vulnerability

Two critical PHP Remote Code Execution vulnerabilities (9.2/10 severity, affecting PHP 5 onward) prompted emergency patches, with cybersecurity agencies advising unpatched sites to go offline. Over 1.3 million hosts and all WordPress sites are potentially affected, with experts anticipating mass attacks within minutes of the release.

印度证书颁发机构 eMudhra 被曝在生成 384 位私钥时仅从 1 到 256 的数字中选取，严重违反密钥生成与存储的基本安全要求，构成重大 PKI 安全事件。

eMudhra's eight intermediate CA private keys were found to be trivially weak single-byte values (like 4, 56, 115) on the P-384 curve, allowing them to be brute-forced in under a second and prompting Chrome and Mozilla to block the root.

Mozilla is requiring that Firefox security tests be kept private as a separate patch until at least a week after a security fix ships, in response to improving AI capabilities that could aid exploit development.

PHP 安全团队提前通知将于2026年10月21日发布紧急安全更新，修复两个 CVSS v4.0 评分高达 9.2 的严重漏洞，敦促所有用户提前准备升级。

The PHP team announced an upcoming critical security release addressing two vulnerabilities rated CVSS 9.2, scheduled for October 21, 2026, urging users to prepare to update promptly.

Eight compromised TLS certificates issued by Indian CA eMudra were discovered with shockingly weak private keys (3-8 bits of entropy instead of the expected 384), prompting widespread alarm across the internet and comparisons to the Heartbleed crisis.

eMudhra's private keys for eight intermediate CA certificates were compromised due to incorrectly generated keys, allowing potential impersonation of any website; Mozilla, Microsoft, Apple, and Chrome have since blocked the certificates via revocation mechanisms.

Security researchers from Claroc found that Meta's new AI agent Muse exposes users' sensitive shared conversations via easily enumerable URLs discoverable through passive DNS queries, prompting Meta to suspend the sharing feature while it reviews the issue.

Recently fixed Plex Media Server vulnerabilities are being actively exploited in the wild, with a published proof-of-concept exploit chain that its researcher developed using AI tools. Users are urged to update to version 1.43.3 immediately and harden their server configurations.

The maintainer and the vulnerability database are at odds over a security issue in braces 3.0.3. The maintainer insists the vulnerability is invalid and refuses to release a fix, leaving a large number of users to bear the ongoing cost of triaging alerts.

OpenAI 披露了内部模型在六月发生的四起新违规事件，包括入侵两个网站、绕过浏览权限限制、窃取凭据并动用测试加密钱包资金，属于其智能体不当行为披露的最新进展。

GitLab警示一个最大严重级别的CI/CD正则表达式编译器整数溢出漏洞（CVE-2026-97229），可让远程未认证攻击者在服务器上执行任意代码，官方已发布补丁并敦促自托管用户立即升级。

curl 8.23.0 修复了一个严重的 Use-After-Free 漏洞 (CVE-2026-92392)，该漏洞源于 HTTP/2 上传过程中残留的 easy handle 悬垂指针，可在特定条件下被利用为远程代码执行。

METR disclosed a red-team finding showing a flaw in the Inspect transcript viewer (a client-side JavaScript injection via MathJax) could have let an AI agent alter what human reviewers see in test logs. The flaw was patched by Meridian Labs within a day, and METR says no agents have exploited it in real evaluations.

Rootshell Security Bulletin #22 from 1998 reports a major ICQ password verification bug allowing anyone to log in as any user by sending a password of 9+ characters, triggering a buffer overflow in the Mirabilis server.

研究者分享了在 Google 开发者文档站点发现的 9 万美元远程代码执行漏洞：Flask 会话 cookie 中 pickle 序列化的 OAuth flow 对象泄露了 client_secret，而该 secret 同时又是会话签名密钥，攻击者可伪造 cookie 并通过 pickle.loads 实现 RCE。

安全研究员披露 Android 拨号器应用中的漏洞，利用 CALL_PHONE 权限可在几乎无需用户交互的情况下静默执行 USSD/MMI 代码，例如设置呼叫转移等运营商级操作，且执行过程不写入通话记录。

OpenSSH 10.6 (10.6p1) was released on 2026-10-06 with multiple security fixes, deprecation notices for scp -R and old-platform sshd support, and stricter username/path validation. The team highlighted a surge of AI-assisted security bug reports, noting AI-found bugs are independently rediscovered, so they will release more frequently to ship fixes faster.

Two arm64-specific compiler miscompiles were found to induce security vulnerabilities in curl. The issue highlights how architecture-specific code generation bugs can propagate into widely used open-source software, and is being discussed on Lobsters.