Cisco Patches Seven Critical IOS XE Vulnerabilities Including CVSS 9.8 Command Injection Flaw
Cisco has issued a security update addressing seven vulnerabilities in IOS XE, the operating system used across routers, switches, wireless controllers, and other enterprise network equipment.
The most severe flaw, identified as CVE-2026-20272 and scored CVSS 9.8, involves improper handling of special elements within commands. This weakness can allow attackers to perform command injection, execute unauthorized operations, and fully compromise affected devices over the network.
Additional vulnerabilities affect memory management, resource lifecycle handling, numeric calculations, execution flow, and input validation. Potential consequences include buffer overflows, out-of-bounds writes, device crashes, infinite loops, and directory traversal attacks.
The issues impact IOS XE running in either standalone or controller-managed mode and are independent of any specific device configuration. Affected version lines include 17.9, 17.12, 17.15, 17.18, and 26.1.
Patches are available starting with versions 17.9.10, 17.12.8, 17.15.6, 17.18.4, 17.18.4a, and 26.1.2. No temporary workarounds exist that can eliminate exposure to these flaws.
The vulnerabilities were identified during internal testing, including analyses supported by advanced artificial intelligence models. As of the advisory publication, there were no indications of public exploitation or malicious use in the wild.
Related articles
October 'In Trend VM' Report: Exploited Windows ALPC and Check Point VPN Vulnerabilities
Positive Technologies has released its October edition of the 'In Trend VM' digest, highlighting two actively exploited vulnerabilities. The first is CVE-2026-85880, a local privilege escalation flaw in the Windows ALPC mechanism that was used as a zero-day in targeted attacks by multiple APT clusters. The second is CVE-2026-85102, a critical remote code execution vulnerability in Check Point Security Gateway and Spark Firewall products that affects VPN negotiation. Both issues have been added to CISA's KEV catalog, with public proof-of-concept code already available for the Check Point flaw. The report details attack chains, affected versions, and recommended patches or workarounds.
Windows PHP Updated to Patch Critical Brotli Vulnerability CVE-2026-111497
The PHP development team has released updated Windows builds of PHP that bundle a patched version of the Brotli compression library. The update addresses CVE-2026-111497, a critical out-of-bounds write flaw in Google's Brotli decoder that can lead to remote code execution, information disclosure, or denial of service. The vulnerability carries a CVSS v4.0 base score of 9.2 and is rated Critical. It affects PHP environments where the cURL extension has automatic decompression of HTTP responses enabled, allowing Brotli decoding to occur. Although cURL automatic decompression is disabled by default, applications or HTTP client libraries may enable it. The fix updates the bundled Brotli component to version 1.2.1 in the releases PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 published on October 26.
AI-Driven Software Boom Fuels Record Surge in Critical Vulnerabilities in 2026
The National Vulnerability Database recorded more than 72,000 CVEs between January and September 2026, compared with 48,244 for the entire previous year. The increase stems directly from the massive growth in code volume produced with AI coding assistants that allow features once requiring two weeks to be completed in a single afternoon. Much of this newly generated code reaches production without thorough human security review because models optimize for functionality rather than adversarial misuse. Common flaws such as missing authorization checks, exposed API keys in repositories, and insecure direct object references appear repeatedly in freshly deployed applications. Criminal groups have adopted the same AI tools to scan and test targets at scale, widening the gap between attacker speed and defender verification processes. Organizations that skip structured adversarial testing leave these issues to be discovered by threat actors, resulting in data exposure and operational disruption far costlier than pre-release remediation.
Apple Releases iOS 27.2 and iPadOS 27.2, Patching 163 Vulnerabilities Including Exploited Flaws in Older Versions
Apple has issued security updates for iOS and iPadOS, addressing a wide range of vulnerabilities across current and legacy operating systems. The iOS 27.2 and iPadOS 27.2 releases fix 163 CVEs affecting WebKit, the kernel, and image processing components. Older branches received targeted patches, with iOS 26.7.2 resolving 134 issues and iOS 18.7.11 addressing three vulnerabilities that include an actively exploited flaw. Specific fixes cover remote code execution risks in WebKit and ImageIO, plus sandbox bypasses. The updates were published on October 26, 2026, and apply to both iPhone and iPad devices. Apple also published detailed security content advisories for each branch.