CVE-2026-16521

⚠️ Daily CVE Roundup - October 28, 2026 Here are the notable CVEs disclosed or updated today: 🔴 Critical & High Severity · CVE-2026-109618 / CVE-2026-109619 (PHP "PHP2Shell") - CVSS 9.2 (Critical). Unauthenticated remote code execution in PHP core memory handling. Exploitation has been confirmed in the wild, and CISA added both to the KEV catalog on October 26 with a remediation deadline of October 29. Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. End-of-life versions (8.1 and below) will not receive patches . · CVE-2026-16521 (Supermicro BMC) - CVSS 7.2 (High) OS command injection due to insufficient input filtering. An attacker can inject a command payload into a BMC function, which may execute when the related service restarts. No public exploit or technical details available; no known mitigation . · CVE-2026-114625 (Arista VeloCloud Orchestrator) - CVSS 9.9 (Critical) Any authenticated user, including the lowest "Enterprise Read Only" role, can escalate to superuser privileges and access internal-only functionality. Arista confirms active exploitation in the wild . Fixed in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12. 🟡 Medium & Notable · CVE-2026-111497 (Node.js / Brotli "Node2Shell") - High severity Out-of-bounds write in the Brotli decoder allows RCE when applications decompress attacker-controlled data. Affects Node.js 22.x, 24.x, and 26.x; end-of-life 20.x will not be patched. Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. · CVE-2026-105626 (HashiCorp Consul) - CVSS 7.5 (High) Unauthenticated attacker can exhaust memory on a Consul agent via the HTTP API, causing denial of service. Fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 / 1.21.19. 📢 Join our Telegram channel for daily CVE updates and cybersecurity news: https://t.me/bugbountyusa #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #PatchManagement #ThreatIntelligence #SecurityAdvisory #BugBounty #DailyCVE #CyberNews

⚠️ Daily CVE Roundup - October 27, 2026 Here are the notable CVEs disclosed or updated today: 🔴 Critical & High Severity · CVE-2026-16521 (Supermicro BMC) - CVSS 7.2 (High). An OS command injection vulnerability exists in the syslog feature due to insufficient input filtering. An attacker can inject a command payload into a BMC function, which may execute when the related service is restarted . · CVE-2026-111497 (Google Brotli / Node.js) - High severity. Out-of-bounds write in the Brotli decoder allows remote code execution via a crafted compressed stream. Affects Brotli 1.0.3 through 1.2.0; fixed in Brotli 1.0.10, 1.1.1, 1.2.1, and Node.js 22.23.4, 24.22.1, 26.12.1 . 🟡 Medium & Notable · CVE-2026-114625 (Arista VeloCloud Orchestrator) - CVSS 9.9 (Critical). Any authenticated user, including the lowest "Enterprise Read Only" role, can escalate to superuser privileges and access internal-only functionality. Arista confirms active exploitation in the wild; fixed in 5.2.3.18, 6.1.3.10, 6.4.2.12 . · CVE-2026-105626 (HashiCorp Consul) - CVSS 7.5 (High). A denial of service in the HTTP API may allow an unauthenticated attacker to exhaust memory on a Consul agent. Fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 / 1.21.19 . 📢 Join our Telegram channel for daily CVE updates and cybersecurity news: https://t.me/bugbountyusa #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #PatchManagement #ThreatIntelligence #SecurityAdvisory #BugBounty #DailyCVE #CyberNews