https://walterstein.eu/en/security-alerts/ In-depth articles on current vulnerabilities: why they are dangerous, who is affected and how to fix them. en https://walterstein.eu/en/security-alerts/argo-cd-cve-2026-113672 https://walterstein.eu/en/security-alerts/argo-cd-cve-2026-113672 Wed, 28 Oct 2026 16:15:51 GMT Argo CD, a tool that deploys applications to Kubernetes, has a critical flaw rated CVSS 9.9. Anyone who can commit a Jsonnet file to a repository, or merely view an existing Directory-type application, can pull tokens, keys and Git credentials from the repo-server. A fix is available. https://walterstein.eu/en/security-alerts/snort-3-cve-2026-20043 https://walterstein.eu/en/security-alerts/snort-3-cve-2026-20043 Wed, 28 Oct 2026 16:09:56 GMT On October 21, 2026, Cisco fixed a batch of flaws in the Snort 3 inspection engine used by its firewalls and security gateways. The most serious score 9.0 on CVSS. No exploitation is known yet, but there is no workaround, so updating is the only real protection. https://walterstein.eu/en/security-alerts/ios-ipados-macos-cve-2026-86950 https://walterstein.eu/en/security-alerts/ios-ipados-macos-cve-2026-86950 Wed, 28 Oct 2026 13:29:08 GMT Apple has fixed CVE-2026-86950, a CoreGraphics flaw likely already used in a targeted attack. A booby-trapped file can run an attacker’s code on an iPhone, iPad or Mac. Update to iOS and iPadOS 26.7.1 or 18.7.11, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1. https://walterstein.eu/en/security-alerts/gitlab-cve-2026-110264 https://walterstein.eu/en/security-alerts/gitlab-cve-2026-110264 Wed, 28 Oct 2026 13:19:58 GMT On October 21, 2026, GitLab fixed a critical vulnerability, CVE-2026-110264, rated CVSS 10.0. Under certain conditions, an attacker without an account could run code on a GitLab server over the network. Self-managed installs from version 7.0 are affected, so update now. https://walterstein.eu/en/security-alerts/gitlab-cve-2026-85706 https://walterstein.eu/en/security-alerts/gitlab-cve-2026-85706 Wed, 28 Oct 2026 13:17:54 GMT A critical flaw in self-hosted GitLab, CVE-2026-85706, can under certain conditions let anyone read files from the server without logging in. Those files may include passwords and keys. Since September 11, 2026, it has been officially listed as exploited. Update now and review your logs. https://walterstein.eu/en/security-alerts/routeros-cve-2026-86060 https://walterstein.eu/en/security-alerts/routeros-cve-2026-86060 Wed, 28 Oct 2026 13:14:44 GMT Flaws in the SSH login of MikroTik RouterOS let an attacker take over a router without a password if SSH is reachable from the internet. Attacks have been under way since at least September 2, 2026. Update to 7.24.3, 7.23.6 or 6.49.21 and check the device for unknown accounts. https://walterstein.eu/en/security-alerts/adobe-commerce-magento-cve-2026-48356 https://walterstein.eu/en/security-alerts/adobe-commerce-magento-cve-2026-48356 Wed, 28 Oct 2026 13:11:56 GMT Attackers are mass-exploiting the PolyShell flaw (CVE-2026-48356) in Adobe Commerce and Magento. They upload a malicious file, take over the store and inject code that runs in shoppers’ browsers. Install update APSB26-73 and check whether your store has already been compromised. https://walterstein.eu/en/security-alerts/collabora-online-cve-2026-110447 https://walterstein.eu/en/security-alerts/collabora-online-cve-2026-110447 Wed, 28 Oct 2026 13:09:12 GMT The Collabora Online Built-in CODE Server app for Nextcloud has a critical flaw that attackers are already exploiting. Without logging in, they can run commands on the server and plant a web shell. Version 26.4.303 fixes it, so update as soon as you can. https://walterstein.eu/en/security-alerts/brotli-cve-2026-111497 https://walterstein.eu/en/security-alerts/brotli-cve-2026-111497 Wed, 28 Oct 2026 13:01:34 GMT A critical flaw, CVE-2026-111497, in Google’s Brotli library lets an unauthenticated attacker corrupt memory over the network and potentially run code. It affects Node.js, .NET, Python, PHP for Windows and other software. Attackers are already exploiting it, so update as soon as you can. https://walterstein.eu/en/security-alerts/php-cve-2026-109618 https://walterstein.eu/en/security-alerts/php-cve-2026-109618 Wed, 28 Oct 2026 06:00:00 GMT Two flaws in the PHP core can let an attacker on the internet run their own code on a server without logging in. CISA says they are already being exploited. The only reliable protection is updating PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restarting every PHP process.