News · Security

Vulnerability watch.

The security flaws worth knowing about, in plain English: what’s wrong, who’s affected and what to do. Being exploited, critical in software lots of businesses run, or close to the websites and systems we build.

Last updated 25 October 2026 · RSS feed

Checked every weekdayEach morning we go through CISA’s list of vulnerabilities known to be exploited, vendors’ advisories and the security press.

Sources firstEvery entry links to the vendor’s own advisory first. Fixed versions are quoted from it, never guessed.

Not a substituteIt’s a heads-up, not professional advice or a full feed. If you run the software, follow the vendor’s advisory. Clients: ask us and we’ll check.

25 October 2026High 8.8Being exploited

Microsoft · Windows Shell · CVE-2026-96951

Windows flaw lets booby-trapped files skip the Mark of the Web warning

A command injection bug in Windows Shell lets a crafted file dodge Mark of the Web, the protection that flags files from the internet and triggers SmartScreen and Office warnings. An attacker still has to persuade someone to open the file or click a link, typically by email or chat. Microsoft confirmed it was exploited before the October updates shipped.

Affected: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 to 26H2) and Windows Server 2012 R2 to 2025. Microsoft also lists Outlook.com, which it has fixed on its side.
What to do: Install the October 2026 Windows security updates, for example KB5127648 (Windows 11 24H2, 25H2 and 26H2), KB5127646 (Windows 11 26H1), KB5126653 (Windows 11 23H2), KB5126657 (Windows 10 21H2 and 22H2) and KB5126646 (Windows Server 2025). A restart is required.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.5

Vercel · Next.js · CVE-2026-96889

Next.js image optimisation can be used to run code on Linux servers

A memory bug in sharp, the image library Next.js uses for its Image Optimisation API, can let an unauthenticated attacker run code through a crafted SVG when the app runs on glibc-based Linux. The same out-of-band release fixed a second critical remote code execution flaw in App Router apps using Cache Components ("use cache" functions returning typed arrays, GHSA-673q-mjm6-r5xr, no CVE yet) and a high-severity denial of service in Server Actions. No in-the-wild exploitation has been reported.

Affected: Next.js 10.0.0 to 15.5.27 and 16.0.x to 16.4.0. The image flaw needs glibc-based Linux; the use cache flaw needs App Router with Cache Components; the denial of service needs App Router with at least one Server Action.
What to do: Upgrade to next@15.5.28 or next@16.4.1 and redeploy. Vercel says to upgrade even if your app has no use cache functions, as there is no workaround for that flaw. For the image flaw alone, making sure Next.js uses sharp 0.35.5 or later also fixes it.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.5Being exploited

Citrix · NetScaler ADC and NetScaler Gateway · CVE-2026-88771

Citrix NetScaler gateways taken over without a login, now in mass attacks

An input validation flaw lets an unauthenticated attacker run commands on NetScaler appliances in their default configuration. It was exploited as a zero-day alongside CVE-2026-88772 (a memory overflow reachable when DTLS is on), and after a public proof of concept appeared attacks spread widely; Censys counts around 42,000 NetScalers exposed to the internet. A further exploited flaw, CVE-2026-88779 (denial of service), followed on 4 October.

Affected: NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus FIPS and NDcPP builds before 14.1-73.37 FIPS and 13.1-37.279. CVE-2026-88779 is fixed in 14.1-73.41 and 13.1-64.28. Secure Private Access hybrid deployments using NetScaler are also affected.
What to do: Upgrade to 14.1-73.41 or 13.1-64.28 or later, which covers all three exploited CVEs. Patching does not remove an attacker who is already in: run Citrix's indicator checks and follow its compromise guidance (CTX694799), and Citrix warns its script may miss real compromises.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.2Being exploited

WordPress · WordPress core · CVE-2026-87902

WordPress core flaw lets attackers run code on some sites without logging in

A path traversal bug in how WordPress picks a page template lets an unauthenticated visitor make the site load a PHP file from outside the theme folder. On servers where PHP's register_argc_argv setting is on, and with themes that have a top-level folder whose name starts with "page-" (Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney are named examples), this becomes remote code execution. Patchstack saw attacks begin within hours of the fix on 22 September and grow tenfold the next day.

Affected: WordPress 4.7.0 to 7.1.1 on every branch. Default cPanel PHP setups (before PHP 8.5) and the official Docker php image have register_argc_argv on.
What to do: Update to WordPress 7.1.2 or later (7.1.3, released 6 October, adds seven further security fixes). Fixed releases for older branches include 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12 and back to 4.7.37. If you cannot update at once, turn off register_argc_argv and block traversal sequences in the pagename parameter at your firewall. Check /tmp and /var/tmp for unexpected .php files; if you find any, treat the site as compromised.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026High 8.8Being exploited

Apple · iOS, iPadOS and macOS · CVE-2026-86950

Malicious files can run code on iPhones, iPads and Macs through CoreGraphics

An out-of-bounds write in CoreGraphics means processing a malicious file may lead to code running on the device. Apple says it is aware of a report that it may have been used in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. These updates bring the fix to devices still on iOS 26 and older macOS releases.

Affected: iOS and iPadOS 26 before 26.7.1 (iPhone 11 and later, and supported iPads), macOS Tahoe before 26.7.1 and macOS Sequoia before 15.8.1.
What to do: Update iPhones and iPads to the latest iOS or iPadOS (26.7.1 or later on the 26 line); update Macs to macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1. Turn on automatic updates on company devices.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.8Being exploited

Check Point · Quantum Security Gateway and Spark Firewall · CVE-2026-85102

Check Point and Spark firewalls with VPN enabled attacked through certificate checks

Weak certificate validation during VPN negotiation lets an unauthenticated attacker run code on Check Point gateways using site-to-site or remote access VPN. Check Point fixed it on 9 September, then confirmed on 22 September that attacks against Spark customers had begun on 12 September. In the same advisory it disclosed CVE-2026-93616 (CVSS 9.8), a separately exploited pre-login flaw in Check Point Security Management servers.

Affected: Security Gateway and Spark Firewall (centrally and locally managed) on R81, R81.10, R81.10.X, R81.20, R82, R82.00.X and R82.10. For CVE-2026-93616: Security Management on R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, and older end-of-support releases.
What to do: Apply the fix Check Point released on 9 September (SK1000117) to gateways and Spark appliances, and the Jumbo hotfix in SK1000171 to management servers (Check Point notes LivePatch Take 28/29 does not fix CVE-2026-93616). Review logs for unusual certificate-based Mobile Access logins.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.8Being exploited

Cisco · Cisco Secure Email Gateway · CVE-2026-76519

Cisco Secure Email Gateway taken over by a single crafted email attachment

When the File Reputation service is on, a crafted attachment sent through the gateway can let a remote, unauthenticated attacker write files and run commands as root. Cisco became aware of active exploitation in October 2026, and there is no workaround.

Affected: Cisco Secure Email Gateway (physical and virtual) running vulnerable AsyncOS releases, with File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected.
What to do: Make sure Content Scanner Tools is at 25.3.0.5525 or later, and move to AsyncOS 15.5.5-014 or 16.5.0-780 (16.0 users should migrate to a fixed release).General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.2Being exploited

Collabora · Collabora Online Built-in CODE Server (Nextcloud app) · CVE-2026-110447

Nextcloud's built-in Collabora Office app used to plant backdoors on servers

An OS command injection in the proxy of the Built-in CODE Server app (richdocumentscode) lets an unauthenticated attacker run commands as the web server user, while the built-in office server is not running (for example after a restart or upgrade). It was exploited in September and October, and Nextcloud users reported finding web shells. Standalone Collabora Online servers are not affected.

Affected: The Nextcloud app Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303, including on end-of-life Nextcloud 29 and earlier. Installs using a separate Collabora server, Docker or distro packages, or a Collabora hosting provider are not affected.
What to do: Upgrade richdocumentscode to 26.4.303 or later, or remove it if you do not use it (disabling it is not enough). Run Nextcloud's integrity check, look for unexpected PHP files, and rotate passwords the web server could read, such as database credentials.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 8.6Being exploited

Ivanti · Ivanti Connect Secure · CVE-2026-104935

Ivanti Connect Secure VPN zero-day lets attackers run commands without logging in

An authentication bypass lets a remote, unauthenticated attacker run commands on Ivanti Connect Secure VPN appliances. Volexity found it being chained with other flaws since early October to get root access, with the attacker leaving no malware and tampering with logs. A privilege escalation flaw used in the same chain is not yet patched, and Ivanti says reliable indicators of compromise are not available.

Affected: Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Versions 22.7R2.14 and earlier are not affected.
What to do: Update to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5, depending on your code line. Check for signs of compromise even after patching, as CISA notes Ivanti's Integrity Checker Tool may not see this activity.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.8Being exploited

Fortinet · FortiMail · CVE-2026-104286

FortiMail email gateways hijacked through the encryption service without a login

A path traversal flaw in FortiMail lets an unauthenticated attacker write files to the appliance using crafted web requests to its identity-based encryption (IBE) service. Fortinet says it has been exploited in the wild, and its indicators include an unexpected archive account being added that copies mail to a remote destination.

Affected: FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. FortiMail Cloud was fixed by Fortinet on 5 October.
What to do: Upgrade to FortiMail 8.0.2, 7.6.7 or 7.4.9 or above; on 7.2, move to branch 7.4 or above. Until then, turn off the IBE service or keep the webmail interface off the internet. Check for unfamiliar archive accounts.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026Critical 9.3Being exploited

BeyondTrust · Remote Support · CVE-2026-102764

BeyondTrust Remote Support appliances breached without a login

Internal components of BeyondTrust Remote Support did not check where messages came from, letting an unauthenticated attacker perform file operations on the appliance and, in practice, take it over. BeyondTrust confirmed compromises dating back to 29 August, and Mandiant attributes them to a suspected China-linked espionage group. Remote-support tools are a common route for attackers into an IT provider's customers.

Affected: BeyondTrust Remote Support 26.2.3 and earlier, self-hosted. BeyondTrust patched its SaaS service by 9 October. Self-hosted Privileged Remote Access shares the affected code.
What to do: Self-hosted customers on 24.3.1 to 26.2.3: apply the BT26-05-RS patch now. Older versions: upgrade to a supported version first, then patch. Then check the appliance for signs of compromise and rotate any credentials it stores, as patching does not remove an attacker already present.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

25 October 2026High 8.6Being exploited

Palo Alto Networks · PAN-OS · CVE-2026-0322

PAN-OS firewalls can be taken over through the management interface

A flaw in the PAN-OS management interface lets an attacker who can log in and reach it over the network run code as root on the firewall. Palo Alto has seen very limited exploitation and says no workaround exists. The risk is much lower where the management interface is reachable only from trusted internal addresses.

Affected: PA-Series and VM-Series firewalls and Panorama on PAN-OS 12.2.0 to 12.2.3, 12.1.2 to 12.1.10, 11.2.0 to 11.2.15, 11.1.0 to 11.1.16 and 10.2.0 to 10.2.18 (including hotfix builds), plus unsupported older versions. Cloud NGFW and Prisma Access are not affected.
What to do: Upgrade to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 or 10.2.18-h12 or later (Palo Alto also lists earlier hotfix builds on each branch). Restrict the management interface to trusted internal IPs or a jump box, and never expose it to the internet.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.