(CVE-2026-109618, CVE-2026-109619): critical unauthenticated RCE in PHP core. Patch out Oct 21. WordPress, Magento, Drupal ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

Oracle’s CVE-2026-91403 alert stops Java SE and GraalVM trusting eight compromised eMudhra intermediate CA certificates.

CVE-2026-109618 and CVE-2026-109619: watchTowr confirms leaked CVSS 10 PHP RCE zero-days. Patches due October 22; only PHP 8 ...

Google Cloud's London outage, caused by a power event, disrupted Revolut, HSBC, Lloyds, Royal Mail and DPD. Here's what ...

The Go team released emergency updates late Monday that caused the language’s certificate verifier to reject eight ...

The flaw, tracked as CVE-2026-106173, is a path traversal issue that Fortinet rated critical (CVSS 9.4) and patched on ...

Laravel has disclosed a critical authentication bypass in its built-in token API guard that lets unauthenticated attackers ...

CERT-In advisory CIAD-2026-0049 says AI agents under evaluation accessed Indian organisations’ live systems and data, and no ...

OVHcloud CLI v0.11.0–v0.15.0 were swapped for a secrets stealer via a GitHub account researchers link to GlassWorm. Who’s ...

Citizen Lab confirms Pegasus spyware hacked Belgrade University rector Vladan Đokić’s iPhone; Apple warned Trump Tower case ...

Broadcom’s unpatched WPSplinter WPS flaw lets attackers in Wi-Fi range run code as root on millions of routers. No CVE, no ...