Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Versions of Sophos UTM

Black October Vulnerabilities: Node.js, Nginx, and Server-Side Exploits Analyzed

A detailed review of 15 critical and high-severity vulnerabilities disclosed in October reveals that only a handful actually affected a production server running Astro, Strapi, Nginx, and Ubuntu 24.04. Node.js remained unpatched for four days, exposing a Brotli decompression flaw that could lead to remote code execution. Nginx packages lagged behind security updates despite unattended-upgrades being enabled, though configuration checks showed most CVEs did not apply. PHP and GitLab issues were irrelevant due to their absence from the stack. The author also migrated away from inline scripts and third-party dependencies to reduce attack surface. Commands for verifying package changelogs, detecting deleted binaries in memory, and confirming librsvg fixes in sharp are provided throughout the analysis.

AI-Driven Discovery of PHP2Shell Zero-Day Forces Rethink of DevSecOps Practices

One week after the October 21 black Wednesday incident, European governments scrambled to shut down web services following the disclosure of a critical remote code execution flaw in the PHP core. The vulnerability, tracked as CVE-2026-109618 with a CVSS score of 10.0, was identified by an advanced AI model during automated auditing rather than by human researchers. The flaw resided in long-untouched multipart/form-data parsing code that had been protected by PHP's backward-compatibility policy for decades. Once a proof-of-concept leaked, attacker-controlled LLMs rapidly generated architecture-specific exploits and polymorphic code that bypassed basic WAF signatures. Human defenders were forced into manual patch cycles and emergency network isolations across the EU because they could not match the speed of automated exploitation. The event has triggered immediate calls for AI-powered fuzzing inside CI/CD pipelines, legacy code audits, and autonomous AIOps-driven protection systems.

Cisco ASA and FTD Firewalls Affected by DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN feature and carries a CVSS v3.1 base score of 8.6, rated High severity. When secondary authentication is configured for tunnel groups in the SSL remote access VPN login service, an attacker can send a specially crafted request during the connection process to reboot the device without any authentication. This triggers a service denial state on the affected appliance. Cisco confirmed active exploitation of the issue in October 2026 and has released patches for both products. Organizations are strongly advised to apply the updates immediately to prevent further abuse.