Researcher Quentin Kaiser disclosed on 16 October 2026, at Hexacon in Paris and in a long write-up, a memory-corruption flaw in Broadcom's proprietary 802.11 Wi-Fi stack: an overflow in the reassembly of WPS EAP messages that can be triggered remotely over Wi-Fi without the network key or a completed WPS enrollment, giving controlled information disclosure and arbitrary code execution. He says the bug has been in Broadcom's SDK since at least 2010; Broadcom silently shipped an incomplete patch in 2018 and then advised OEMs to move to hostapd, leaving it a lasting 'forever day' on eCos-based chips (BCM3380, BCM3383, BCM33834) and a potential one on Linux-based chips (BCM3390, BCM65xx, BCM68xx) on any device that was never migrated. Broadcom declined to assign a CVE or publish an advisory, which Kaiser says is why so many OEMs never patched; he reported it under a 90-day timeline that expired on 16 October. He demonstrated working over-the-air exploitation against gateways from three of four Belgian ISPs (Proximus BBOX 3/3V+ Sagemcom F@st, VOO Netgear CG3100/CG3700 and Technicolor/Commscope models, Orange Belgium ASKEY TCG3000), showing a root shell and extraction of the Wi-Fi PSK from NVRAM, and says that as of 15 October none of the demonstrated devices were patched. The same Broadcom silicon ships worldwide in cable and DSL gateways from many vendors, so the blast radius extends well beyond Belgium; Kaiser released a fingerprinting script and a YARA rule to help map affected models. There is no indication of in-the-wild exploitation, and no Australian ISP or device has been named. (source: Quentin Kaiser research)
Quentin Kaiser — One Parser, Two Bugs, Many Routers: exploiting Broadcom Wi-Fi across eCos and Linux (16 Oct 2026)
Security firm Calif published research and full exploit code on 16 October 2026 showing local privilege escalation to root on OpenBSD 7.9 with KARL kernel relinking, SMAP and SMEP enabled, and without any information-leak bug. The chain starts with shm_nattch, the System V shared-memory attach counter, which has been a signed 16-bit short since the original BSD sources, roughly 37 years ago: mapping 127 segments and forking 259 processes wraps it to -32,643, and a race then frees kernel memory other processes still use. A separate out-of-bounds write corrupts multicast-membership counters so that later decrements alter page-table entries, making a user mapping supervisor-accessible; the exploit then overwrites a function pointer that sits at a predictable kernel address because OpenBSD's boot-time and best-fit allocators are not randomised. OpenBSD fixed the integer overflow in errata 018 on 14 September 2026, labelled a reliability fix, and the reference-counting use-after-free in errata 026 on 30 September, labelled a security fix; both apply to all architectures through syspatch, and OpenBSD 7.8 also received the overflow fix. No CVE has been assigned and there is no report of use in attacks. Calif also proposes kernel hardening such as safe unlinking for linked lists and allocator randomisation. (sources: OpenBSD 7.9 errata; Calif) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: OpenBSD errata; Calif)
The Apache Kylin project published five CVE records on 16 October 2026 for the open-source OLAP analytics engine, all fixed in Kylin 5.0.5. CVE-2026-64959, which Apache rates critical, is a backend cache API that is missing authentication and can execute injected SQL (Kylin 5.0 to 5.0.4). The others, affecting Kylin 4 through 5.0.4, are CVE-2026-68571, code injection through a special parameter in a JDBC URL (moderate); CVE-2026-64610, unsafe Java deserialisation from a broken external cache service (moderate); CVE-2026-63619, a metadata dump API without enough authorisation or path confinement (moderate); and CVE-2026-63618, exposure of system configuration information (important; CISA's enrichment scores it CVSS 3.1 7.5). Apache says the impact falls mostly on Kylin services exposed directly to the internet, which it describes as uncommon, and that in-house deployments are mostly unaffected. No exploitation is reported. (source: Apache Kylin)
The Linux kernel CVE Numbering Authority published CVE-2026-98432 on 15 October 2026 (12:08 UTC; 20:08 Perth) for a use-after-free in the kernel's IPv4 TCP code, fixed by the commit 'ipv4: free inet_opt and ireq_opt after an RCU grace period'. The CVE record says tcp_v4_syn_recv_sock() hands the request socket's IP options to the child socket without copying them, so another CPU sending a SYNACK for a retransmitted SYN can still be reading them after the child socket frees them with a plain kfree(), leading to a use-after-free in ip_options_build(); a similar issue exists with request socket migration. The kernel CNA rates it CVSS 3.1 9.8 (Critical) and its scoring notes say an unauthenticated peer supplies IPv4 Record Route or Timestamp options in a TCP SYN to a listening service, and races a retransmitted SYN against completing and tearing down the same connection; it says reclaiming the freed object can disclose adjacent kernel heap contents to the peer, permit out-of-bounds kernel writes and potential control-flow corruption, or crash the kernel. The CVE record lists the flaw as affecting kernels from 4.4 and fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Ubuntu's CVE page (last updated 28 October) gives it Ubuntu priority High and lists the linux package as vulnerable in releases from 16.04 to 26.10, with fixes marked work in progress for 22.04, 24.04, 26.04 and 26.10. IPv6 is not affected by the first issue, according to the CVE record. (source: CVE record; Ubuntu) UPDATE (30 Oct 2026, Perth; Red Hat): Red Hat's CVE page now scores the flaw CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which it calls preliminary and subject to review, rates it Critical for Red Hat Enterprise Linux, says the issue primarily results in a system crash leading to denial of service or potential memory corruption, and points to Red Hat security bulletin RHSB-2026-016 for a mitigation procedure. Red Hat's machine-readable VEX file for the CVE (current version 30 October 2026, 20:47 UTC; 4:47 am Perth, 31 October) rates the impact Critical and lists kernel packages in Red Hat Enterprise Linux 8, 9 and 10 and Red Hat Enterprise Linux for NVIDIA 26, and RHEL CoreOS in OpenShift Container Platform 4 and 5, as known affected, with no fixed packages listed, and lists Red Hat Enterprise Linux 6 and 7 as not affected. As of 30 October (Perth) the CVE record's fixed versions and Ubuntu's page (still last updated 28 October, fixes work in progress) are unchanged. (source: Red Hat; CVE record; Ubuntu) UPDATE (31 Oct 2026): Anthropic says in a research post that, after initial prompting, its Claude model wrote an exploit for CVE-2026-98432 that allows a remote attacker to send packets to Linux servers with a multipath TCP (MPTCP) listener to run arbitrary commands as root, without any credentials or user interaction: the exploit first defeats KASLR remotely and then hijacks control flow, and because a lost race only fails the handshake an attacker can retry until it succeeds; in Anthropic's proof of concept it took 48 minutes to leak a kernel pointer and another five minutes to reach command execution. Anthropic says the flaw was patched upstream and backported to all maintained stable kernel branches. (source: Anthropic) CIQ's mitigation article for Rocky Linux 8, 9 and 10 and its RLC Pro variants says that as of 30 October no patched CIQ kernel had been published, gives an interim nftables rule (ip hdrlength gt 5 meta l4proto tcp counter drop) that drops IPv4 TCP packets carrying IP options, and says disabling MPTCP alone (net.mptcp.enabled=0) does not close the hole because the vulnerable code path stays reachable through plain TCP traffic; it notes Go programs built with Go 1.24 or newer enable MPTCP by default for listening sockets on Linux. (source: CIQ) Debian's security tracker lists the flaw as fixed in linux 6.1.190-1 for bookworm (DLA-4841-1), 6.12.113-1 for trixie (DSA-6568-1) and linux-6.12 6.12.113-1~deb12u1 for bookworm (DLA-4850-1). Ubuntu's page (last updated 30 October) still lists fixes as work in progress, and the CVE record's fixed versions are unchanged as of 31 October. BleepingComputer reported Anthropic's exploit on 30 October and says there are currently no confirmed reports of CVE-2026-98432 being exploited in the wild. (sources: Debian; Ubuntu; CVE record; BleepingComputer) UPDATE (31 Oct 2026; Akamai/Linode): Linode's status page carries a customer security advisory for CVE-2026-98432. In a post at 2:10 am Perth time on 31 October (18:10 UTC, 30 October), Akamai said it is aware of the recently published remote code execution CVE-2026-98432, is actively investigating and taking the appropriate mitigation actions while it continues to monitor its platform, and asked customers with questions or an impact from the issue to open a support ticket. In an update at 5:18 am Perth time (21:18 UTC) it said it is continuing to investigate, the appropriate subject matter experts are engaged, and updates on mitigation status will be posted as progress is made. The advisory does not describe any impact on customers. (source: Linode status page) UPDATE (31 Oct 2026): In a further update at 9:55 am Perth time on 31 October (01:55 UTC), Akamai said it is deploying mitigations for the underlying known attack vector while it continues to analyse any other possible impact, strongly advised customers to apply OS updates from their upstream provider to their workloads as soon as those become available, and said it has no evidence of this vulnerability being exploited on the Akamai Compute platform. (source: Akamai/Linode) Correction (31 Oct 2026): the card said Red Hat scored the flaw CVSS 3.1 8.1 with attack complexity High, that its VEX file rated the impact Important, and that Red Hat said no mitigation met its criteria. Red Hat has since revised its CVE page and VEX file (current version 30 October, 20:47 UTC; 4:47 am Perth, 31 October) to CVSS 3.1 9.8 and Critical, and added Red Hat Enterprise Linux for NVIDIA 26 and OpenShift Container Platform 5 RHCOS as known affected, still with no fixed packages. Its security bulletin RHSB-2026-016 (public date 30 October) says Red Hat is expediting the release of fixes and gives an nftables rule that drops incoming IPv4 TCP packets containing IP options, which it says reduces exposure but cannot fully prevent it and is not a substitute for patching. (source: Red Hat)
CVE record — CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (published 15 Oct 2026 12:08 UTC)
Mitsubishi Electric published advisory 2026-006 on 15 October 2026 for multiple vulnerabilities in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz, and CISA republished it on 27 October as ICS advisory ICSA-26-300-02 (Mitsubishi Electric's advisory, as republished by CISA). According to Mitsubishi Electric, CVE-2026-16436 (CVSS 4.0 9.2) is an authentication bypass because the challenge response used to unlock the system in the security challenge feature is common to all users and fixed, so a remote attacker who obtains it may be able to unlock the system; CVE-2026-16437 (7.1) lets a local administrator unlock the system by tampering with the management file that stores the challenge response; CVE-2026-16438 (9.4) arises because the installers unnecessarily grant default DCOM permissions to the products' administrator account, so users with that account can locally or remotely launch and operate DCOM objects that should require UAC elevation; and CVE-2023-4863 (9.3), in the bundled libwebp component of GENESIS64 and ICONICS Suite 10.97 to 10.97.2, lets an attacker logged in locally execute arbitrary code by importing a crafted file as an administrator. Mitsubishi Electric says exploitation could result in information disclosure, tampering with, destruction or deletion of information, and a denial-of-service condition. It says there are no plans to release fixed versions of MC Works64, GENESIS32 or BizViz. CISA lists the products as deployed worldwide in critical manufacturing. (source: Mitsubishi Electric advisory 2026-006)
Mitsubishi Electric — Multiple vulnerabilities in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz (advisory 2026-006, 15 Oct 2026)
Google's Chrome Releases blog says the Stable channel was updated on 15 October 2026 to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 for Linux, rolling out over the coming days and weeks, with 10 security fixes. The one Critical bug is CVE-2026-110922, a use-after-free in Prerender reported by Xinyang Ge on 2 October. The six High bugs are CVE-2026-110913 (memory corruption in DOM, reported by Xinyang Ge of Anthropic, assisted by Claude, on 29 September), CVE-2026-110919 and CVE-2026-110921 (use-after-free in V8), CVE-2026-110920 (memory corruption in V8), CVE-2026-110918 (memory corruption in Core, found by Google) and CVE-2026-110917 (memory corruption in SVG, reported by C0rk1). The three Medium bugs are CVE-2026-110916 (improper input validation in Desktop), CVE-2026-110915 (use-after-free in Compositing) and CVE-2026-110914 (memory corruption in Workers). Google does not say any of them is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. The same day, Extended Stable moved to 152.0.7977.169 for Windows and Mac with 10 fixes, including Critical CVE-2026-110151 and CVE-2026-110922, and Chrome 155.0.8059.84 for Android carries the same fixes as desktop. This follows the 13 October 155.0.8059.79/.80 release, which is a separate card. (sources: Chrome Releases; Cyber Security News) Updated 17 Oct 2026 (Cyber Security News): Cyber Security News's report is dated 17 October 2026; details credited to Cyber Security News on this card come from that report.
Chrome Releases — Stable Channel Update for Desktop, 155.0.8059.84/.85 (15 Oct 2026)
Israel's National Cyber Directorate (INCD) published four CVE records on 15 October 2026 for Unitronics UniStream Pro (B10/C10) with UniLogic: CVE-2026-45449 (OS command injection, CWE-78), CVE-2026-45450 (memory-buffer restriction, CWE-119), CVE-2026-45451 (improper authentication, CWE-287) and CVE-2026-45452 (externally controlled format string, CWE-134). Each is rated CVSS 3.1 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) — network reachable with low privileges and no user interaction. Affected builds are UniStream Pro B10/C10 with UniLogic prior to 1.41.329. Solutions in the CVE records: upgrade UniLogic and UniStream to 1.41.329 or above for CVE-2026-45449, and to 1.42.220 or above for the other three. No exploitation is stated in the records. Unitronics PLCs have previously been targeted in OT incidents; treat internet-exposed HMI/PLC pairs as high priority. (source: CVE/INCD records)
CVE-2026-45449 — Unitronics UniStream Pro/UniLogic OS command injection (INCD, 15 Oct 2026)
JetBrains assigned CVE-2026-111094 on 15 October 2026 for TeamCity builds before 2026.2, 2026.1.4 and 2025.11.8: remote code execution was possible through a whitelist bypass in the build messages protocol (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network, high attack complexity, no privileges or user interaction). The same advisory set includes CVE-2026-111095 (stored XSS in the classic project overview, CVSS 8.0) and CVE-2026-111096 (stored XSS in the classic build log, CVSS 6.7). JetBrains lists the fixes on its privacy-security issues-fixed page; there is no report of in-the-wild use in the CVE records. (sources: JetBrains issues-fixed; CVE records)
Red Hat published CVE-2026-92982 on 15 October 2026 (public date 15 Oct 13:33 UTC) for Ansible Operator Plugins. A low-privileged Kubernetes user who can create or modify a custom resource can put Jinja2 expressions in CR spec values; Ansible evaluates those values inside the operator pod without proper sanitisation, so the attacker gets arbitrary code execution in that pod and can use the operator service account's cluster RBAC. Red Hat rates it Important, CVSS 3.1 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), CWE-1336. The markUnsafe flag in Ansible Operator Plugins (used in Red Hat Ansible Automation Platform and OpenShift Container Platform) defaults to false, which is what allows the injection. Mitigation from Red Hat: set markUnsafe: true in watches.yaml for the affected operator so CR spec fields are not evaluated as templates, then restart the operator pod. Red Hat's product impact table was still listing affected OpenShift / AAP-family products with fix status under investigation at last check — do not invent package EVRs; follow the live CVE page for errata. No exploitation is stated. (source: Red Hat CVE-2026-92982)
Red Hat — CVE-2026-92982 Ansible Operator Plugins Jinja2 template injection (public 15 Oct 2026)
On 15 October 2026 BeyondTrust disclosed CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar): improper origin validation in an internal messaging component lets an unauthenticated remote attacker perform file operations on a vulnerable appliance and reach host-level control. Google Threat Intelligence Group / Mandiant says suspected PRC-nexus espionage actor Armory Castle (formerly UNC5221) exploited the flaw as a zero-day in late August 2026 during an incident-response engagement, then deployed the SAWFLY PHP webshell (encrypted C2 via a custom Base32/RC4 channel), escalated to root via an SUID copy of /bin/sh, queried appliance secrets with bt-secrets, and planted reboot-surviving sudoers persistence through post_boot.d. Mandiant says the flaw affects all supported Remote Support versions up to 26.2.3; Remote Support SaaS tenants were patched by BeyondTrust on 9 October 2026 (no customer action for the appliance patch); self-hosted customers on 24.3.1 or later should apply the BT26-05-RS patch from the /appliance interface (or confirm automatic apply); older than 24.3.1 must upgrade first. Mandiant warns any internet-reachable vulnerable appliance during the window should be treated as potentially compromised until reviewed. (source: Google Mandiant / GTIG) CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on 16 October 2026 with a 19 October deadline for US federal agencies and a forensic-triage requirement, not just patching; the entry's notes link BeyondTrust advisory BT26-05. (source: CISA KEV) UPDATE (31 Oct 2026): Rapid7 published a technical analysis of CVE-2026-102764 on 30 October and says a Metasploit module now implements the exploit chain, with PHP and Unix Command targets. Rapid7 says an unauthenticated attacker can start a public customer support session, forge a reserved local router ID in a message's source address so an appliance-side worker accepts it as local, reach an internal file-transfer service, write a PHP file into the site's public directory and run code as the site's operating-system user; no account credentials or user interaction are required. Rapid7 tested Remote Support 24.1.2 and says other affected releases and fixed builds have not been established. For detection, Rapid7 suggests looking for unexpected PHP files under the site's public directory and received files ending in .php.n$t, noting that the .n$t suffix is also used by normal transfers and that a successful exploit need not leave a 'DISCARDING NONLOCAL MESSAGE' log entry. (source: Rapid7) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Google Mandiant / GTIG; Rapid7; CISA KEV)
Google Mandiant / GTIG — Armory Castle exploits BeyondTrust Remote Support CVE-2026-102764 (published with 15 Oct disclosure)
Sonatype published four CVE records for Nexus Repository 3 on 15 October 2026 and fixed them in Sonatype Nexus Repository 3 CE/Pro 3.97.0 (release notes dated mid-October; CVE references point at the 3.97.0 notes and matching support articles). CVE-2026-97712 (CVSS 4.0 8.7 High): a user who only holds role create or role update can grant roles and privileges the account does not hold, including full administrative access. CVE-2026-97665 (CVSS 4.0 7.1 High): a missing authorisation check on the NuGet Components API upload path lets an account with only repository read and browse privileges upload and persist NuGet symbol packages (.snupkg) to a hosted repository when Symbol Server is enabled; if anonymous access is on, the built-in anonymous user can hold those read/browse rights. CVE-2026-97666 (CVSS 4.0 6.9 Medium): an unauthenticated remote attacker can feed attacker-controlled input into a Java class-loading call through an ExtDirect repository endpoint and learn whether specific classes are present — information disclosure only, not code execution by itself. CVE-2026-97667 (CVSS 4.0 5.1 Medium): an account with edit permission on a hosted R repository can store script content in R package metadata that runs in the browser of anyone who opens that package in the Browse UI. Affected ranges differ by CVE (97712 and 97666 from 3.0.0; 97667 from 3.28.0; 97665 from 3.95.0) but all are fixed in 3.97.0. No exploitation is stated in the CVE records. (sources: Sonatype 3.97.0 release notes; Sonatype Support; CVE.org records)
Sonatype — Nexus Repository 3.97.0 release notes (fixes CVE-2026-97712 and related Oct 2026 advisories)
CVE records published on 15 October 2026 assign identifiers to a July 2026 OPNsense security patch set. The lead issue is CVE-2026-57155 (GitHub GHSA-wjqq-rfmm-v5h3, CVSS 3.1 9.9 Critical): the Firewall Alias GeoIP importer downloads a country-IP database from a user-supplied URL and unpacks it as root. An unsanitized country_code field from the CSV is used as the output filename under /usr/local/share/GeoIP/alias, so a user who only holds Firewall Alias Edit can point the importer at a server they control and write attacker-chosen content to an attacker-chosen path as root (directory traversal). That arbitrary root write can be turned into root code execution via the default newsyslog hourly cron. Researcher write-up (HackerAsk, 1 Jul 2026) and the advisory say the chain was reproduced on 26.1.6_2 and 26.1.10. Related CVEs in the same fixed builds: CVE-2026-63442 (CVSS 3.1 8.1 High) — unauthenticated WebGUI login username CRLF log forgery that can add a victim IP to the sshlockout pf table (adjacent network); CVE-2026-58390 (CVSS 3.1 8.0 High) — stored XSS to root RCE via OpenVPN client common_name in status views; CVE-2026-71490 (CVSS 3.1 7.1 High) — comma-separated direct user privileges bypass MVC user-config-readonly write protection; plus several medium XSS/XPath issues. Vulnerable: OPNsense core <= 26.1.10 and <= 26.4.1. Patched: 26.1.11 and 26.4.1p1 (GitHub advisory patched_versions). No known public mass exploitation is stated in the CVE records. (sources: OPNsense GHSA-wjqq-rfmm-v5h3; CVE.org)
OPNsense GHSA-wjqq-rfmm-v5h3 — Root RCE via arbitrary file write in GeoIP Alias Importer (CVE-2026-57155)
