Vercel published a Next.js Security Update for Upstream Vulnerabilities on 14 October 2026, shipping out-of-band fixes that had been postponed from the September security release while upstream dependencies caught up. Two issues are rated critical at CVSS 4.0 9.5: (1) GHSA-673q-mjm6-r5xr — unauthenticated remote code execution in App Router apps with Cache Components when a use cache function returns multiple typed arrays (affected Next.js 16.0.0 through 16.4.0; fixed in 16.4.1; related React advisory GHSA-xqc2-xf4c-x3h3; no known workaround — upgrade even if you think you lack similar functions); (2) CVE-2026-96889 / GHSA-2464-fhr4-w9xw — unauthenticated RCE via the Image Optimization API when attacker-supplied SVG is processed through sharp on glibc-based Linux (affected 10.0.0–15.5.27 and 16.0.0–16.4.0; fixed in 15.5.28 and 16.4.1; workaround is sharp >= 0.35.5). A third issue, GHSA-p3m5-59mp-jv5r (related React GHSA-h3gv-c5rc-p453), is a high-severity denial of service against App Router apps that expose at least one Server Action (crafted requests can pin CPU and block further requests in the same process; Pages Router or apps without Server Actions are not vulnerable; fixed in the same patched trains). (sources: Next.js blog security update; vendor advisories on GitHub)
Next.js — Security Update for Upstream Vulnerabilities (14 Oct 2026)
The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026 for CVE-2026-108097, a remote code execution flaw in the core Field UI module (the admin UI for managing fields and their display). Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). The advisory says the issue is not directly exploitable with core alone, but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication; custom code may also expose the vulnerable functionality. Mitigate immediately by uninstalling the core field_ui module while preparing the upgrade. Fixed releases: Drupal 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 for the 12.0 beta line (beta branch only). Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix. Drupal Steward is described as protecting some known attack vectors but not all. Reported by Drew Webber of the Security Team and Octavio Galland. (source: Drupal SA-CORE-2026-014) UPDATE 14–17 Oct 2026: In the same 14 October security window the Drupal Security Team also published SA-CONTRIB-2026-218 for the contributed Entity List module (entity_list, which builds lists of entities without Views): CVE-2026-108099, remote code execution, rated Critical 19/25 with the same risk vector. As with the core flaw, the module alone is not directly exploitable, but multiple serious exploit paths exist through other contributed modules, at least one known path needs no authentication, and custom code may also expose it. The fix is Entity List 3.0.10. BleepingComputer (17 October) reported both flaws together and noted the Security Team's pre-release warning that exploits might be developed within hours or days of disclosure. No exploitation has been reported so far. The CVE records for CVE-2026-108097 and CVE-2026-108099 are not yet published on cve.org; this card rests on the Drupal security advisories.
Drupal.org — SA-CORE-2026-014: Field UI remote code execution (CVE-2026-108097, 14 Oct 2026)
The util-linux project published two security advisories with CVE records on 14 October 2026 for the set-user-ID mount utility shipped by nearly every Linux distribution. Both need a local low-privileged user whom /etc/fstab already allows to mount something (a user or users entry), and both are time-of-check to time-of-use races won by swapping a path component with renameat2(RENAME_EXCHANGE) in an ancestor directory the attacker can write to. CVE-2026-53612 (GHSA-g8wm-75wr-g2vh) is in the hook_owner post-mount hook: when the fstab entry also sets X-mount.mode, X-mount.owner or X-mount.group, mount runs chmod and lchown on a path that can be redirected to a root-owned file. It affects 2.39 through 2.41.4 and 2.42 through 2.42.1. CVE-2026-53613 (GHSA-8gj5-72r3-428g) is in restricted non-root mount requests, which check the fstab target and then resolve the path again, so the mount can be redirected to somewhere like /etc/sudoers.d. It affects 2.17 through 2.41.6 and 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Both are rated CVSS 3.1 7.0 (local, high complexity). No exploitation has been reported. (sources: util-linux GitHub advisories; CVE records)
util-linux — GHSA-8gj5-72r3-428g, mount target TOCTOU (CVE-2026-53613; 14 Oct 2026)
Palo Alto Networks Unit 42 published on 14 October 2026 its investigation of a long-running intrusion at a telecommunications managed service provider, which it tracks as CL-STA-0954 (also known as UNC5820) and says overlaps with suspected nation-state activity. Initial access, in September 2024, came through CVE-2024-47575 (FortiJump), a missing-authentication flaw in FortiManager's FGFM management channel on TCP 541 (CVSS 3.1 9.8). The attackers registered a rogue virtual FortiGate, then exfiltrated an archive with running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls that protected the provider and its clients. After a long dwell period they used FortiManager to push packet-capture rules to downstream firewalls, targeting unencrypted HTTP, TFTP, RADIUS and LDAP traffic. Unit 42 confirmed that admin and SSL VPN passwords stored as reversible ciphertext in the stolen configs could be brute-forced, and the attackers logged in to perimeter firewalls over SSL VPN with legitimate credentials. They then exploited CVE-2025-61624, a path traversal in the FortiOS CLI auto-script feature that lets an admin write files as root (Fortinet FG-IR-26-122, CVSS 5.4), to drop PEERSTITCH on selected firewalls. PEERSTITCH is a statically linked ARM64 injector that uses ptrace to patch the miglogd logging and iked IPsec daemons in memory. It leaves no binary on disk, opens no listening port and makes no outbound connection, instead hiding its communications in traffic those daemons already handle. Unit 42 did not examine the client networks, so client exposure is configuration and credential material rather than confirmed intrusion. IOCs in the report include 45.32.41[.]202, 198.199.122[.]22, 23.240.77[.]233 and 47.18.167[.]159. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on 16 October 2026 (covering FortiOS, FortiPAM, FortiProxy and FortiSwitchManager), with a 19 October deadline for US federal agencies and a forensic-triage requirement. (sources: Palo Alto Networks Unit 42; Fortinet FG-IR-26-122)
Palo Alto Networks Unit 42 — FortiManager CVE-2024-47575 intrusion and PEERSTITCH malware (14 Oct 2026)
The UK Ministry of Justice published an update on 14 October 2026 on the cyber-attack it identified on 23 April 2025 against the Legal Aid Agency (LAA), the executive agency that runs legal aid in England and Wales. By 16 May 2025 the MoJ had established that the criminal group behind the attack had exfiltrated a large amount of personal data about legal aid applicants and providers. Further forensic analysis now shows that most of the stolen data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period, but about 250,000 records predate 2007. Most of those are from the 1990s and 2000s, a very small number predate 1990, and the earliest verified record is from 1978. The analysis also found that probation data from HM Prison and Probation Service was in the exfiltrated material; the MoJ says none of it relates to victims of crime. Earlier disclosures listed applicant contact details, dates of birth, national ID numbers, criminal history, employment status and financial details such as contributions, debts and payments, plus provider contracts, financial information and LAA Online Portal credentials. The MoJ says the data involved varies greatly between individuals, a pre-2007 record does not mean everyone who dealt with legal aid back then is affected, and it has no indication the stolen data has been published or shared. It is working with the National Crime Agency, the NCSC and the Information Commission. A Ministry of Justice spokesperson told BleepingComputer it is now investing more than £200 million in modernising legal aid digital services and cyber security. (sources: GOV.UK notice; BleepingComputer) Updated 15 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 15 October 2026; details credited to BleepingComputer on this card come from that report.
GOV.UK (Ministry of Justice) — Legal Aid Agency cyber security incident data update October 2026 (14 Oct 2026)
Progress published CVE records on 14 October 2026 for at least 11 vulnerabilities in MOVEit Transfer, its managed file transfer server, all fixed in MOVEit Transfer 2025.1.6 and 2026.0.4 and referenced to Progress's MOVEit Transfer Critical Security Bulletin (September 2026). The highest-rated are CVE-2026-89067, an authentication bypass through an alternate path in Secure Messaging (CVSS 3.1 8.8, low-privileged network attacker; credited to Leo Oliver), and CVE-2026-87093, a service directory writable by local users that allows local privilege escalation (8.8). Several more weaken sign-in: CVE-2026-89068, a missing step in LDAP sign-on authentication (8.1, no privileges needed but high complexity); CVE-2026-89074, an email MFA bypass through unicode handling (7.5); CVE-2026-89070, OIDC authentication replay (7.5); CVE-2026-89073, an OAuth access-restriction bypass through weak session expiry (7.5); CVE-2026-89071, LDAP injection in certificate-based authentication (7.5); CVE-2026-89072, an authorisation flaw in client-certificate management (7.5); and CVE-2026-89077, an identity-validation flaw in SFTP authentication (7.5). The set also includes SQL injection in Custom Reports for admins (CVE-2026-89076, 7.2) and local disclosure of session information (CVE-2026-89075, 7.3). The CVE records do not report exploitation. MOVEit Transfer matters for Australian organisations because internet-facing MOVEit servers were mass-exploited by the Clop gang in 2023 (CVE-2023-34362).
Progress — MOVEit Transfer Critical Security Bulletin, September 2026 (CVE records published 14 Oct 2026)
Juniper Networks published its October 2026 Junos OS and Junos OS Evolved security advisories on 14 October 2026, with CVE records for at least 16 issues. The most serious are in J-Web, the built-in web management interface. CVE-2026-101956 (JSA112188) lets an unauthenticated remote attacker run arbitrary Junos commands with root privileges through an exposed J-Web interface. CVE-2026-101986 (JSA112187) bypasses J-Web authentication to run CGI content with elevated privileges using a crafted HTTP request. CVE-2026-101983 is a stack buffer overflow in httpd that an unauthenticated attacker can reach when a J-Web virtual-domain is configured. Juniper rates all three 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0). Other bugs rated 9.8 are CVE-2026-33792, a stack overflow in srxpfe on SRX Series triggered by a crafted packet on a configured GRE tunnel (JSA112186); CVE-2026-102182 in kmd on MX Series via certificate-based IKE packets (JSA112196); and CVE-2026-33789 and CVE-2026-33796 in rpd when BGP Monitoring Protocol (BMP) is enabled (JSA112187). The release also fixes an SRX ADVPN peer-message overflow (CVE-2026-102084), an SRX Security Intelligence feed format-string bug (CVE-2026-102062), an authd overflow reachable with SNMP read access when SNMP and AAA are on (CVE-2026-101979), and a PTX zero-touch provisioning DHCP command injection (CVE-2026-101967), among others. Juniper SIRT says it is not aware of malicious exploitation, and lists no workarounds for the J-Web, GRE and IKE issues. (sources: Juniper's JSA advisories; Juniper-issued CVE records) UPDATE 19 October 2026: Singapore's Cyber Security Agency (alert AL-2026-146, 19 Oct) and Belgium's CCB (16 Oct) have issued patch-now warnings for the same release, and both list further 9.8-rated bugs that Juniper's CVE records (all referencing JSA112187) confirm: CVE-2026-101954, a fourth unauthenticated J-Web flaw, in J-Web and its NETCONF session handling, that gives root-level configuration access and full device takeover when web management is reachable (Junos OS 25.2, 25.4 and 26.2 trains and matching Evolved releases); CVE-2026-102178, a stack overflow in the BGP daemon triggered by flowspec route re-advertisement from a configured flowspec peer when BGP update-threading is enabled; CVE-2026-101990, an rpd stack overflow from a flow-spec update selected for re-advertisement (code execution on Junos OS, crash on Evolved); CVE-2026-101982, an rpd stack overflow from EVPN-VPWS route advertisements by a configured BGP/EVPN peer (root code execution on Junos OS); and CVE-2026-102175, a heap overflow in the sdxd service-deployment daemon reachable by an attacker who controls or intercepts the configured SDX/SRC server connection. All are rated 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0) by Juniper and are fixed in the same releases as the J-Web bugs. Still no reported exploitation.
Noma Labs published SneakPeek on 14 October 2026, an exploit chain in the preview pane of Claude Code Desktop, the desktop app's coding interface. When Claude reads or edits an HTML file, the pane renders it automatically. Files under 256 KB load as data: URLs with a Content Security Policy that blocks scripts. Files over 256 KB were written to a temporary file and loaded from file://, where the CSP was not applied. The request filter meant to stop local file reads only worked when the pane was proxying a dev server, not when rendering a static file from disk. Noma's proof of concept hid a payload in an oversized test-coverage report in a public repo. Once the victim cloned it and asked Claude to look at the report, the script read SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes and Docker credentials, Git tokens and Claude's own OAuth tokens. It then sent them out with navigator.sendBeacon, and could leak the user's real IP address through WebRTC, with no permission prompt. Noma reported it on 4 July 2026. Anthropic scored it 8.7 (CVSS 4.0, high) and treated it as equivalent to code execution on the host. Its first patch blocked file:// fetches from the page, but Noma bypassed that with a Web Worker created from a blob: URL. Anthropic then shipped a complete fix in Claude Desktop 1.30096.1 (17 August 2026), delivered by auto-update. Noma says a GitHub advisory and CVE are still pending. No in-the-wild exploitation is reported. Separate from the Claude Code plugin SHA-pin bypass (CVE-2026-86063) on Cyberstack.
Noma Labs — SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data (14 Oct 2026)
OpenVPN's CNA published CVE-2026-84471 on 14 October 2026 (CVE record datePublished 14:29 UTC). The community security announcement describes a possible double-free of a TLS session buffer in the lame-duck path because the guard in check_session_buf_not_used() was incomplete, extending the earlier work on CVE-2026-13117. The CVE description (also from OpenVPN) frames it as an incomplete fix for the related CVE-2026-12996 use-after-free and says a remote authenticated peer can cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry (CWE-416). OpenVPN rates it CVSS 4.0 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H). Affected lines in the CVE record are OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7; the vendor announcement says 2.6.0–2.6.22 and 2.7_alpha1–2.7.6 are affected and lists fixed builds 2.6.23 and 2.7.7. GitHub release notes for openvpn 2.6.23 (23 September 2026) explicitly credit the improved check_session_buf_not_used() / double-free lame-duck fix as CVE-2026-84471. No public exploitation is reported. Related earlier TLS-session memory issues on the same code path include CVE-2026-12996 (fixed in 2.6.21 / 2.7.5) and CVE-2026-13117.
OpenVPN community — CVE-2026-84471 security announcement (possible double-free in check_session_buf_not_used() lame duck handling; fixed 2.6.23 / 2.7.7)
nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) on 14 October 2026 with fixes for five vulnerabilities, and F5 published matching advisories and CVE records the same day. The three most serious hit the NGINX data plane and are rated High 8.1 (CVSS 3.1) and Critical 9.2 (CVSS 4.0) by F5: CVE-2026-97205, a use-after-free in ngx_http_core_module when asynchronous file I/O (AIO) is on and a Server Side Includes page uses an include virtual command; CVE-2026-93479, a heap buffer overflow when map regex capture variables are evaluated in a root directive or access-log format before the map's own variable; and CVE-2026-15176, a heap buffer overflow when a location combines alias with rewrite and a set or return that references $request_filename (or $request_filename appears in a log_format). A remote unauthenticated request can crash and restart workers; F5 says code execution is possible only if ASLR is disabled or bypassed, and each bug needs a specific configuration. The same release also fixes CVE-2026-95101, HTTP/3 request body injection (F5 CVSS 5.3 / 6.9), and CVE-2026-97629, session forgery when TLS session ticket keys are rotated (6.5 / 8.3). nginx.org itself grades all five medium. NGINX Plus 37.x, NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric and some NGINX Ingress Controller releases are also affected; Plus R35 and R36 get no fix. No exploitation has been reported. Separate from the October nginx-ui card on Cyberstack (a different project).
nginx.org — nginx security advisories (CVE-2026-15176, -93479, -95101, -97629, -97205; not vulnerable 1.31.7+, 1.30.6+; 14 Oct 2026)
Ahsay AhsayCBS Command Injection Vulnerability. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Ahsay AhsayCBS Improper Authentication Vulnerability. Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
