The CyberSec Intelligence technical team presents the daily analysis of cybersecurity risks and vulnerabilities reported today, October 22, 2026. Constant threat monitoring is essential for maintaining a strong defensive posture within organizational IT infrastructures.
Actively exploited vulnerabilities
The following vulnerabilities have been included in the CISA KEV catalog, with clear evidence of their active exploitation in cyberattacks:
- CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition): An OS Command Injection vulnerability allows attackers to execute arbitrary commands with administrator privileges (root or SYSTEM) on affected systems.
- CVE-2026-96656 (Plex Media Server): Allows an administrator account to write arbitrary files that can be run on startup. It can be chained with vulnerabilities CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
- CVE-2026-96655 (Plex Media Server): Server-Side Request Forgery (SSRF) deficiency that allows authenticated users to send requests to internal or external addresses via the ‘/video/:/transcode/universal’ parameter.
- CVE-2026-96654 (Plex Media Server): Incorrect neutralization of encoded URI schemes allows attackers to call functions of other modules and send their own parameters.
- CVE-2026-96652 (Plex Media Server): SSRF vulnerability through which an attacker can use any value for the X-Plex-Token parameter to force the server to send POST requests to arbitrary destinations.
- CVE-2026-110936 (Siemens Software Center): An Uncontrolled Search Path Element flaw provides an authenticated local attacker with the ability to place a malicious DLL library to execute code with the privileges of the application.
- CVE-2026-102764 (BeyondTrust Remote Support): Allows a remote attacker to bypass authentication through spoofing techniques and perform unauthorized operations on files on the appliance.
- CVE-2025-61624 (Fortinet Multiple Products): A Path Traversal vulnerability in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager allows an authenticated user with an administrator profile (write privileges) to delete or write arbitrary files via specific CLI commands.
- CVE-2026-21589 (Atlassian Multiple Products): Exposure of directories or files allows an unauthenticated attacker to access sensitive resources directly from the web application root on platforms such as Bitbucket, Confluence, Jira, or Bamboo.
New critical vulnerabilities
Technical details have been published for a series of critical vulnerabilities recently identified in network systems and equipment:
- CVE-2026-113390 (DrayTek Vigor2960): OS command injection in function ‘sub_182B0’ from the CGI Interface component (/cgi-bin/mainfunction.cgi). The vulnerability has a CVSS score of 9.9 and allows remote code execution. We note that the device is at the end of its life cycle (EoS).
- CVE-2026-113678 (Froxlor): A symlink (symbolic link following) vulnerability in the statistics generation function allows authenticated clients to take ownership of directories on the host server, obtaining root privileges. CVSS: 9.9.
- TOTOLINK X2000R (version Gh-V1.0.0-B20250421.1327): Ten critical vulnerabilities (CVSS: 9.1) have been reported that can be exploited via malicious HTTP requests to execute arbitrary code:
- CVE-2026-10131: OS Command Injection in boa formPasswordSetup.
- CVE-2026-10132: Stack-based buffer overflow in boa formIpQos mac.
- CVE-2026-10133: Stack-based buffer overflow in batchupg.
- CVE-2026-10135: OS Command Injection in batchupg.
- CVE-2026-10136: Heap-based buffer overflow in boa formUpload().
- CVE-2026-10137: Stack-based buffer overflow in boa formUpload().
- CVE-2026-10138: OS Command Injection in boa formUpload().
- CVE-2026-10139: Stack-based buffer overflow in Mcli.
- CVE-2026-10141: Acceptance of unsigned firmware in the update section.
- CVE-2026-28763: Stack-based buffer overflow in boa formMapDelDevice.
From the security press
The following important analyses and updates have been published in the specialist press:
Emergency fixes for GitLab (CVSS: 10.0)
A critical security update has been released for an unauthenticated remote code execution (RCE) vulnerability. It affects all versions of the software from the last 12 years (starting with version 7.0 released in 2014). Source: The Hacker News.
Security updates and alerts for PHP2Shell (CVSS: 9.2)
The PHP team has issued emergency patches for two critical RCE flaws generically named “PHP2Shell”, located at the PHP runtime level. The versions that secure the system are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Experts warn that changing temporary settings does not offer complete protection, with updating being the only secure measure. Sources: The Hacker News – Emergency Patches, The Hacker News – Workarounds and The Hacker News – Initial Alert.
Public exploit (PoC) for FortiSIEM (CVSS: 9.4)
Researchers have published a technical proof-of-concept (PoC) exploit for vulnerability CVE-2026-106173, a critical path traversal flaw in FortiSIEM that allows unauthenticated attackers to execute remote commands. Source: The Hacker News.
What we recommend
To ensure the protection of your systems against these threats, we recommend applying the following measures:
- Patch prioritization: Immediately update email servers, version control systems (GitLab, Atlassian), operating systems running PHP, and active security appliances (Fortinet).
- Isolation and replacement of EoS equipment: Identify if you have DrayTek Vigor2960 routers in your infrastructure and ensure they are replaced or isolated in dedicated networks, as they lack active support from the manufacturer.
- Limiting the exposure of administration interfaces: Restrict public access to administration panels (such as those for Plex or BeyondTrust) using strict firewall rules and access only through secure VPN connections with multi-factor authentication (MFA).
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
