CVE-2026-114509

🚨 Security vulnerabilities reported within last 48 hours: PHP — 2 CVEs (php2shell: CVE-2026-109618 & CVE-2026-109619, unauthenticated RCE) Node.js — 10 CVEs (incl. Brotli OOB write RCE, TLS hostname bypasses, DNS NUL truncation) NGINX — 5 CVEs (incl. 3 critical memory issues) Go — 1 CVE (CVE-2026-111943, crypto/x509 / eMudhra distrust) GitLab — 12 CVEs (incl. CVE-2026-110264, CVSS 10.0 unauthenticated RCE) eMudhra — CA certificate compromise (weak/recoverable intermediate keys) Laravel — 1 critical auth bypass (TokenGuard, GHSA-f9x3-7vq9-cph6 / CVE-2026-114509, CVSS 9.2) Plex Media Server — 4 CVEs (Plex2Shell chain, added to CISA KEV) Oracle Java SE / GraalVM — 1 CVE (CVE-2026-91403, CVSS 9.1, JSSE / related to eMudhra) Cisco Expressway — 1 critical RCE (CVE-2026-76466, CVSS 9.8, unauthenticated root via clustering DB) LiteLLM — supply-chain compromise (malicious v1.107.0 on PyPI + Docker: credential stealer + remote code loader) SiteGuard — 1 CVE (CVE-2026-106931 OS command injection, CISA KEV) Siemens Software Center — 1 CVE (CVE-2026-110936, CISA KEV) Railway — security incident (unauthorized access to customer environment variables / secrets; possible decryption of some; deployments paused, rotate all keys)

Laravel developers: audit your API authentication configuration. A critical authentication bypass vulnerability, CVE-2026-114509 (CVSS 9.2), affects Laravel’s built-in TokenGuard under certain MySQL/MariaDB configurations. An unauthenticated attacker may be able to authenticate as another existing user without possessing that user’s valid API token. Fixed versions: Laravel 12.68.0 or later Laravel 13.29.0 or later Check immediately: Inspect config/auth.php for guards using driver => token. Identify API routes protected by those guards. Verify your installed framework version with composer show laravel/framework. Run composer audit. Apply the security fix and verify deployment. Laravel Sanctum and Passport are not directly affected by this specific TokenGuard vulnerability. Important: A vulnerable version does not automatically mean an application is exploitable. The authentication configuration and database backend determine exposure. Official advisory: https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6 #Laravel #CyberSecurity #ApplicationSecurity #PHP

csirt_it: ‼️ #PoC #Laravel: disponibile Proof of Concept (PoC) per lo sfruttamento della CVE-2026-114509 Rischio: 🔴 Tipologia: 🔸 Authentication Bypass 🔸 Spoofing 🔗 https://www.acn.gov.it/portale/w/laravel-disponibile-poc-per-lo-sfruttamento-della-cve-2026-114509 ⚠️ Importante mantenere aggiornati i sistemi https://t.co/4KSLcxMorG

🚨 Security vulnerabilities reported within last 48 hours: PHP — 2 CVEs (php2shell: CVE-2026-109618 & CVE-2026-109619, unauthenticated RCE) Node.js — 10 CVEs (incl. Brotli OOB write RCE, TLS hostname bypasses, DNS NUL truncation) NGINX — 5 CVEs (incl. 3 critical memory issues) Go — 1 CVE (CVE-2026-111943, crypto/x509 / eMudhra distrust) GitLab — 12 CVEs (incl. CVE-2026-110264, CVSS 10.0 unauthenticated RCE) eMudhra — CA certificate compromise (weak/recoverable intermediate keys) Laravel — 1 critical auth bypass (TokenGuard, GHSA-f9x3-7vq9-cph6 / CVE-2026-114509, CVSS 9.2) Plex Media Server — 4 CVEs (Plex2Shell chain, added to CISA KEV) Oracle Java SE / GraalVM — 1 CVE (CVE-2026-91403, CVSS 9.1, JSSE / related to eMudhra) Cisco Expressway — 1 critical RCE (CVE-2026-76466, CVSS 9.8, unauthenticated root via clustering DB) LiteLLM — supply-chain compromise (malicious v1.107.0 on PyPI + Docker: credential stealer + remote code loader) SiteGuard — 1 CVE (CVE-2026-106931 OS command injection, CISA KEV) Siemens Software Center — 1 CVE (CVE-2026-110936, CISA KEV) Railway — security incident (unauthorized access to customer environment variables / secrets; possible decryption of some; deployments paused, rotate all keys)