🚨 ACTIVE EXPLOITATION
- CISA adds exploited Collabora Online CODE Server command injection flaw (CVE-2026-110447) to KEV
CVE-2026-110447
CISA has added CVE-2026-110447, a remotely exploitable command injection flaw in the Collabora Online Built-in CODE Server Nextcloud app, to its KEV catalog.- Affects Collabora Online Built-in CODE Server (richdocumentscode) before 26.4.303 when used within Nextcloud; standalone Collabora Online servers are not affected.
- Unauthenticated OS command injection (CWE-78) in proxy.php enables remote code execution with critical 9.2 CVSS v4.0 score.
- The flaw is only reachable when the local CODE server is not running, e.g. after restart, upgrade, or crash; attackers can execute arbitrary commands and deploy web shells.
- Actively exploited in the wild in September–October 2026; KEV remediation due 2026-10-26.
- Distinct from CVE-2025-66208; no workarounds documented in the CVE record.
🕵️ RESEARCH & DEEP DIVES
Abandoned Time4Popcorn updater (CVE-2026-30612) exposed millions of devices to RCE attacks
Eye Security disabled an abandoned Time4Popcorn updater that would execute any code sent to it with elevated privileges on millions of Windows and macOS devices.- Affected users are those with the abandoned Time4Popcorn fork of Popcorn Time installed on Windows, macOS, and Android, including residential, corporate, government, and military networks (estimated 2.5-3.0 million hosts).
- The updater (CVE-2026-30612) contacted the abandoned domain popcorntimeupd.xyz over unencrypted HTTP and downloaded and ran executables without any digital signature verification.
- Code sent through the update channel ran as SYSTEM on Windows and as root on macOS; anyone controlling the update domain or tampering with traffic could achieve remote code execution.
- Eye Security registered the lapsed domain and 14 related ones, then delivered a remediation payload between November 2025 and March 2026 that stopped and disabled the updater, cutting requests by 98%.
- Android users remain exposed because updates require user approval, and the app bundles an outdated 2014 Chrome engine with no sandbox protections.
Brian Krebs says Rufus installer downloaded from rufus[.]ie installed ~100 trojans
Brian Krebs reports that installing the Windows Rufus USB tool from rufus[.]ie loaded his PC with roughly 100 trojans.- Affects Windows users downloading Rufus, the free tool for writing ISO images to USB/CD-ROM
- The installer, downloaded from rufus[.]ie, resulted in about 100 trojans on the machine
- During installation it displayed verbose messages claiming it needed to download additional components
- Malware installs only after the executable is clicked; a reader's any.run sandbox run shows the same post-install prompts Krebs saw
- Krebs notes Google's default search results list rufus[.]ie as the authoritative Rufus site; the legitimate site is rufus.akeo.ie
📋 ADVISORIES
Arista issues Security Advisory 0200: critical vulnerability rated CVSS 9.2
Arista has published Security Advisory 0200 covering a critical vulnerability rated CVSS 9.2.- Applies to Arista products covered by advisory ARISTA0200; details are in the vendor advisory
- The advisory is rated Critical with a CVSS score of 9.2 and tracks 2 CVEs
- EPSS probability for the vulnerability is 11.6%
Dell fixes hundreds of third-party flaws in Storage Resource Manager and Storage Monitoring and Reporting
Dell has released security updates for SRM and SMR addressing hundreds of third-party component vulnerabilities.- Applies to Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR), both Vapp and Windows/Linux deployments, versions prior to the remediated releases.
- Advisory DSA-2026-462 addresses 562 CVEs in bundled third-party components including SUSE Linux Enterprise Server 15, Apache Tomcat, Java, Jetty, MySQL, Netty, Spring, Apache Camel, and Zookeeper.
- The flaws could allow remote code execution, privilege escalation, unauthorized data access, or denial of service; the advisory carries a critical CVSS 10.0 rating.
- Exploitation requires reaching vulnerable services in the SRM/SMR stack; compromised instances could disrupt storage monitoring and provide a foothold in storage environments.
- Remediation requires upgrading SRM/SMR to the latest fixed versions (e.g., 6.0.0.2 or later per DSA-2026-111).
Dell issues DSA-2026-453 security update for VxRail third-party component vulnerabilities
Dell has released remediation for hundreds of third-party component vulnerabilities affecting VxRail systems.- Applies to Dell VxRail hyperconverged infrastructure systems running VxRail software.
- Advisory DSA-2026-453 addresses 678 CVEs across bundled third-party components including Java, Python, Golang, OpenSSL, Curl, libsoup, libssh, libxml2, SQLite, Sudo, and SuSE packages.
- Dell rates the impact as Critical, with a maximum CVSS score of 9.8; the advisory is listed as known exploited with EPSS of 94.2%.
- Vulnerabilities could be exploited by malicious users to compromise the affected system; remediation is available via VxRail updates.
- Example CVEs include CVE-2026-22007 (Java), CVE-2025-13462 (Python), CVE-2026-5160 (Golang), and CVE-2024-4603 (OpenSSL).
PHP2Shell: Critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 exploited before patch
CVE-2026-109618CVE-2026-109619
Two critical PHP remote code execution vulnerabilities dubbed PHP2Shell were patched on October 21, 2026 after exploitation attempts were observed in the wild.- Affects all PHP web deployments serving HTTP, including Apache modules, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed; fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with backports for 7.4, 8.0, and 8.1.
- Both CVEs are remote code execution flaws rated CVSS 9.2 that work in default configurations and bypass application-level authentication, since PHP processes malicious requests before application code runs.
- CVE-2026-109618: an out-of-memory error via longjmp() interrupts request initialization, leaving invalid hash table data that PHP's cleanup routine turns into a function call; triggered by an unauthenticated HTTP POST.
- CVE-2026-109619: fatal error handling leaves global memory pointing to freed regions that later requests read or branch on, enabling arbitrary code execution.
- AWS reported exploitation attempts as early as October 17, 2026, four days before disclosure; Unit 42 observed agentic AI-driven post-exploitation against a European government entity, and Cortex Xpanse identified over 22.6 million potentially exposed instances.
Sources 📄 Source: github.com · 📎 Coverage: securitylabs.datadoghq.com · 👁 via InfraTrust Advisories (+1)Cisco fixes high-severity IPv4 DoS flaw in IOS XR for ASR 9000/9900 routers
Cisco has disclosed a high-severity denial-of-service vulnerability in IPv4 packet processing in IOS XR software for ASR 9000 and 9900 series routers.- Affects Cisco ASR 9000 and ASR 9900 series routers running Cisco IOS XR Software
- Vulnerability in IPv4 packet processing allows unauthenticated denial of service via IPv4 unicast packets
- Tracked as advisory cisco-sa-asr9k-tUyxcyXN with CVSS 7.5 (High) and EPSS 0.3%
- Bug tracked as CSCwn39554
🔓 CVEs & KEV
CVE-2026-115893 — bytecodealliance wasmtime — CVSS 9.9 — Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large ...
CVE-2026-115889 — bytecodealliance wasmtime — CVSS 9.9 — Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscom...
CVE-2026-115886 — mlflow — CVSS 6.5 — MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs ...
cisco-expressway-hardening — InfraTrust Advisories
cisco-snort3-hardening — InfraTrust Advisories
• *cisco-snort