Git patches six flaws, including code execution on recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
Stories per day · 30 days
8 RSS
Relatedphp11brotli6php2shell5use-after-free5chrome4heap-overflow4nodejs4rce4remote-code-execution4browser3cisa3cisa-kev3denial-of-service3google3godot2kev2linux2mod-php2
77 stories, newest first · one card per story
Stories tagged #memory-corruption
Xen guest can double-unmap memory in Linux xen-netback (CVE-2026-99287)
Illegal ring indexes during frontend setup make cleanup unmap connection resources twice; no fix or attacks are stated.
X.Org fixes eight X server and Xwayland memory flaws
Fixes are in xorg-server 21.1.26 and xwayland 24.1.15; X.Org gave no severity scores or exploitation status.
Apache OpenOffice out-of-bounds write in PDF import
Apache OpenOffice through 4.1.16 allows out-of-bounds memory write when importing encrypted PDF files, causing crash or memory corruption.
TightVNC Viewer pre-auth RCE via memory corruption
Attackers execute code on Windows PCs before password prompt using crafted large screen sizes in RFB protocol; PoC released but no active exploitation confirmed.
TeamViewer before 15.83 lets a host attack the viewer (CVE-2026-111585)
A malicious host can crash the viewer and, on Windows, Remedio showed code execution that is not yet fully remote.
2
Telegram for Android flaw ran code after a voice call was answered
Versions 8.6.2 through 12.10.3 were affected; 12.10.4, released in late September, fixes MediaState handling, and no CVE was assigned as of October 29.
PHP2Shell flaws exploited in the wild; OffSec ships free lab
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
Four EPICS Base flaws patched, one scored CVSS 9.8
Base 7.0.10 and earlier is affected; 7.0.11 is the fix, and CISA reports no public exploitation.
Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
CISA lists exploited Google Brotli flaw CVE-2026-111497
A crafted Brotli stream can corrupt decoder memory, leak data, cause denial of service, or run code.
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
CISA adds two exploited PHP flaws to the KEV catalog
CVE-2026-109618 and CVE-2026-109619 are known exploited; BOD 26-04 tells FCEB agencies to remediate them first.
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
1
CISA KEV lists PHP memory-corruption flaw enabling unauthenticated RCE
CVE-2026-109618 is an out-of-memory corruption bug; federal due date is October 29, and ransomware use is unknown.
Brotli decoder flaw CVE-2026-111497 can leak memory or run code
Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.
4
jxrlib memory bugs on damaged JPEG XR fixed in fork 1.4.4
A few-hundred-byte damaged file can trigger a heap overflow write, and most distributions still ship unfixed code.
Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy
Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.
PHP before 8.2.35 and related releases allows remote code execution
Two flaws let unauthenticated attackers send crafted HTTP requests; a mod_php proof of concept runs before application code.
2
PHP2Shell exploitability depends on the runtime, Horizon3 says
Horizon3 validated CVE-2026-109618 and CVE-2026-109619 only under preconditions it is still mapping.
PHP patches two critical unauthenticated RCE flaws
Fixes ship in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; config changes do not fully close exposure.
Researcher reports double-free in PHP 8.4.25, 8.5.10 and 8.5.12
Elise sent PHP a short proof of concept; no CVE, patch, or vendor confirmation is stated.
1
ISC BIND 9 flaws can exhaust resources or crash named
Four CVEs cover message-processing exhaustion, GSS-TSIG memory corruption, and unexpected exits.