Drupal Patches Two Critical RCE Flaws (CVE-2026-108097, CVE-2026-108099): Update Now
Drupal shipped fixes for two critical remote code execution bugs and warned that exploits “might be developed within hours or days.” If you run Drupal, this…
Category
Security
Follow Security via RSSBlockStrap (CVE-2026-103849): Critical Magento and Adobe Commerce Flaw, Patch Before It’s Exploited
Sansec is warning that a maximum-severity Magento and Adobe Commerce bug, dubbed BlockStrap (CVE-2026-103849), will likely be exploited soon even though no attacks have been seen…
17 New Vulnerabilities in X.Org Client Libraries: Update libX11, libXpm and Friends
Not even two weeks after a dozen X.Org Server and XWayland vulnerabilities, 17 more were disclosed, this time in the X.Org client libraries. What’s affected libX11,…
FreeBSD Kernel Bug Lets Local Users Get Root: Patch Now
If you run FreeBSD, there’s a fresh kernel fix to grab. Trend Micro’s Zero Day Initiative published ZDI-26-784 (CVE-2026-58093, CVSS 8.8) on October 16. It’s a…
F5 BIG-IP DNS Spoofing Bug: Update Available
Quick one for anyone running F5 gear. F5 published an advisory (K000163710, CVE-2026-10723) for a vulnerability in BIG-IP DNS that could allow spoofing. Affected versions per…
How-To: Hardening a New Linux Server
Every new server I stand up gets the same basic treatment before it does anything else. Here’s the checklist. Update everything and turn on automatic security…
PwnEscape (CVE-2026-99999): Patch Your Linux VM Hosts
If you host VMs for anyone you don’t fully trust, this one’s for you. CVE-2026-99999, nicknamed PwnEscape by the researchers, is a guest-to-host escape. Someone who…
PwnEscape (CVE-2026-99999): Patch Host Kernels for the Checksum Bug
On October 15, 2026, Greg Kroah-Hartman pushed seven stable kernels that include a fix for CVE-2026-99999 — nicknamed PwnEscape in the research write-ups. LWN summarized the…
CISA KEV: Atlassian CVE-2026-21589 + Linux TCP UAF
Two October 15 threads belong in one ops pass. CISA added CVE-2026-21589 — Atlassian multiple products, files/directories accessible to external parties — to the KEV catalog…
CISA Adds Four KEVs (Oct 14): PAN-OS, Cisco Email, AhsayCBS
On October 14, 2026, CISA added four CVEs to the Known Exploited Vulnerabilities catalog: CVE-2026-0322 (Palo Alto Networks PAN-OS code injection), CVE-2026-76519 (Cisco Secure Email Gateway…