Onyx — signals

Discussed, not on watchlist: CVE-2026-109618 (5 advisories, reddit 7, github 166, hn 17)

Wed, 21 Oct 2026 18:08:00 +0000

GitHub: Jamalofski/php-8.1-cve-builds — Unofficial Windows builds of PHP 8.1.34 with the CVE-2026-109618/109619 fix (vs16, official builder) · Hacker News: Today's PHP security release, and how we're strengthening security · Hacker News: PHP 8.2.35

Discussed, not on watchlist: CVE-2026-109619 (5 advisories, github 114, reddit 5, hn 8)

Wed, 21 Oct 2026 17:37:41 +0000

GitHub: lushinshang/php2shell-cve-2026-109618 — PHP2Shell（CVE-2026-109618 / CVE-2026-109619）兩天全紀錄：以 php.net 官方公告為主軸的繁中深度導讀 · GitHub: mejustbox-byte/CVE-2026-109618-CVE-2026-109619 — PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart reachability eviden · GitHub: kiran-ox/php2shell-check — Read-only checker for PHP2Shell (CVE-2026-109618, CVE-2026-109619): finds vulnerable PHP, services still running old code after an update, a

Discussed, not on watchlist: CVE-2026-10961 (0 advisories, github 3)

Wed, 21 Oct 2026 17:15:23 +0000

GitHub: al4n4n/php2shell — php2shell 100% work DoS in Wordpress. CVE-2026-109618 and CVE-2026-10961 · GitHub: goodcoddeo/pterodactyl_PHP-CVE-2026-10961x — Pterodactyl PHP security updater for Ubuntu 24.04 and Debian 12/13. AppliePHP security updates for CVE-2026-109618 and CVE-2026-109619 (crit · GitHub: dinosn/php-cve-2026-10961x-lab-poc — PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), f

New: CVE-2017-17093 · medium (WordPress)

Wed, 21 Oct 2026 16:27:44 +0000

WordPress before 4.9.1 contains a reflected cross-site scripting caused by improper restriction of the lang attribute in HTML elements, letting attackers execute malicious scripts via the site's language setting, exploit requires attacker to manipulate site language setting.

New: CVE-2026-2238 · medium (GitLab)

Wed, 21 Oct 2026 15:38:19 +0000

GitLab CE/EE >= 17.5 < 18.11.6, >= 19.0 < 19.0.3, and >= 19.1 < 19.1.1 contain an information disclosure vulnerability caused by improper authorization checks in confidential issue references, letting unauthenticated users view confidential issue references on public projects, e…

New: CVE-2025-64137 · medium (Jenkins)

Wed, 21 Oct 2026 15:38:19 +0000

Jenkins Themis Plugin <= 1.4.1 contains a broken access control caused by missing permission check, letting attackers with Overall/Read permission connect to attacker-specified HTTP servers, exploit requires Overall/Read permission.

New: CVE-2025-64143 · medium (Jenkins)

Wed, 21 Oct 2026 15:38:19 +0000

Jenkins OpenShift Pipeline Plugin <= 1.0.57 contains an information disclosure vulnerability caused by storing authorization tokens unencrypted in job config.xml files, letting users with Item/Extended Read permission or file system access view sensitive tokens, exploit requires…

New: CVE-2025-64138 · medium (Jenkins)

Wed, 21 Oct 2026 15:38:19 +0000

Jenkins Start Windocks Containers Plugin <= 1.4 contains a cross-site request forgery vulnerability caused by insufficient request validation, letting attackers connect to attacker-specified URLs, exploit requires victim interaction.

New: CVE-2019-10209 · low (PostgreSQL)

Wed, 21 Oct 2026 15:38:19 +0000

PostgreSQL 11.x before 11.5 contains a memory disclosure caused by cross-type comparison in hashed subplan, letting attackers retrieve sensitive memory data, exploit requires crafted SQL queries.

Discussed, not on watchlist: CVE-2026-96652 (1 advisories, github 3)

Wed, 21 Oct 2026 15:09:39 +0000

GitHub: w116tjb/plex2shell-windows-hunt — Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script · CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog · GitHub: ChrisLPJones/plex2shell-check — Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild

New: CVE-2011-3187 · medium (Ruby on Rails)

Wed, 21 Oct 2026 15:00:11 +0000

Ruby on Rails 3.0.5 contains a to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb that does not validate the X-Forwarded-For header from Class C network IP addresses, letting remote attackers inject arbitrary text into log files or bypass address parsing via c…

New: CVE-2011-2932 · medium (Ruby on Rails)

Wed, 21 Oct 2026 15:00:11 +0000

Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 contain a reflected cross-site scripting caused by a malformed Unicode string in output_safety.rb, letting remote attackers inject arbitrary web script or HTML, exploit requires sending a specially …

New: CVE-2024-23111 · medium (Fortinet FortiOS)

Wed, 21 Oct 2026 15:00:11 +0000

FortiOS versions 7.4.3 and below, 7.2 all versions, 7.0 all versions, and FortiProxy versions 7.4.2 and below, 7.2 all versions, 7.0 all versions contain a cross-site scripting caused by improper input neutralization during web page generation, letting remote privileged attacker…

New: CVE-2025-61624 · medium (Fortinet FortiOS)