SecureRoot: critical and exploited vulnerabilities

CVE-2026-97229: GitLab CI/CD regular expression integer overflow allows unauthenticated RCE

Thu, 29 Oct 2026 00:00:00 +0000

An integer overflow in the Onigmo regular-expression compiler in the Ruby that GitLab CE/EE ships lets an unauthenticated attacker run code on the GitLab server by submitting a specially crafted regular expression in a CI/CD configuration; it bypasses the incomplete fix for CVE-2026-93577 in GitLab 19.4.1. GitLab fixed it in 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026, and the underlying Ruby bug is fixed in Ruby 4.0.8, 3.4.12 and 3.3.13, so other Ruby applications that compile attacker-contro

CVE-2026-46300: Linux kernel ESP-in-TCP page-cache write to root (Fragnesia)

Wed, 28 Oct 2026 00:00:00 +0000

skb_try_coalesce() in the kernel networking core (net/core/skbuff.c) drops the shared-fragment marker when it merges socket buffers, so the IPsec ESP receive path (ESP-in-TCP) can decrypt in place over page-cache pages of files the attacker can only read. A local unprivileged user can overwrite the cached copy of a SUID binary such as /usr/bin/su and get a root shell; Ubuntu notes it may also allow container escape. A public exploit exists, and CISA added it to KEV on 28 October 2026, noting it

CVE-2026-111497: Brotli decoder out-of-bounds write in Node.js enables RCE (Node2Shell)

Tue, 27 Oct 2026 00:00:00 +0000

An unchecked return value in the Google Brotli decoder (versions 1.0.3 to 1.2.0) turns a malformed block switch into an out-of-bounds write, so attacker-supplied Brotli data reaching Node.js through request bodies with Content-Encoding: br (Express 5 / body-parser 2), Brotli responses decoded by fetch(), or node:zlib Brotli calls can crash the process, leak memory or run code. Public exploits give a shell on official Node.js 24.22.0 builds and CISA added it to the KEV catalog on 2026-10-27 (due

CVE-2026-48356: Adobe Commerce / Magento unrestricted file upload (APSB26-73)

Tue, 27 Oct 2026 00:00:00 +0000

Adobe Commerce and Magento Open Source accept upload of files with a dangerous type, which Adobe rates critical (CVSS 9.6) and says can lead to arbitrary code execution; no authentication is required but a victim must open a crafted URL or page. It was fixed in the July 14, 2026 security update APSB26-73. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-27, so it is being exploited in the wild.

CVE-2026-109618: PHP out-of-memory handling corrupts request memory, remote code execution

Mon, 26 Oct 2026 00:00:00 +0000

When PHP hits an out-of-memory error it aborts the request with longjmp(), which can leave request memory partly initialized; request cleanup then treats it as valid, which attackers can turn into remote code execution. An unauthenticated attacker can trigger the out-of-memory condition with crafted multipart POST requests, and with Apache mod_php this happens before any application code runs; PHP-FPM is also considered susceptible. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; CISA added it t

CVE-2026-109619: PHP stale request state reused by the next request, remote code execution

Mon, 26 Oct 2026 00:00:00 +0000

PHP worker processes keep some global state (error, session, object and extension state) that points into a request's memory; after a fatal error or a late warning it is not reset, and the next request on the same worker can use the freed memory (use after free). An unauthenticated attacker can chain two requests to the same worker to get remote code execution: PHP confirmed this against Apache mod_php and, through session upload progress plus an application fatal error, against PHP-FPM. Fixed i

CVE-2026-105482: Node.js dns.resolve*() silently truncates hostnames at a NUL byte

Fri, 23 Oct 2026 00:00:00 +0000

dns.resolve*() and dns.reverse() pass names to c-ares as C strings, so attacker.example\0.trusted.example is resolved as attacker.example without an error. Applications that validate a hostname (for example against an allowlist) and then resolve it can act on records for a different name. This is an incomplete fix of CVE-2026-48930; fixed in the October 21, 2026 releases (High, CVSS 7.4; Red Hat Important), with no known exploitation.

CVE-2026-105483: Node.js TLS hostname check bypass with fullwidth-digit IP addresses

Fri, 23 Oct 2026 00:00:00 +0000

tls.checkServerIdentity() does not treat hosts written with non-ASCII digits (such as fullwidth １２７.0.0.1) as IP addresses, although they resolve to a normal IPv4 address, and matches them against certificate DNS names instead. A certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 can then authenticate an IP endpoint it was not issued for. This regression from the CVE-2026-48618 fix affects only 24.x and 26.x; fixed October 21, 2026 (High, CVSS 7.4), no known exploitation.

CVE-2026-106069: Node.js TLS hostname check bypass with leading-zero IPv4 hosts

Fri, 23 Oct 2026 00:00:00 +0000

tls.checkServerIdentity() normalizes hosts with WHATWG URL rules, reading a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the operating system resolver on some platforms, such as macOS, connects to 127.0.0.1. A server at the connected address can therefore be authenticated with a certificate issued for a different IP address. Fixed in the October 21, 2026 releases (High, CVSS 7.4; Red Hat Important); no known exploitation.

CVE-2026-110447: Nextcloud Collabora Built-in CODE Server (richdocumentscode) command injection

Fri, 23 Oct 2026 00:00:00 +0000

The Nextcloud app 'Collabora Online - Built-in CODE Server' (richdocumentscode) before 26.4.303 has an unauthenticated OS command injection in proxy.php that runs commands as the web server user while the built-in CODE server is not running (after a restart, upgrade or crash). It was exploited in the wild in September and October 2026 to drop PHP web shells, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-23. Standalone Collabora Online servers (Docker or distro packa

CVE-2026-110264: GitLab Org-mode regex integer overflow allows unauthenticated RCE

Thu, 22 Oct 2026 00:00:00 +0000

GitLab CE/EE renders Org-mode files with the org-ruby gem, which builds a regular expression from an attacker-supplied #+TODO: keyword; a keyword with more than 32,767 repeats overflows a 16-bit counter in Ruby's Onigmo regex engine and causes an out-of-bounds write at match time. An unauthenticated attacker can turn this into code execution on the GitLab server as the git user, exposing gitlab-secrets.json, CI/CD variables, runner and access tokens, and every repository. GitLab rates it critica

CVE-2026-106931: SiteGuard Server Edition statistics feature OS command injection (root)