Today's cybersecurity landscape reveals a flurry of critical vulnerabilities across major platforms, alongside notable data breaches and evolving threat actor tactics. Software updates are essential to mitigate risks, as active exploitation of several flaws is already underway.
Critical Linux Kernel Flaw 'PwnEscape' Exposes Host Memory to Guest VMsVulnerability
A newly identified critical vulnerability, dubbed 'PwnEscape' (CVE-2026-99999), in the Linux kernel's networking code allows virtual machines (VMs) to potentially read memory from their host systems. This widespread flaw affects various cloud environments, as demonstrated by a researcher against Vercel's live cloud sandboxes.
Why it matters: If your website or application runs on a Linux-based virtual machine, this vulnerability could allow an attacker on a co-located VM to access sensitive data from your host, necessitating immediate updates from your cloud provider.
Read more at The Hacker News ↗
Palo Alto Networks PAN-OS Vulnerability Actively Exploited for RCEVulnerability
Palo Alto Networks has released patches for a high-severity remote code execution (RCE) vulnerability (CVE-2026-0322) affecting the management interface of its PAN-OS software. This flaw has been confirmed to be under active exploitation, prompting urgent action from users.
Why it matters: If your business uses Palo Alto Networks firewalls, ensure they are updated immediately to prevent potential remote code execution and compromise of your network perimeter.
Read more at The Hacker News ↗
Next.js Patches Critical RCE Flaws in Caching and SVG ProcessingVulnerability
Next.js has issued an out-of-band security update addressing two critical remote code execution (RCE) vulnerabilities, one in React Server Components and another in the librsvg library used for SVG image handling. An additional high-severity denial-of-service flaw was also fixed.
Why it matters: If your website is built with Next.js, updating to the latest versions (e.g., 1.30.6, 1.31.7) is crucial to protect against unauthenticated attackers who could run malicious code on your server.
Read more at The Hacker News ↗
Drupal Core's Field UI Module Vulnerability Allows Unauthenticated RCEVulnerability
A critical flaw in Drupal core's Field UI module (CVE-2026-105740) could allow unauthenticated remote code execution, particularly when certain contributed modules are also installed. Drupal has released security updates for versions 11.4.10, 11.3.19, and 10.6.19 to address this issue.
Why it matters: If your website runs on Drupal, promptly updating to the patched versions is vital, especially if you use contributed modules, to prevent attackers from executing arbitrary code on your server.
Read more at The Hacker News ↗
Nginx Addresses Five Flaws, Including Potential RCE and TLS BypassVulnerability
Nginx has released updates (versions 1.30.6 and 1.31.7) to fix five vulnerabilities, including three memory bugs that could lead to crashes or remote code execution under specific configurations. Another flaw could allow attackers to forge a TLS session, potentially bypassing client certificate checks.
Why it matters: As Nginx is widely used, ensure your Nginx installations are updated to the latest versions to mitigate risks of server crashes, unauthorized code execution, and potential TLS security bypasses.
Read more at The Hacker News ↗
Collabora RCE Flaw Exploited to Backdoor Nextcloud ServersVulnerability
Threat actors are actively exploiting a critical remote code execution vulnerability (CVE-2026-110447) within the Collabora Online - Built-in CODE Server app for Nextcloud. This exploitation allows attackers to install backdoors on affected Nextcloud servers.
Why it matters: If your business uses Nextcloud with the Collabora Online app, prioritize applying the necessary patches to prevent attackers from gaining unauthorized access and backdooring your server.
Read more at BleepingComputer ↗
UK Legal Aid Agency Data Breach Impacts Records Dating Back to 1978Breach
The UK's Legal Aid Agency (LAA) has disclosed that a breach in April 2025 resulted in the theft of records spanning from 1978 onwards. While most of the compromised data relates to applications, claims, and payments between 2007 and 2025, the extensive timeframe highlights the long-term impact of the incident.
Why it matters: This incident underscores the importance of robust data retention policies and securing historical data, as older records can still hold sensitive information valuable to attackers.
Read more at BleepingComputer ↗
CenterPoint Energy Data Breach Affects 1 Million TexansBreach
CenterPoint Energy, a major utility company, experienced a data breach that compromised the personal information of approximately one million Texans. The exposed data includes sensitive details such as names, addresses, Social Security numbers, and driver's license numbers.
Why it matters: Small businesses and their employees in the affected region should be vigilant against phishing attempts and identity theft, as their personal data may have been exposed in this breach.
GhostAction Campaign Compromises 1,900 GitHub Accounts, Targets 30,000 RepositoriesThreat
The 'GhostAction' credential-theft campaign intensified recently, compromising around 1,900 GitHub accounts and attempting to extract secrets from over 30,000 public repositories. This significant surge in activity was observed on October 8th and 9th, 2026.
Why it matters: If your business uses GitHub for code management, implement strong authentication (like MFA) and regularly audit repository access to prevent unauthorized access and potential data exfiltration.
Read more at The Hacker News ↗
Tech Support Scams Leverage 20,000+ Cloudflare Pages DomainsThreat
A long-standing Traffic Distribution System (TDS) known as Help TDS, linked to the Russian affiliate program Hotejka, is exploiting over 20,000 Cloudflare Pages domains to host tech support scams. This operation, active since at least 2017, redirects unsuspecting users from compromised websites to fraudulent scam pages.
Why it matters: Regularly monitor your website for unauthorized PHP code injections, as compromised sites are being used as redirect vehicles for widespread tech support scams, potentially harming your visitors.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.