Rapid responses

ISC BIND is open-source software, maintained by the Internet Systems Consortium (ISC), that implements the Domain Name System (DNS), which is the foundational protocol for translating human-readable domain names into IP addresses.

ISC has released security updates that address four high-severity vulnerabilities in BIND 9:

• CVE-2026-19630: Inbound DNS messages with a particular structure cause additional processing with no limit in a BIND resolver, allowing a remote attacker to exhaust CPU and memory and cause a denial of service.

• CVE-2026-94300: Replaying GSS-TSIG signed UDP messages corrupts memory in the BIND “named” process. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid and, by also sending crafted queries to a zone the attacker controls, may cause the process to abort or potentially achieve remote code execution.

• CVE-2026-96888: A BIND resolver configured with both a “redirect” zone and “qname-minimization strict” may abort with an assertion failure while processing the redirect, allowing a remote attacker to cause a denial of service.

• CVE-2026-97313: A recursive BIND server that allows recursive queries and has at least two RPZ zones, one with the default “recursive-only yes” and one with “recursive-only no”, may exit with an assertion failure when it receives a query with RD=1 followed by a query with RD=0, allowing a remote attacker to cause a denial of service.

The following versions are affected:

• BIND 9.11 - 9.18: Versions 9.11.0 through 9.18.50 (CVE-2026-96888 affects versions 9.16.0 and later, and CVE-2026-97313 affects versions 9.16.0 and later)
• BIND 9.20: Versions 9.20.0 through 9.20.29
• BIND 9.21: Versions 9.21.0 through 9.21.26
• BIND Supported Preview Edition 9.11-S1 - 9.18-S1: Versions 9.11.3-S1 through 9.18.50-S1 (CVE-2026-96888 affects versions 9.16.8-S1 and later)
• BIND Supported Preview Edition 9.20-S1: Versions 9.20.9-S1 through 9.20.29-S1

Severity & Risk Assessment

• Severity: High - Remote attackers can crash or exhaust the resources of a DNS server, disrupting name resolution for every client that depends on it. CVE-2026-94300 may also allow remote code execution on the “named” host.
• Risk: Medium - The vulnerabilities are reachable over the network without authentication, but ISC is not aware of active exploits, CVE-2026-94300 requires a captured GSS-TSIG message and has high attack complexity, and CVE-2026-96888 and CVE-2026-97313 require specific non-default configurations.

No workarounds are known for any of these vulnerabilities.

Arista VeloCloud Orchestrator (VCO) is the centralized management and orchestration component of the VeloCloud SD-WAN solution, used to configure, monitor, and manage VeloCloud Edge devices across an enterprise network.

Self-hosted, on-prem deployments of VeloCloud Orchestrator contain a SQL injection vulnerability that allows a remote attacker to access privileged internal functionality and impact the VCO host. Any authenticated user, including one holding the lowest built-in tenant role (Enterprise Read Only), can gain operator privileges and masquerade as a local “superuser operator” user. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 23, 2026.

The following versions are affected:

• Arista VeloCloud Orchestrator 5.2.x: Versions prior to 5.2.3.18
• Arista VeloCloud Orchestrator 6.1.x: Versions prior to 6.1.3.10
• Arista VeloCloud Orchestrator 6.4.x: Versions prior to 6.4.2.12

Hosted and Dedicated versions of VeloCloud Orchestrator were affected and have already been patched by the vendor. End-of-support versions have not been assessed.

GitLab Community Edition (CE) provides core Git repository management and CI/CD pipelines, while Enterprise Edition (EE) includes all CE capabilities alongside advanced security, compliance, and enterprise scalability features.

Self-managed installations of GitLab Community Edition (CE) and Enterprise Edition (EE) contain a critical integer overflow vulnerability in the regular expression compiler. Under certain conditions, an unauthenticated attacker can supply a specially crafted regular expression to execute arbitrary code on the GitLab server.

The following versions are affected:

• GitLab CE & EE 7.0 - 18.11.x: Versions 7.0 through 18.11.12
• GitLab CE & EE 19.0.x: Versions 19.0.0 through 19.0.9
• GitLab CE & EE 19.1.x: Versions 19.1.0 through 19.1.8
• GitLab CE & EE 19.2.x: Versions 19.2.0 through 19.2.8
• GitLab CE & EE 19.3.x: Versions 19.3.0 through 19.3.5
• GitLab CE & EE 19.4.x: Versions 19.4.0 through 19.4.2
• GitLab CE & EE 19.5.x: Version 19.5.0

Severity & Risk Assessment

• Severity: Critical – Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the GitLab server, leading to full compromise of hosted source code, CI/CD secrets, and connected infrastructure.
• Risk: High - The vulnerability can be exploited remotely by an unauthenticated attacker with no user interaction.

PHP is a widely used open-source, general-purpose scripting language for web development. It runs web applications and content management systems, often through mod_php, PHP-FPM, or CGI.

The PHP Project has released a security update that addresses two critical vulnerabilities, collectively known as “php2shell”. Both are rated CVSS 9.2 and can allow unauthenticated remote code execution:

• CVE-2026-109618: PHP handles out-of-memory (OOM) errors by exiting the current context with longjmp(), which can interrupt PHP while request data is only partially initialized. Request cleanup may then read or branch on the invalid data, allowing an unauthenticated, remote attacker to execute arbitrary code. Crafted multipart requests can trigger the condition, and with Apache mod_php it can occur before any application code runs.

• CVE-2026-109619: PHP retains global state that points to memory owned by a request. If that state is not reset before the request memory is freed, a later request handled by the same worker can use the stale state before normal initialization, allowing an unauthenticated, remote attacker to execute arbitrary code.

All PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Applications that run on PHP, such as content management systems, e-commerce platforms, and web frameworks, may be exposed through a vulnerable PHP runtime.

Evidence indicates that CVE-2026-109618 and CVE-2026-109619 are actively exploited in the wild, leading to their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026.

The following versions are affected:

• PHP 8.2: Versions prior to 8.2.35
• PHP 8.3: Versions prior to 8.3.36
• PHP 8.4: Versions prior to 8.4.27
• PHP 8.5: Versions prior to 8.5.12

Note: PHP 8.1 and earlier no longer receive updates from the PHP Project and should be considered vulnerable unless a distribution or LTS vendor has backported the fixes.

Cisco Secure Email Gateway is an email security appliance, available as a physical, virtual, or cloud gateway, that protects organizations from spam, phishing, and malware. Its Advanced Malware Protection (AMP) feature uses a file reputation service to evaluate email attachments.

Certain versions of Cisco AsyncOS Software for Cisco Secure Email Gateway are affected by an arbitrary file write vulnerability within the Advanced Malware Protection (AMP) feature. The flaw stems from improper handling of email attachments on systems where the File Reputation service is enabled, assigned to a mail policy, and running Content Scanner Tools earlier than version 25.3.0.5525. An unauthenticated, remote attacker can exploit this by sending a specially crafted email attachment through an affected device, allowing them to write arbitrary files to the underlying operating system and execute commands with root privileges.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026.

The following versions are affected:

• Cisco Secure Email Gateway 15.5: Versions prior to 15.5.5-014
• Cisco Secure Email Gateway 16.0: All versions
• Cisco Secure Email Gateway 16.5: Versions prior to 16.5.0-780

Cisco recommends that customers running releases earlier than 16.5 migrate to 16.5.0-780.

BeyondTrust Remote Support (RS) is an enterprise platform designed for help desks to securely access and troubleshoot end-user devices or mobile platforms across any network without a VPN.

Certain versions of BeyondTrust Remote Support are affected by an improper origin validation vulnerability in internal messaging components of the appliance. The components do not adequately validate the origin of the messages they receive, which, under the right conditions, allows an attacker to perform file operations on the appliance.

Evidence indicates that this vulnerability is being actively exploited in the wild. BeyondTrust reported that a threat actor compromised a Remote Support SaaS instance on August 29, 2026, and the vulnerability was subsequently added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026.

The following versions are affected:

• BeyondTrust Remote Support: Versions 26.2.3 and prior.

SonicWall Secure Mobile Access (SMA) 1000 Series appliances are enterprise gateways that provide secure, policy-enforced Zero Trust and SSL VPN remote access to applications and network resources across on-premises, hybrid, and cloud environments.

Certain versions of SonicWall SMA1000 appliances are affected by multiple vulnerabilities:

• CVE-2026-102255: A pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Work Place interface, caused by an unintended alternate access path (forward proxy), allows a remote, unauthenticated attacker to direct the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations.

• CVE-2026-102256: An OS command injection vulnerability in the SMA1000 appliance allows a remote attacker authenticated as an administrator to execute arbitrary OS commands, resulting in remote code execution.

• CVE-2026-102257: A Zip Slip vulnerability in the SMA1000 Appliance Management Console (AMC) interface allows an authenticated, high-privilege attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

• CVE-2026-102258: A stored cross-site scripting (XSS) vulnerability in the SMA1000 Appliance Management Console (AMC) allows a remote attacker authenticated as an administrator to store and potentially execute arbitrary JavaScript code in the AMC.

The following versions are affected:

• SonicWall SMA1000 (models 6210, 7210, and 8200v) 12.4: Versions 12.4.3-03526 (platform-hotfix) and older
• SonicWall SMA1000 (models 6210, 7210, and 8200v) 12.5: Versions 12.5.0-02952 (platform-hotfix) and older

Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

Ivanti Connect Secure (ICS) (formerly Pulse Connect Secure) is a secure remote access and virtual private network (VPN) solution.

Certain versions of Ivanti Connect Secure are affected by an authentication bypass by spoofing vulnerability. A remote, unauthenticated attacker can exploit it to execute arbitrary commands on the appliance.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

The following versions are affected:

• Ivanti Connect Secure 25.1: Versions 25.1.1.1 and prior, and versions 25.1.2.2 and prior
• Ivanti Connect Secure 22.8: Versions 22.8R2.4 and prior

Ivanti Connect Secure 22.7R2.14 and prior, and 25.1.3.0 and later, are not affected.

GitLab Community Edition (CE) provides core Git repository management and CI/CD pipelines, while Enterprise Edition (EE) includes all CE capabilities alongside advanced security, compliance, and enterprise scalability features.

Self-managed installations of GitLab Community Edition (CE) and Enterprise Edition (EE) contain a critical integer overflow vulnerability in the CI/CD regular expression compiler. Due to insufficient regular expression validation, an unauthenticated attacker can supply a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on the GitLab server.

The following versions are affected:

• GitLab CE & EE 19.2.x: Versions 19.2.0 through 19.2.7
• GitLab CE & EE 19.3.x: Versions 19.3.0 through 19.3.4
• GitLab CE & EE 19.4.x: Versions 19.4.0 through 19.4.1

Severity & Risk Assessment

• Severity: Critical – Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the GitLab server, leading to full compromise of hosted source code, CI/CD secrets, and connected infrastructure.
• Risk: High - The vulnerability can be exploited remotely by an unauthenticated attacker with low attack complexity and no user interaction.

Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Software, and Jira Service Management are Atlassian’s self-managed products for CI/CD, source control, collaboration, identity, code review, and issue tracking.

Certain versions of these Atlassian products contain an arbitrary file access vulnerability that allows an unauthenticated, remote attacker to access specific files within the web application root directory. Exploitation requires prior knowledge of the target file’s exact name and path; the vulnerability does not allow an attacker to enumerate or list directory contents. In some configurations, sensitive files may be reachable this way, increasing the impact of exploitation. Atlassian Cloud sites have been patched and Atlassian’s investigation found no evidence of exploitation against Cloud.

Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 15, 2026.

The following versions are affected:

• Bamboo Data Center: All versions prior to 10.2.24 or 12.1.12.
• Bitbucket Data Center: All versions prior to 9.4.26, 10.2.8, or 10.5.1.
• Confluence Data Center: All versions prior to 9.2.26 or 10.2.19.
• Crowd Data Center: All versions prior to 6.3.7, 7.0.3, 7.1.7, or 7.2.4.
• Crucible: All versions prior to 4.9.15.
• Fisheye: All versions prior to 4.9.15.
• Jira Software Data Center: All versions prior to 9.12.40, 10.3.26, or 11.3.12.
• Jira Service Management Data Center: All versions prior to 5.12.40, 10.3.26, or 11.3.12.

Note: This query does not currently detect Crucible instances.

runZero has identified multiple vulnerabilities in a large subset of major baseboard management controllers (BMCs) that can lead to device compromise or segmentation breakdowns. Details of individual vulnerabilities will be published as the disclosure process completes.

BMCs are embedded into every modern enterprise server. These devices run their own OS, have their own network interfaces, and are network-reachable even when the server is powered off. The devices speak a protocol called IPMI that was thoroughly trashed by Dan Farmer’s ground-breaking research in 2013. Since Farmer’s original research into Cipher Zero authentication bypass and RAKP password hash disclosure, dozens of new vulnerabilities have been identified in these devices, but none of this research revisits the IPMI protocol itself.

High level details of our findings will be presented at Black Hat 2026 & DEF CON 34.