The CyberSec Intelligence team presents the daily summary of the most important vulnerabilities and cyber threats identified today, October 24, 2026. This report analyzes high-impact security risks, providing practical recommendations for protecting IT infrastructures within your organization.
Actively exploited vulnerabilities
- CVE-2026-114625 (Arista VeloCloud Orchestrator): An SQL Injection vulnerability in the on-premise version allows remote attackers to access privileged internal functionalities. Source: NVD.
- CVE-2026-110447 (Collabora Online – Built-in CODE Server): When used in the NextCloud platform, the CODE server contains an OS command injection vulnerability, allowing remote code execution. Source: NVD.
- CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition): An OS command injection vulnerability allows an attacker to execute arbitrary commands with root or SYSTEM privileges. Source: NVD.
- Plex Media Server (CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, CVE-2026-96652): A set of interconnected vulnerabilities (file path control, SSRF, and improper neutralization of URI schemes) allows writing arbitrary files and forcing the server to transmit malicious requests. Sources: CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, CVE-2026-96652.
- CVE-2026-110936 (Siemens Software Center): Uncontrolled search path element allows an authenticated local attacker to execute arbitrary code via malicious DLLs. Source: NVD.
New critical vulnerabilities
- CVE-2021-48016: PHP code injection vulnerability in DedeCMS (ShowMsg()) that can lead to PHP and system command execution via a malicious Referer header. Source: NVD.
- CVE-2022-51022: Path traversal vulnerability in YiShaAdmin that allows reading and deleting system files via the filePath parameter. Source: NVD.
- CVE-2022-51026: Authentication bypass in Bytebase that allows unauthenticated attackers to log in as any user, including with Owner privileges. Source: NVD.
- CVE-2026-115375 & CVE-2026-115377 (Incus): Critical path traversal and arbitrary file write vulnerabilities via symbolic links that can lead to total compromise of the host machine. Sources: CVE-2026-115375, CVE-2026-115377.
- CVE-2026-115384 (Wasmtime): A stack buffer overflow vulnerability in asynchronous callbacks that allows bypassing the sandbox or crashing the host. Source: NVD.
- CVE-2026-83938 (Azure Kubernetes Configuration Service) & CVE-2026-97785 (AAD App Proxy): Authentication issues that allow remote attackers to escalate privileges on the network. Sources: CVE-2026-83938, CVE-2026-97785.
From the security press
- Critical updates in the Ruby Regex engine: Fixes for Onigmo address major vulnerabilities that facilitated four critical RCE breaches in GitLab. Source: The Hacker News.
- Warning about a new unpatched PHP vulnerability (CVE-2026-115560): Discovered right after the emergency patches for PHP2Shell, this can allow remote code execution in atypical configurations. Source: The Hacker News.
- Code execution via EPS images in the Pillow library (CVE-2026-112900): This popular Python library allows command execution due to the lack of validation of the filename passed to Ghostscript. Source: The Hacker News.
- Major flaw in the x402 SDK for AI agents: Malicious APIs could drain the token balances of agents due to the lack of a predefined spending limit. Source: The Hacker News.
- Massive attack campaigns with Mirai malware (Potassium): Millions of exploitation attempts targeting PHP2Shell vulnerabilities (CVE-2026-109618) are recorded. Source: The Hacker News.
- Zero-day vulnerability exploited in Arista VeloCloud: A reported SQL Injection flaw allows attackers to obtain full administrative privileges from a limited account. Source: The Hacker News.
- ThreatsDay analysis: The week was marked by AI secret leaks, PingCAP source code thefts, bugs in Signal, and bypasses in Laravel. Source: The Hacker News.
- Two unpatched vulnerabilities in Linux KSMBD: Flaws with severity 9.0 allow pre-authentication remote code execution in kernel SMB servers. Source: The Hacker News.
What we recommend
- Patch Management: Immediately update internet-exposed systems running Arista VeloCloud, Collabora, Plex instances, affected Python libraries, and PHP installations.
- Asset inventory: Monitor and maintain a clear inventory of software dependencies in your infrastructure, including modules like Pillow, AI SDKs, or the use of the KSMBD kernel module in Linux.
- Continuous traffic monitoring: Implement strict access control rules and intrusion detection tools to identify potential SQL Injection or command execution exploitation attempts.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
