Vulnerabilities
New CVEs and flaws
Debian issues vim security update fixing 40 vulnerabilities
Debian advisory DSA-6600-1 covers 40 CVEs in Vim, spanning path traversal in the tar and zip plugins, buffer overflows and underflows, out-of-bounds reads and writes, crashes, and command or code injection. Several issues are reachable through netrw, NetBeans, completion, spell files and tag files, so the risk comes from opening untrusted content. Systems running Vim should install the Debian update.
Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.
CISA official criticises Chainguard for releasing a PHP bug early
Chainguard reportedly broke an embargo by releasing details of a critical PHP vulnerability early. A CISA official described the move as dangerous, arguing that AI is adding to the pressures facing cyber defenders.
Debian issues security update fixing multiple vulnerabilities in DPDK packet processing libraries
Debian Security Advisory DSA-6597-1 patches several vulnerabilities in the dpdk package, a library suite for fast packet processing. Depending on which features are enabled, crafted packets or malicious guest requests could trigger denial of service or memory corruption. Administrators running dpdk on Debian should apply the vendor update.
Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.
TeamViewer flaw could let attackers run code on IT support technicians' computers
HackRead reports a TeamViewer vulnerability that could allow attackers to execute code on an IT support technician's machine. The excerpt is truncated before explaining the trigger condition, so the attack method, affected versions and patch status are not stated.
AWS discloses credential exposure flaw in Kinesis Producer Library for Java (CVE-2026-119117)
AWS published CVE-2026-119117 affecting the Amazon Kinesis Producer Library for Java. When the logger is set to DEBUG, the AWS credentials the library resolved can be written to log files. Separately, affected versions pass the credentials to the native child process as command-line arguments, so a local user can read them from the process argument list. Versions before 1.0.8 are affected.
FreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)
AWS has disclosed CVE-2026-119086, a missing type validation issue in xQueueSelectFromSet in FreeRTOS-Kernel. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in a privileged context, affecting the integrity of privileged execution. Builds without queue sets are not affected.
Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys
Cloudflare reports that eMudhra's eight intermediate private keys, one of which was simply the number 4, can be recovered from the public certificates, letting anyone forge certificates that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched high-priority systems, including Pingora origin-facing proxies, within hours and logged about 22,000 handshakes using the weak keys, all refused where verification was enabled. About 160 handshakes carried forged certificates, one dated less than an hour after Mozilla's bug report went public, but they appeared to be servers' own default certificates rather than interception attempts.
TeamViewer fixes flaw letting a remote host attack the computer controlling it
TeamViewer has patched a vulnerability that allows a malicious or compromised host in a remote session to attack the viewer, the machine that connects and takes control. The host can exploit it to crash the viewer's TeamViewer, and depending on the platform may also run further actions. The available text is truncated, so the full consequences are unclear.
AWS Nitro Enclaves SDK for C hit by use-after-free and KMS impersonation flaws
AWS published bulletin 2026-157-AWS covering two issues in the AWS Nitro Enclaves SDK for C, affecting versions up to and including v0.4.5. CVE-2026-119116 is a use-after-free in the kmstool-enclave example application that lets an application on the parent EC2 instance send crafted vsock messages to run arbitrary code inside the enclave. CVE-2026-119148 is an input validation flaw in the SDK library that could let a third party impersonate KMS and inject forged responses.
Canadian Cyber Centre flags vulnerabilities in Laravel MongoDB versions before 5.12.0
The Canadian Centre for Cyber Security issued advisory AV26-1107 on 30 October 2026, stating that as of 28 October 2026 Laravel MongoDB versions prior to 5.12.0 are affected by vulnerabilities. It encourages administrators to review the linked references and apply any necessary updates as they become available. The advisory text provides no further detail on the flaws.
HashiCorp fixes Nomad symlink escape and Boundary SSRF flaws in new security advisory
The Canadian Centre for Cyber Security has published advisory AV26-1106 covering HashiCorp vulnerabilities as of 29 October 2026. HCSEC-2026-52 affects Nomad, where dispatch payload writes can escape the allocation directory through symlinks. HCSEC-2026-54 affects Boundary, which is vulnerable to server-side request forgery in the Vault credential store. Administrators should review the vendor advisories and apply updates.
PHP2Shell attacks root Palo Alto firewalls but fail against WordPress
Critical PHP vulnerabilities, referred to as PHP2Shell, have been targeted in attacks for over a week. The attacks have gained root access on Palo Alto firewalls but failed against WordPress. Around 22.6 million exposed instances are potentially affected.