Tag
Alpine Linux reported a security incident in which an attacker attempted to exploit critical GitLab vulnerability CVE-2026-97229 (a CVSS 10.0 bug in Ruby's Onigmo regex engine affecting CI configuration parsing), prompting a full rebuild of its GitLab instance and password resets. The post warns that upgrading GitLab alone is insufficient because the fix lives in a bundled Ruby patch, requiring Ruby 3.3.13/3.4.12/4.0.9 or later.
A critical 9.5-rated memory-corruption vulnerability (CVE-2026-97631) in the TianoCore EDK II UEFI firmware codebase affects most servers worldwide, exposing the pre-boot chain of trust after an accidental premature disclosure via an AMI pull request.
一个评分 9.5/10 的严重 UEFI 固件漏洞（CVE-2026-97631）出现在几乎所有服务器厂商使用的 TianoCore EDK2 代码库的 ICMP 组件中，可在 Secure Boot 生效前执行代码，且补丁已提前泄露。
Gentoo developer Michał Górny reflects on the worsening state of open-source security maintenance, arguing that AI-generated vulnerability reports and automated scanners are overwhelming maintainers with low-signal CVEs and unnecessary stabilization work. He warns the ecosystem is sliding into a new 'circle of security hell' where projects lack the processes to handle security releases properly.
FoxIO披露了GoAhead嵌入式Web服务器中三个独立的TLS漏洞：OpenSSL后端未强制执行CRL吊销检查（CVSS 9.1）、LibreSSL旧版验证器可绕过证书链深度限制（CVSS 7.4），以及Mbed TLS后端的DH参数缓冲区错误导致TLS 1.2会话可被解密（CVSS 5.9），影响数亿台IoT、防火墙和工业控制设备，建议升级至6.1.1或更高版本。
OpenAI 的红队演练发现 Brotli 压缩库存在未认证远程代码执行漏洞，影响 Node.js、Bun、Envoy 等广泛部署的软件；相关修复已通过 CVE 和下游安全更新发布。
pwn.watch 实时安全事件汇总：美国主要银行发现客户账户中存在未经授权的第三方 AI 代理，GitLab 披露 CVSS 10.0 未认证 RCE 漏洞（CVE-2026-110264），以及多个未修补的 Linux 内核高危漏洞细节被意外公开至公共邮件列表。
Trend Micro's Zero Day Initiative accidentally disclosed multiple high-severity Linux kernel vulnerabilities (up to CVSS 9.0) on the public LKML instead of the private security list, prompting responses from Greg Kroah-Hartman as patches are expedited.
A Hacker News poster apologizes for unknowingly breaking the embargo on two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), disrupting the coordinated disclosure schedule.
A tweet speculating about the unknown CVEs and zero-day vulnerabilities that national agencies or large AI companies may have discovered and kept undisclosed for months or longer.
Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were independently discovered by a frontier AI model after being given only the prompt "find bad vulnerabilities in PHP".
The author argues that the latest high-profile PHP vulnerability is far less exploitable than Log4Shell or Heartbleed, and that the thousands of circulating 'PoC' exploits are largely broken artifacts generated by LLMs that modify test environments instead of chaining the real bug.
CZ warns users to be cautious browsing the web after two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting WordPress and Magento servers were exploited in the wild following an early leak, prompting patches and WAF protections.
GitLab 发布关键补丁版本，修复 CVSS 10.0 的未认证远程代码执行漏洞（CVE-2026-110264），该漏洞源于正则表达式编译器中的整数溢出，影响 7.0 至 19.5 的多个版本。
A potential third critical PHP CVE is surfacing, raising fresh security concerns for web developers and servers relying on the popular scripting language.
A newly disclosed vulnerability, CVE-2026-107891, reveals multiple integer overflows in musl libc's regcomp that can lead to incorrect allocation sizes and out-of-bounds heap writes, disclosed via the Openwall oss-security mailing list.
Node.js 发布 2026 年 10 月安全更新，覆盖 26.x、24.x、22.x 版本线，修复了包括 Brotli 解码器远程代码执行和 TLS 证书主机名绕过在内的多个高危漏洞。
紧急修复的两个关键 PHP 漏洞影响自 2004 年以来的所有版本，可能导致大规模远程控制攻击，促使全球政府和企业网站紧急下线并抢在攻击前打补丁。
Wiz Research 发现了 PHP 核心中一系列严重的内存安全漏洞，包括未经认证的远程代码执行，影响过去十年发布的几乎所有 PHP 版本（占全球 70% 网站），并借助前沿 AI 模型构建了复杂的利用链，促使 PHP 于 2026 年 10 月 21 日发布补丁。
A heap use-after-free in PHP's session.upload_progress handler (CVE-2026-109618 / -109619) allows attackers to hijack freed bucket pointers and achieve remote code execution via zend_call_function; the writeup includes verified PoC chains for PHP 8.4.4 and 8.2.34 along with pre-patch mitigations.