Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been discovered in the go-archive archive processing library maintained under the Moby Project. The flaw affects several extraction functions and can be exploited to create or overwrite files outside the designated target directory.
The issue, assigned CVE-2026-17106, resides in the Unpack, UnpackLayer, and Untar routines. During archive extraction, the library validates the destination path as a string but does not account for differences in how the operating system resolves that path. As a result, an attacker-controlled archive can cause files to be written beyond the intended extraction root.
Docker assigned the vulnerability a CVSS v4.0 base score of 7.1 and rated it High severity. Public proof-of-concept code targeting macOS and Linux is already available, increasing the urgency for organizations that rely on affected Docker components.
The vulnerability has been addressed in go-archive 0.3.0. Corresponding fixes were released in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0. Administrators are advised to update these products promptly to mitigate the risk of unauthorized file operations.
Related articles
Two Critical RCE Vulnerabilities Patched in PHP with CVSS 9.2 Scores
The PHP development team has disclosed two severe remote code execution vulnerabilities affecting the widely used scripting language. Both issues, tracked as CVE-2026-109618 and CVE-2026-109619, received a CVSSv4.0 base score of 9.2 and were rated Critical. The flaws stem from improper memory handling during request processing and cleanup phases. Exploitation could allow attackers to execute arbitrary code by manipulating uninitialized or residual data in worker processes. Security updates addressing both vulnerabilities were released on October 21, 2026, and users are strongly urged to apply the patches immediately. The advisories were previewed the previous day, highlighting the urgency of the fixes.
Critical PHP Core Flaws Enable Unauthenticated Remote Code Execution
The PHP project released emergency patches on October 21 for two critical vulnerabilities in the language core, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell. Both issues received a CVSS 4.0 score of 9.2 and allow remote code execution without authentication. CVE-2026-109618 resides in memory-handling routines where longjmp can leave request data partially initialized, and subsequent shutdown operates on invalid data; multipart requests with many headers or empty file fields can trigger the condition. CVE-2026-109619 affects an obsolete global state in long-lived workers that retain references to freed memory, with confirmed paths involving fatal errors, error reporting data, and session upload progress. Researchers demonstrated unauthenticated code execution over HTTP against the first flaw on Apache with mod_php using default limits, while PHP-FPM exposure was identified through code analysis. The FBI Cyber Division issued an alert urging immediate updates, and Cloudflare deployed WAF rules while confirming early attacks in the wild.
Oracle Releases October 2026 Critical Patch Update Fixing 1,295 Vulnerabilities Across Multiple Products
Oracle has published its quarterly Critical Patch Update (CPU) on October 20, 2026, delivering a total of 1,295 security patches for a wide range of products. After removing duplicates, the update addresses 1,209 unique CVEs. The highest number of fixes went to Oracle Fusion Middleware with 206 patches, followed by Oracle E-Business Suite with 194, Oracle Communications with 110, Oracle MySQL with 98, and Oracle Java SE with 55. Among the vulnerabilities, 587 received a CVSSv3 base score of 7.0 or higher, including 112 rated 9.0 or above. Six vulnerabilities scored the maximum 10.0, one of which is CVE-2026-101809 in Oracle E-Business Suite Workflow Notification Mailer that can be exploited remotely without authentication over HTTP.
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.