The CyberSec Intelligence team presents the daily security bulletin for October 23, 2026. In this report, we have centralized the most recently reported vulnerabilities, incidents from the specialty press, and our recommendations for securing your infrastructure.
Actively exploited vulnerabilities
- CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition): An OS Command Injection vulnerability allows remote attackers to execute arbitrary commands in the operating system with root or SYSTEM privileges. Source: NVD CVE-2026-106931.
- CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, CVE-2026-96652 (Plex Media Server): A vulnerability chain (SSRF, external control of filenames, and improper neutralization of URI schemes) allows authenticated or token-compromised attackers to achieve file execution and force the server to send requests to arbitrary destinations. Source: CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, CVE-2026-96652.
- CVE-2026-110936 (Siemens Software Center): An “Uncontrolled Search Path Element” defect that allows an authenticated local attacker to execute arbitrary code by placing a malicious DLL in the application’s search directory. Source: NVD CVE-2026-110936.
- CVE-2026-102764 (BeyondTrust Remote Support): Authentication bypass via spoofing that allows a remote attacker to perform unauthorized file operations on the device. Source: NVD CVE-2026-102764.
- CVE-2025-61624 (Fortinet – FortiOS, FortiPAM, FortiProxy, FortiSwitchManager): A Path Traversal vulnerability that allows authenticated administrators with read-write permissions to delete or write arbitrary files via specific CLI commands. Source: NVD CVE-2025-61624.
New critical vulnerabilities
- CVE-2026-109618 (PHP): Memory management errors upon Out-Of-Memory (OOM) events can leave memory uninitialized, leading to remote code execution (RCE). Source: NVD CVE-2026-109618.
- CVE-2026-114268 (Tenda BE3L Pro): Buffer overflow in the formWifiBasicSet (/goform/WifiBasicSet) function that can be exploited remotely to compromise the device. Source: NVD CVE-2026-114268.
- CVE-2026-114382 & CVE-2026-114383 (TOTOLINK EX200): Two stack-based buffer overflow vulnerabilities in setStaticDhcpConfig and setWiFiAclAddConfig can be exploited remotely via already available public exploits. Source: CVE-2026-114382, CVE-2026-114383.
- CVE-2026-114575 (TOTOLINK A950RG): Command injection via the FileMd5 argument in UploadCustomModule, paving the way for remote attacks. Source: NVD CVE-2026-114575.
- CVE-2021-48014 (FineReport 9.0): Path traversal in /WebReport/ReportServer design_save_svg allowing unauthenticated attackers to write a JSP webshell. Source: NVD CVE-2021-48014.
- CVE-2021-48016 (DedeCMS): PHP code injection in ShowMsg() by utilizing a forged HTTP Referer header. Source: NVD CVE-2021-48016.
- CVE-2022-51022 (YiShaAdmin): Unauthenticated path traversal defect in /admin/File/DownloadFile that allows reading and deleting system files. Source: NVD CVE-2022-51022.
- CVE-2022-51026 (Bytebase): Authentication bypass by using a compromised GitLab configuration sent by the client, allowing impersonation of any user. Source: NVD CVE-2022-51026.
- CVE-2026-115375 & CVE-2026-115377 (Incus): Path traversal and file writing vulnerabilities via arbitrary symlinks in transferred volumes, leading to host compromise. Source: CVE-2026-115375, CVE-2026-115377.
- CVE-2026-115384 (Wasmtime): Stack buffer overflow allowing malicious guest machines to write to the host’s native stack via asynchronous callbacks. Source: NVD CVE-2026-115384.
From the security press
- Zero-Day in Arista VeloCloud: Attackers are actively exploiting an SQL injection vulnerability in VeloCloud Orchestrator (VCO), elevating read-only account privileges to operator level. Source: The Hacker News.
- Unpatched Critical Flaws in Linux KSMBD: Details have been published about two unpatched RCE vulnerabilities (CVSS 9.0) in the SMB server integrated into the Linux kernel. Source: The Hacker News.
- 12-Year-Old GitLab Vulnerability (CVSS 10.0): GitLab has urgently released updates for an unauthenticated RCE flaw affecting all software versions since 2014. Source: The Hacker News.
- PHP2Shell Campaign and Emergency Patches: The PHP community has published quick patches to halt active RCE attacks based on the flaws dubbed PHP2Shell. Source: The Hacker News – Emergency Patches, The Hacker News – Mitigations, The Hacker News – Alert.
- ThreatsDay Weekly Report: The summary reveals AI secrets leaks, PingCAP source code theft, and major authentication flaws in Laravel. Source: The Hacker News.
What we recommend
- Prioritized Patch Management: Immediately apply updates for PHP environments affected by the PHP2Shell vulnerability and update GitLab and Fortinet versions in your infrastructure.
- Limiting Exposure and Network Segmentation: Isolate sensitive systems (such as orchestrator consoles or media servers) and restrict public access to administrative interfaces.
- Rigorous Inventory: Maintain increased visibility over all IoT/SOHO equipment (such as TOTOLINK and Tenda) within the corporate network and disable non-essential remote access.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
