#security

Deep Dive

In self-hosted Postiz 2.23.0 to 2.25.2 any registered user can read server files, and in 2.15.0 to 2.25.2 they can forge sign-in tokens to take over other organizations; fixed in 2.25.3.

Deep Dive

Pillow 2.6.0 to 12.3.0 passes an attacker-controlled EPS or PostScript filename to Ghostscript unsanitized, allowing argument injection and command execution; fixed in 13.0.0.

Deep Dive

CVE-2026-110264, a 10.0 integer overflow, exposes every self-managed GitLab since 7.0 to unauthenticated RCE; fixed October 21; its sibling is in KEV.

Deep Dive

CVE-2026-111497 (CVSS v4.0 9.2): Brotli decoder overflow in Node.js, Bun, .NET, Python, Envoy and Istio, now in CISA's Known Exploited Vulnerabilities catalog.

Deep Dive

Four chained flaws in Plex Media Server before 1.43.3.10861 let an unauthenticated attacker run code as the Plex user; exploited in the wild since October 17, 2026.

Deep Dive

Eight eMudhra intermediate CA private keys are computable from their public certificates, enabling site forgery; about 30,800 certificates break when Chrome removes emSign ECC Root CA - G3 on October 27, 2026.

Deep Dive

A threat actor hijacked LiteLLM's release pipeline with a leaked, never-revoked master key and pushed a malicious 1.107.0 to PyPI and Docker on October 21, 2026. The wheel installs Python startup files that steal credentials and open an hourly backdoor even when LiteLLM is never imported. PyPI quarantined the version after 1 hour 44 minutes; anyone who installed it must rebuild the environment and rotate every reachable secret.

Deep Dive

PAN-OS is actively exploited; separately, a chain rooted 25 servers via an undisclosed vendor's firewalls: PHP RCE fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.

Deep Dive

Rejected WebSocket upgrades through Echo's Proxy middleware leave a raw tunnel open to the upstream, and later HTTP requests on that connection skip Echo's router and route middleware, so authentication enforced only at Echo routes is bypassed. The GitHub Advisory Database rates it Critical, CVSS v4.0 9.1, while Echo's own advisory rates it Moderate. Fixed in v4.16.1 and v5.4.1, released October 22, 2026. No public proof of concept and no exploitation in the wild are known.

Deep Dive

Laravel rates CVE-2026-114509 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can sign in as an existing user of the legacy token API guard on MySQL or MariaDB by sending a JSON body like {"api_token": [0]}, without knowing any valid API token. Fixed in 12.68.0 and 13.29.0, with the fix also present in the 11.56.1 tag. A public proof of concept has existed since October 22, 2026, and no exploitation in the wild is known.