CISA published ICS advisory ICSA-26-300-01 on 27 October 2026 for EPICS Base from the EPICS community, listing four CVEs in EPICS Base release 7.0.10 and prior. According to CISA, CVE-2026-114595 (CVSS 3.1 9.8, CVSS 4.0 9.3, Critical) is an integer overflow in network request processing that can cause memory to be allocated with an incorrect size, and subsequent handling of attacker-supplied data may result in memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (CVSS 3.1 8.2, CVSS 4.0 8.8) is improper validation of message length values during protocol parsing that can trigger an integer overflow and an out-of-bounds memory write, causing process instability or denial of service; and CVE-2026-114597 and CVE-2026-114598 (CVSS 3.1 7.5, CVSS 4.0 8.7) are insufficient validation of element or length values in a network message that can cause reads beyond an allocated buffer, leading to denial of service and possible exposure of adjacent memory. CISA says the EPICS community has made updates available in the epics-base GitHub repositories and users should update to the 7.0.11 release; EPICS Base R7.0.11 is published on GitHub, dated 27 October. CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it, lists the product as deployed worldwide in critical manufacturing, and credits Shubham Raj of Cipher / Causal Security with reporting the flaws. (source: CISA advisory) UPDATE (28 Oct 2026, Perth; The Register): Causal Security co-founder Shubham Raj told The Register (27 Oct, 19:11 UTC) that the company's autonomous AI agent, Cipher, independently found all four previously unknown EPICS flaws, investigating and testing the system and validating the four exploits, in three hours and 49 minutes. (source: The Register)
CISA ICS advisory ICSA-26-300-01 — EPICS Base (27 Oct 2026)
Mozilla released Firefox 159 on 27 October 2026 with advisory MFSA 2026-118, which is rated high overall and lists 167 CVEs: 108 rated high, 52 moderate and 7 low. Mozilla notes that it no longer rolls internally found memory safety bugs into a single CVE and now issues an advisory for every individual bug, which is why the count is large. High-rated issues include sandbox escapes in the DOM: Navigation component (CVE-2026-117861), the Form Manager component (CVE-2026-117864) and the DOM: Networking component (CVE-2026-117868); privilege escalations in the Networking component (CVE-2026-117862), the Graphics: Canvas2D component (CVE-2026-117866) and WebRTC (CVE-2026-118006, CVE-2026-117892); a same-origin policy bypass in DOM: Navigation (CVE-2026-117860); and JIT miscompilation and use-after-free bugs in the JavaScript engine (for example CVE-2026-117890 and CVE-2026-117891). Mozilla credits OpenAI Codex Security (kylebot) with 34 of the high-rated bugs and Amy Burnett of OpenAI with 7. The advisory does not say any of the bugs are exploited in the wild. The same day Mozilla published MFSA 2026-120 for Firefox ESR 153.6, listing 145 CVEs (95 high, 44 moderate, 6 low), and MFSA 2026-119 for Firefox ESR 115.44. (source: Mozilla security advisories)
Mozilla — MFSA 2026-118 Security Vulnerabilities fixed in Firefox 159 (27 Oct 2026)
Apple released security updates on 26 October 2026 for iOS and iPadOS 27.2 and 26.7.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, Safari 27.2, tvOS 27.2, watchOS 27.2 and visionOS 27.2, according to its security releases page. Apple's notes for iOS 27.2 list WebKit bugs where processing maliciously crafted web content may lead to arbitrary code execution, an App Store flaw (CVE-2026-112690, credited to Claudio Bozzato and Francesco Benvenuto of Cisco Talos) that may let a remote attacker break out of the WebContent sandbox, and a range of kernel and driver bugs that may let an app corrupt or write kernel memory. The same App Store fix appears in iOS 26.7.2 and all three macOS updates, and iOS 26.7.2 also fixes an ImageIO bug (CVE-2026-64759) where processing a maliciously crafted image may lead to arbitrary code execution. On the Mac, Apple says a Kernel flaw (CVE-2026-112438) fixed in macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2 may let an unprivileged attacker execute arbitrary code as root; macOS Golden Gate 27.2 also fixes a Remote Management flaw (CVE-2026-112427) that Apple says may let a remote attacker cause arbitrary code execution, along with several bugs that may let an app gain root privileges, break out of its sandbox or bypass Gatekeeper checks. Safari 27.2 brings the WebKit code-execution fixes to macOS Sequoia and macOS Tahoe. Apple's notes for iOS 27.2, iOS 26.7.2, the three macOS releases and Safari 27.2 do not say any of these flaws have been exploited, and Apple does not publish CVSS scores. The same day Apple also shipped iOS 18.7.11 for older iPhones, which fixes the exploited CoreGraphics flaw CVE-2026-86950 and is covered on that flaw's card.
Apple — About the security content of iOS 27.2 and iPadOS 27.2 (26 Oct 2026)
Ukraine's computer emergency response team, CERT-UA, said late last week that it had identified cases in which hackers compromised internet-connected Dahua cameras and video recorders, changed their settings and created unauthorised user accounts, The Record from Recorded Future News reported on 26 October 2026. According to The Record, CERT-UA did not say how many devices were compromised, when the attacks happened or who was responsible. The Record reports that, according to CERT-UA, the attackers appear to be exploiting Easy4IP, a feature that lets users reach Dahua cameras remotely through the manufacturer's cloud service and that connects devices using their serial numbers even when they sit behind firewalls or cannot be reached directly from the internet. CERT-UA said the serial numbers follow predictable patterns, so attackers can guess large numbers of them and find cloud-connected cameras, which means devices with the remote access feature turned on could be exposed even if their serial numbers were never published, according to The Record. Once a device is found, attackers can try weak or default passwords or exploit flaws in outdated firmware that bypass authentication, and CERT-UA specifically warned about two critical vulnerabilities disclosed in 2021, CVE-2021-33044 and CVE-2021-33045, which affect certain Dahua cameras and video recorders, The Record reports.
The Record — Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras (26 Oct 2026)
Erica Windisch of Cyberdione Labs published a security assessment report called Tailworm covering Tailscale client v1.104.2 and headscale v0.29.5 (the self-hosted control server), which the report says were tested in a lab from 22 to 24 October. The report says Tailscale SSH's Unix-socket forwarding performs path checks and file operations as root, so an ordinary session from one approved device can lead to root execution on target servers, capture of enrollment keys and arbitrary root-file deletion. The report says the attacker needs a foothold on one device plus one SSH policy rule letting it connect, with forwarding granted automatically on headscale and set per rule on Tailscale's hosted service. The report also lists findings in Tailscale's experimental conn25 app connectors, the headscale control server, the DERP relay client and tailscale serve. The report says Tailscale responded publicly on Reddit, where vice president of engineering Mike Shaver acknowledged the report and described fixes in progress. Tailscale's security bulletins page listed no bulletin for these findings when checked on 26 October (Perth). UPDATE (27 Oct 2026; Tailscale): Tailscale published a Tailscale SSH investigation and remediation update dated 26 October saying most of the Tailscale SSH issues it has identified concern privilege escalation, where someone already authorised to connect over Tailscale SSH may be able to act beyond the permissions of their configured local user, including potentially gaining elevated privileges. "These are serious security issues, and we're treating them accordingly," Tailscale said, adding that exploitation depends on the permissions granted to the connecting user or device, the system's configuration and other conditions. Tailscale says its engineers have implemented fixes for most of the issues and are completing testing, that it is targeting a patched client release by the end of Tuesday 27 October subject to testing, and that it will then publish a security advisory with the confirmed vulnerabilities, affected versions and configurations; it is still not recommending that everyone disable Tailscale SSH. BleepingComputer reported on 27 October that Cyberdione Labs' report covers 11 flaws, collectively called Tailworm. (source: Tailscale; BleepingComputer) UPDATE (28 Oct 2026, Perth; Tailscale): Tailscale has published four security bulletins, TS-2026-014 to TS-2026-017, dated 26 October, and says each issue is fixed in Tailscale version 1.104.4 or newer. TS-2026-014: the SSH server in the root-privileged tailscaled process validated Unix socket forwarding paths lexically but performed the operations as root, which gave authenticated peers with authorised forwarding access a route to root-only Unix sockets such as the Docker socket or the tailscaled local API; Tailscale now performs Unix socket forwarding on behalf of the authenticated user. TS-2026-015: memory exhaustion in Tailscale SSH session handling could let a peer with a permitted session crash tailscaled, disrupting every Tailscale connection on the node. TS-2026-016: tailscale serve Unix backends could reach privileged sockets including the tailscaled local API socket, which Tailscale says allowed full node takeover on nodes where a local operator can write serve configurations or local users can write to configured backend paths. TS-2026-017: with serve TLS enabled and two or more mounts with different capability requirements, a shared HTTP/2 context could send the wrong Tailscale-App-Capabilities values across mounts. Tailscale's investigation page, updated 27 October, now points to the four bulletins and recommends that customers using Tailscale SSH follow the applicable update guidance. The bulletins give no CVE identifiers or severity scores. (source: Tailscale) Correction (30 Oct 2026): the card said headscale's newest release was 0.29.5 and did not fix the reported issues; headscale released v0.29.6 on 24 October, and its release notes do not mention the Tailworm findings, so the card now says no headscale release is known to fix them. (source: headscale on GitHub) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Tailscale; Cyberdione Labs Tailworm report; headscale on GitHub)
PHP published an informational advisory on 23 October 2026 (10:12 UTC, 6:12 pm Perth) suggesting that users set session.upload_progress.enabled=0 until the next regular bugfix release, 'to fully protect from an unlikely RCE vector', tracked as CVE-2026-115560. PHP says the issue can only occur under an unusual combination of configuration and application code: an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(), and session upload progress must also still be enabled. PHP says applications that never change the serialize handler at runtime can keep the feature enabled. PHP says the same setting was already listed as a mitigation in its GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on 21 October, and that anyone who applied it then should keep it in place and needs to take no further action. Because the setup is unlikely in practice, PHP says it is handling the issue in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release. (source: PHP.net) Updated 24 Oct 2026: the CVE number has no published record on cve.org yet, so the card no longer links to one; PHP's own advisory is the primary source. (source: PHP.net) UPDATE (25 Oct 2026): Palo Alto Networks added an FAQ to its PHP advisory on 25 October saying its current analysis shows no impact of CVE-2026-115560 on PAN-OS (NGFW and Panorama), because the issue relates to an uncommon configuration that PAN-OS does not use, and that a review of impact to its other products is underway. (source: Palo Alto Networks advisory CVE-2026-109618) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: PHP.net; Palo Alto Networks)
PHP.net — Informational advisory: Session upload progress (23 Oct 2026)
TianoCore published GitHub advisory GHSA-99cj-7hg9-mp4m, "Pre-boot RCE in EDK II PXE driver", on 22 October 2026, rated Critical (CVSS 4.0 9.5, CWE-120). According to the advisory, the UefiPxeBcDxe driver in NetworkPkg copies ICMP error packets into the 504-byte Mode.IcmpError field in both its IPv4 and IPv6 handlers, so an unauthenticated attacker can send a unicast ICMP error during PXE boot from any network distance. Results range from a boot hang to code execution in DXE at ring 0 when the attacker knows the firmware build. The advisory lists EDK II master as of 2026-09-14 as affected, says it is "Not patched currently" and points to fix pull request 13302; the CVE record lists versions up to edk2-stable202608. Credit goes to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google). Ars Technica (27 Oct) reports that disclosure went wrong after an AMI pull request last month, with coordinated disclosure originally planned for January; that Intel says no commercial products under security support are known to be affected; that Arm says the issue is not directly applicable; and that Eclypsium's Jesse Michael says exploits must be tuned per target. Ars says home computers that boot from disk are not affected.
TianoCore (GitHub advisory GHSA-99cj-7hg9-mp4m) — Pre-boot RCE in EDK II PXE driver (22 Oct 2026)
Eye Security's research team said on 22 October 2026 that between November 2025 and March 2026 it actively disabled the vulnerable update mechanism in Time4Popcorn, a fork of the Popcorn Time BitTorrent streaming client, by executing code on systems running it. The flaw is CVE-2026-30612, which the CVE record describes as allowing a remote attacker to execute arbitrary code through updater.exe on Windows and PT.updd on macOS in Time4Popcorn for Windows up to 6.2.1.18, for macOS up to 6.2.1.17 and for Android up to 3.5.0.173; CISA's ADP enrichment scores it CVSS 3.1 9.8. Eye Security says it found an Updater.exe at a client trying to reach the lapsed domain popcorntimeupd.xyz. After registering it, Eye found the updater would download and run any executable named in a JSON reply with NT AUTHORITY\SYSTEM privileges, with no code signing and over unencrypted HTTP; on macOS a pushed update ran as root. It estimates it encountered about 2.5 to 3.0 million Windows hosts and 250,000 to 350,000 macOS hosts, connecting mostly from home ISPs but also from government, military and corporate networks around the world. Eye says its update only stopped and disabled the updater service, with no telemetry or file deletion, and that it had to adjust the code to get past endpoint products that flagged it. It says more than a million systems were updated by December 2025, it sent over 2 million update downloads in total, and update requests had fallen 98% by 1 March 2026. In late March it handed the 15 domains it controlled to The Shadowserver Foundation; some other update domains are still owned by third parties. Eye did not touch Android, where updates need user interaction, and says the application itself remains unsafe: it is built on a 2014 Chrome engine with the sandbox disabled, loads content over plain HTTP and loaded JavaScript from abandoned domains, and Eye has a proof of concept that runs calc.exe through JavaScript. (source: Eye Security) Updated 23 Oct 2026: BleepingComputer reported the research. (source: BleepingComputer)
Eye Security — Operation IXIM: Preventing a botnet of millions of Popcorn Time users (22 Oct 2026)
HPE's security bulletin HPESBNW05162 rev.1, released 22 October 2026, lists 72 CVEs in the HPE Networking Wireless Operating Systems AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways and Access Points. HPE rates eight of them 10.0 under CVSS 3.1: CVE-2026-79844 and CVE-2026-79850 (authentication bypass leading to remote code execution in AOS-10 and AOS-8), CVE-2026-79845 (authentication bypass in the PAPI protocol of AOS-10 allowing unauthorised access and modification of sensitive data), CVE-2026-79846 (unauthenticated command injection in AOS-8), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection allowing remote code execution in AOS-8), and CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows leading to remote code execution in AOS-10). A further 25 are rated between 9.0 and 9.8, among them unauthenticated command and SQL injection in the PAPI protocol and an authentication bypass in the AOS-8 SSH daemon. HPE lists affected versions as AOS-10.8.x.x: 10.8.1.1 and below, AOS-10.7.x.x: 10.7.2.6 and below, AOS-10.4.x.x: 10.4.1.13 and below, AOS-8.13.x.x: 8.13.3.0 and below and AOS-8.10.x.x: 8.10.0.23 and below. It recommends upgrading to AOS-10.8.x.x: 10.8.1.2 and above, AOS-10.7.x.x: 10.7.2.7 and above, AOS-10.4.x.x: 10.4.1.14 and above, AOS-8.13.x.x: 8.13.3.1 and above or AOS-8.10.x.x: 8.10.0.24 and above. HPE says versions that have reached End of Maintenance are presumed to be affected and are not covered by the advisory. HPE says the vulnerabilities were generally discovered by its internal security research and that it 'is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory'. It adds: 'Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.' Until patches are applied, HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with firewall policies at layer 3 and above. HPE published CVE records citing the bulletin on 22 October (UTC), and CISA's ADP enrichment on the seven 10.0-rated HPE records lists exploitation as none. When checked on 23 October, the CVE list entry for CVE-2026-79845 was an unrelated record assigned by VulDB, not an HPE record. (sources: HPE security bulletin; HPE CVE records) Updated 23 Oct 2026: BleepingComputer reported the bulletin, noting that ArubaOS powers Aruba Networking enterprise wireless infrastructure. (source: BleepingComputer)
HPE — HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8) (22 Oct 2026)
Security firm V12 said on 22 October 2026 that it found 25 vulnerabilities in the x402 codebase, the open standard that lets software such as AI agents pay for an API call inside an ordinary HTTP exchange (a server answers 402 Payment Required, the client signs a payment and retries). V12 described three it rated critical. First, the documented default client setup enforced no per-payment limit or total budget, so, according to V12, a hostile API could turn a routine request into a request for the wallet's full balance of a compatible token, and with an automatic signer and no application-supplied policy the client could sign it. Second, the TypeScript Solana facilitators did not check the instruction type, so a token approval, which moves no tokens, was accepted as a payment in V12's local test; V12 called it "a complete payment bypass" and says the test did not submit a live transaction. Third, the Sign-In-With-X client signed login messages without checking that the website named in them was the one it had contacted, which V12 says could let a malicious server log in to another site as the agent's wallet. V12 says it reported the 3 critical and 13 high-severity findings to the x402 team on 12 August 2026 and that the 3 critical flaws were fixed by 20 August. The x402 Foundation's TypeScript changelogs for 2.23.0 list the matching changes: client spendControls that by default allow only recognised pegged assets with a $1 USD cap, a required origin check before signing Sign-In-With-X messages, and a validation guard for TransferChecked in the Solana package. (sources: V12; x402 Foundation changelog) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: V12; x402 Foundation changelog)
V12 — 25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings (22 Oct 2026)
Cisco published a critical advisory (cisco-sa-vcs-static-cred-hr7EWZ8t) on 21 October 2026 at 16:00 GMT (22 Oct 00:00 Perth) for CVE-2026-76466 in the database service feature of Cisco Expressway Series. According to Cisco, an unauthenticated, remote attacker with network access to an Expressway device could run arbitrary operating system commands as root. Cisco says the flaw is due to the use of persistent cookies, and that client certificates are not validated when TLS Verify Mode is set to Enabled for clustering; an attacker who has the cookies could connect to the database service and invoke specific remote procedure call (RPC) commands. Cisco rates it CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-798 (use of hard-coded credentials), bug CSCww27732. It affects Expressway-C and Expressway-E, virtual and appliance, only when the devices are configured in a cluster. Cisco lists X15.5.20 as the first fixed release for X15.5.3 and earlier, says X14 and earlier must migrate to a fixed release, and says there are no workarounds; the fix is also part of the 'Cisco Expressway Series Security Hardening Release: October 2026'. Cisco's PSIRT says it is not aware of any public announcements or malicious use. Cisco credits Stefan Aleksic of Jane Street. The advisory is part of Cisco's bundled publication of 21 October 2026 16:00 GMT (22 Oct 00:00 Perth). Source: Cisco security advisory cisco-sa-vcs-static-cred-hr7EWZ8t (22 Oct 2026 Perth). Correction (27 Oct 2026): the card date moved from 21 to 22 October 2026; Cisco's advisory shows 'First Published: 2026 October 21 16:00 GMT', which is 00:00 on 22 October in Perth (AWST). (source: Cisco)
Cisco — Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t, 22 Oct 2026)
Trend Micro's Zero Day Initiative (ZDI) sent reports for two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, to the kernel security team on 21 October 2026, with the public Linux kernel mailing list copied. Each is rated CVSS 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), and ZDI tested Linux 7.3-rc3. ZDI-CAN-33774 is a race in protocol dispatch: a queued SMB1 request can be handled with SMB2 handlers after an SMB2 packet arrives, so a 40-byte SMB1 buffer is parsed as an SMB2 header and out-of-bounds heap memory is sent back to the attacker; ZDI says there is also a path to an out-of-bounds write, and that triggering it requires winning the race and a guest share. ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path that leads to a heap overflow and needs an RDMA device, a writable share and SMB Direct. Phoronix (22 Oct) says the reports appear to have been sent to the public list by mistake, and that a patch for ZDI-CAN-33549 sits in a Git branch intended for Linux 7.5. No exploitation has been reported. (sources: ZDI reports on the Linux kernel mailing list; Phoronix) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ZDI reports on the Linux kernel mailing list; Phoronix)
Linux kernel mailing list — ZDI-CAN-33774: KSMBD protocol dispatch race condition RCE report from Trend Micro's Zero Day Initiative (21 Oct 2026)
