Updates
Cybersecurity Updates
Stay informed through a selection of cybersecurity alerts, vulnerability notices and security guidance from trusted industry and government sources.
Canadian Cybersecurity Guidance
- CCCSAV26-1087
HashiCorp security advisory (AV26-1087)
Serial Number: AV26-1087Date: October 26, 2026 As of October 26, 2026, HashiCorp is affected by a vulnerability in the following products: Consul Prior to 2.1.0 Consul Enterprise Prior…
Read at source — HashiCorp security advisory (AV26-1087) - CCCSAV26-1086
Craft CMS security advisory (AV26-1086)
Serial number: AV26-1086Date: October 26, 2026 As of October 23, 2026, Craft CMS is affected by vulnerabilities in the following products: CMS Prior to 4.18.9 Prior to 5.11.2…
Read at source — Craft CMS security advisory (AV26-1086) - CCCSAV26-1085
Google security advisory (AV26-1085)
Serial number: AV26-1085Date: October 26, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1.0.3 to versions prior to…
Read at source — Google security advisory (AV26-1085) - CCCSAV26-1084
Red Hat security advisory (AV26-1084)
Serial number: AV26-1084Date: October 26, 2026 As of October 20, 2026, Red Hat is affected by vulnerabilities in the following products: Red Hat Enterprise Linux 10 All versions…
Read at source — Red Hat security advisory (AV26-1084) - CCCSAV26-1083
[Control Systems] Siemens security advisory (AV26-1083)
Serial number: AV26-1083Date: October 26, 2026 As of October 26, 2026, Siemens is affected by a vulnerability in the following products: Mendix SAML (Mendix 10 compatible) Prior to…
Read at source — [Control Systems] Siemens security advisory (AV26-1083) - CCCSAV26-1082
IBM security advisory (AV26-1082)
Serial number: AV26-1082Date: October 26, 2026 As of October 20, 2026, IBM is affected by vulnerabilities in the following products: IBM App Connect Enterprise Versions 13.0.1.0 to 13.0.8.2…
Read at source — IBM security advisory (AV26-1082) - CCCSAV26-1080
Arista Networks security advisory (AV26-1080) – Update 1
Serial number: AV26-1080Date: October 23, 2026 As of October 22, 2026, Arista Networks is affected by a vulnerability in the following product: VeloCloud Orchestrator (VCO) Prior to 5.2.3.18…
Read at source — Arista Networks security advisory (AV26-1080) – Update 1 - CCCSCVE-2026-109618
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1
Number: AL26-026Date: October 21, 2026Updated: October 23, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a…
Read at source — AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1
Vendor Security Advisories
- PSIRT
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private…
Read at source — Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities - PSIRT
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE…
Read at source — Vulnerabilities in PHP Affecting Cisco Products: October 2026 - MSRCCVE-2026-69926
CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability - MSRCCVE-2026-105728
CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability - MSRCCVE-2026-96311
CVE-2026-96311 Windows Network List Service Tampering Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-96311 Windows Network List Service Tampering Vulnerability - MSRCCVE-2026-69923
CVE-2026-69923 Windows AI Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-69923 Windows AI Elevation of Privilege Vulnerability - MSRCCVE-2026-70054
CVE-2026-70054 Windows NetBIOS Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-70054 Windows NetBIOS Elevation of Privilege Vulnerability - MSRCCVE-2026-96234
CVE-2026-96234 .NET Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-96234 .NET Information Disclosure Vulnerability - MSRCCVE-2026-70338
CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability - MSRCCVE-2026-83519
CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
Read at source — CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability - PSIRT
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection…
Read at source — Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability - PSIRT
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security…
Read at source — Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 - PSIRT
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to…
Read at source — Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities - PSIRT
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated,…
Read at source — Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability - PSIRT
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly…
Read at source — Multiple Cisco Products Snort 3 Denial of Service Vulnerability - PSIRT
Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3…
Read at source — Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Critical Alerts and Active Threats
- CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP…
Read at source — CISA Adds Two Known Exploited Vulnerabilities to Catalog - CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command…
Read at source — CISA Adds One Known Exploited Vulnerability to Catalog - CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type…
Read at source — CISA Adds One Known Exploited Vulnerability to Catalog - CISA
Siemens Software Center
View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL…
Read at source — Siemens Software Center - CISA
Siemens PSS(R)SINCAL
View CSAF Summary PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a…
Read at source — Siemens PSS(R)SINCAL - CISA
InterSystems Corporation InterSystems IRIS for Health
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions…
Read at source — InterSystems Corporation InterSystems IRIS for Health - CISA
Siemens RUGGEDCOM CROSSBOW Station Access Controller
View CSAF Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a…
Read at source — Siemens RUGGEDCOM CROSSBOW Station Access Controller - CISA
Siemens SENTRON 3NA COM Fuse
View CSAF Summary SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition.…
Read at source — Siemens SENTRON 3NA COM Fuse
Vulnerabilities and Security Updates
- USNUSN-8956-1
USN-8956-1: Brotli vulnerability
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
Read at source — USN-8956-1: Brotli vulnerability - USNUSN-8955-1
USN-8955-1: nginx vulnerabilities
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx…
Read at source — USN-8955-1: nginx vulnerabilities - USNUSN-8954-1
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial…
Read at source — USN-8954-1: zlib vulnerability - USNUSN-8953-1
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Read at source — USN-8953-1: OpenVPN vulnerability - USNUSN-8952-1
USN-8952-1: Tornado vulnerabilities
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service,…
Read at source — USN-8952-1: Tornado vulnerabilities - USNUSN-8890-2
USN-8890-2: libsoup vulnerabilities
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2…
Read at source — USN-8890-2: libsoup vulnerabilities - USNUSN-8951-1
USN-8951-1: c-ares vulnerabilities
It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of…
Read at source — USN-8951-1: c-ares vulnerabilities - USNUSN-8947-1
USN-8947-1: NSS update
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
Read at source — USN-8947-1: NSS update
Last updated: October 27, 2026.
Let’s discuss your cybersecurity priorities.
An initial, no-obligation conversation to understand your context, priorities and needs.