Topic
CISA added CVE-2026-119977 to KEV. The WordPress flaw allows unauthenticated code execution during core updates. Fixes shipped October 28 for every branch back to 4.7. Update now and check your logs.
Attackers are encrypting Synology NAS devices on outdated DSM with C3RB3R ransomware. Synology points to a 2024 flaw, 360 to two from September 2026. Both are patched. Here's what to do now.
CISA lists GitLab flaw CVE-2026-97229 (CVSS 10.0) as actively exploited. Alpine Linux was targeted, and a second regex bug makes the first October patch insufficient. What self-hosters should do now.
CVE-2026-98432 in the Linux kernel's IPv4 TCP code: Anthropic's Claude found it and wrote a root exploit. Debian, Oracle and SUSE have patches. Ubuntu and RHEL don't have fixes out yet.
A race condition in WordPress core updates allows unauthenticated code execution (4.7 to 7.1.3, CVSS 8.1, no CVE). Wordfence blocked nearly 63,000 attempts in 24 hours. Fix: 7.1.4 plus backports.
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 9.2) affects Node.js, .NET, PowerShell, Python packages and Bun. CISA reports exploitation. Patches are out.
The PHP2Shell flaws are now being exploited successfully, and CISA lists them as actively exploited. Patches have been out since October 21. Unit 42 has retracted its link to an attack on a government agency.
CVE-2026-110447 (CVSS 9.2) in Nextcloud's built-in Collabora CODE Server is being exploited to plant web shells. A fix exists: 26.4.303 or later. Disabling the app does not protect you.
On Oct 21 a poisoned LiteLLM 1.107.0 hit PyPI and Docker. It steals cloud logins, secrets and AI API keys. Safe version: 1.106.2. If you ran 1.107.0, rotate everything and rebuild.
Blog, cloud, Git and a few websites run on a Mac mini at my place. No open ports on the router, one tunnel to the outside. An overview.