up to Android 16 on Pixel and Samsung Galaxy devices, that it was reported to Google on 5 May 2026, and that Google's fix (commit 735d967, 'Fix remote DoS in decodeWapPdu', authored 15 June 2026) catches the exception and deletes the triggering message; it shipped in the October 2026 Android security release for Android 14 through 17, so Android 12 and 13 devices do not receive it. A recovery method over ADB (deleting the queued rows from content://sms/raw), credited to @sakisdog, is on the site. The researcher has published a working proof-of-concept app and source on GitHub. BleepingComputer reported on 31 October (11:35 pm Perth) that the flaw is tracked as CVE-2026-58882 and is not listed in Google's October 2026 Android security bulletin; the bulletin, read by this desk, does not list CVE-2026-58882. (sources: smsofdeath.com; GitHub MarkBlah/smsofdeath; BleepingComputer) UPDATE (3 Nov 2026, Perth; Android Security Bulletin): Google's Android Security Bulletin for November 2026, published 2 November, lists CVE-2026-58882 (Android bug A-517376969) as a Critical denial-of-service flaw in the System component, with updated AOSP versions Android 14, 15, 16, 16 QPR2 and 17, fixed at security patch level 2026-11-01; the bulletin does not flag it as exploited. The researcher had said the fix shipped in the October 2026 release; Google's bulletin places it at the November 2026-11-01 patch level. (source: Android Security Bulletin)
smsofdeath.com — SMS of Death: zero-click Android telephony DoS (researcher write-up, disclosed 29 Oct 2026)
Google's Chrome Releases blog says the Stable and Extended Stable channels were updated on 29 October 2026 to 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux, rolling out over the coming days and weeks, with 21 security fixes: one Critical, 19 High and one Medium. The Critical bug is CVE-2026-76024, memory corruption in MediaStream, reported by Xinyang Ge on 21 October. High-rated fixes include use-after-free and memory-corruption bugs in FileSystem, Autofill, CacheStorage, Network, Input, Frames, Skia, V8, GarbageCollection, Dawn, Quota, DOM, Editing and Blink; Google is credited with 12 of the 21 bugs. Google does not say any of the flaws is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. Chrome 156.0.8078.79 for Android, released the same day, contains the same security fixes as the desktop release unless otherwise noted. This follows the 156.0.8078.73/.74 update of 27 October, which is a separate card. (source: Chrome Releases)
Chrome Releases — Stable Channel Update for Desktop, Chrome 156.0.8078.79/.80 (29 Oct 2026)
Veeam published KB4961, 'Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1', on 29 October 2026. It lists three vulnerabilities, all fixed starting in Veeam Management Pack for Microsoft System Center 13.1 (build 13.1.0.334). CVE-2023-22793 (Critical, CVSS v4.0 9.3) is "A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center." CVE-2026-107238 (High, 8.7) allows "an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account" on servers running the Collector service, and CVE-2026-107239 (High, 8.8) allows "a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE)" on servers running the Collector service. Affected: Veeam Management Pack for Microsoft System Center 9.1 and all earlier version 9 builds, including the Veeam Backup & Replication 13 compatibility patch. Veeam says: "A fix will not be provided for version 9.x. Customers running version 9.x should upgrade to 13.1.0.334." Veeam lists all three as discovered during internal testing; KB4961 does not mention exploitation. (source: Veeam KB4961)
Veeam — KB4961: Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1 (published 29 Oct 2026)
Cisco published security advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 28 October 2026 at 19:15 GMT (29 October 03:15 Perth) for CVE-2026-76418, a vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that, Cisco says, could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service. Cisco says the flaw is due to logic errors when secondary authentication is configured on a tunnel group and can be exploited by sending a crafted request when connecting to the SSL remote access VPN; it notes that a successful VPN login is not required to reach the affected processing path. Devices are affected if they run a vulnerable ASA or FTD release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope (including the default tunnel group, DefaultWEBVPNGroup). Cisco rates the advisory High (CVSS 3.1 base 8.6) and says: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Cisco says there are no workarounds, only a mitigation, and strongly recommends upgrading to a fixed release. Cisco credits Eric Fernald, who found the flaw while resolving a Cisco TAC support case. (source: Cisco) According to BleepingComputer, Cisco did not provide indicators of compromise or say who is exploiting the flaw. (source: BleepingComputer) UPDATE (30 Oct 2026, Perth; CISA): CISA added CVE-2026-76418 ("Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability") to its Known Exploited Vulnerabilities catalog on 29 October 2026 based on evidence of active exploitation, with a remediation due date of 1 November 2026 for US federal civilian agencies. Cisco's advisory was still at version 1.0 when re-read on 30 October (Perth), with the same first fixed releases. (source: CISA; Cisco)
Cisco Security Advisory — Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability (cisco-sa-asaftd-tunnel-dos-s6mgkb75; first published 28 Oct 2026 19:15 GMT)
Linux Kernel Missing Initialization of a Variable Vulnerability. Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
