cybr.cx — Daily Digest | October 22, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | CVSS: N/A
An OS command injection vulnerability in SiteGuard Server Edition allows attackers to execute arbitrary OS commands with root or SYSTEM privileges. CISA added this to KEV on October 20 with a remediation deadline of October 23 — that's tomorrow. If you're running SiteGuard in any capacity, treat this as a fire drill.

⚠️ Actively exploited — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 | Plex Media Server | CVSS: N/A
Four chained vulnerabilities in Plex Media Server that together form a serious attack path: two SSRF flaws (one exploitable with any valid X-Plex-Token via the /video/:/transcode/universal endpoint), a URI scheme injection allowing cross-plugin function calls, and a path traversal enabling arbitrary file writes executed on load. These chain together into remote code execution. Plex is ubiquitous in home and small-office environments that often have implicit network trust — don't assume low-risk because it's a media server.

⚠️ Actively exploited — CVE-2026-0322 | Palo Alto Networks PAN-OS | CVSS: N/A
A code injection vulnerability in PAN-OS allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. An attacker with any valid credential can fully own perimeter infrastructure. Patch immediately; PAN-OS exploits have historically preceded large-scale intrusion campaigns.

⚠️ Actively exploited — CVE-2026-102764 | BeyondTrust Remote Support | CVSS: N/A
Authentication bypass by spoofing in BeyondTrust Remote Support allows a remote attacker to perform arbitrary file operations on the appliance without valid credentials. The CISA remediation deadline has already passed (October 19) — if you haven't acted, you're overdue.

⚠️ Actively exploited — CVE-2025-61624 | Fortinet FortiOS, FortiPAM, FortiProxy, FortiSwitchManager | CVSS: N/A
A path traversal flaw in multiple Fortinet products lets an authenticated admin-level user write or delete arbitrary files via specific CLI commands. Combined with credential theft or lateral movement, this could devastate network edge infrastructure. Remediation deadline was October 19.

⚠️ Actively exploited — CVE-2026-21589 | Atlassian Bitbucket, Confluence, Jira (Data Center), Bamboo, Crowd, Crucible, Fisheye | CVSS: N/A
An unauthenticated external file exposure vulnerability across essentially the entire Atlassian Data Center portfolio. The breadth of affected products — spanning source control, wikis, project management, and CI/CD — makes this exceptionally high-priority for any enterprise running self-hosted Atlassian infrastructure.

⚠️ Actively exploited — CVE-2026-76519 | Cisco Secure Email Gateway | CVSS: N/A
A relative path traversal bug allows an unauthenticated remote attacker to write arbitrary files to the underlying OS of Cisco's Secure Email Gateway. No authentication required makes this trivially weaponisable for initial access.

CVE-2026-101457 / CVE-2026-101518 / CVE-2026-101525 / CVE-2026-101526 | Oracle Siebel CRM & Enterprise Manager | CVSS: 8.8
A cluster of HIGH-severity Oracle flaws rounds out today's CVE list. The Siebel Life Sciences eDetailing component allows SQL-based network attacks from low-privileged users leading to full takeover (CVE-2026-101457). Oracle Enterprise Manager Base Platform and its Siebel management components (CVE-2026-101518, -101525, -101526) share the same 8.8 score and takeover impact via HTTP from low-privileged accounts. Oracle E-Business Suite's Capacity and Purchasing modules (CVE-2026-101542, CVE-2026-101557) carry identical risk profiles. If you're on the October Oracle CPU cycle, prioritise these.

Headline News

Two CVSS 10.0 PHP RCEs — And the Dutch National Cyber Security Centre Took Itself Offline

Two critical remote code execution vulnerabilities in PHP — both scoring a perfect CVSS 10.0 — were disclosed yesterday alongside emergency patches, after details reportedly leaked ahead of the planned disclosure window. The vulnerabilities affect the PHP runtime itself, meaning the exposure surface spans virtually every PHP-based web application globally: WordPress, Laravel, Symfony, legacy enterprise apps, and everything in between. In a somewhat ironic turn, the Dutch National Cyber Security Centre (NCSC) proactively took its own public-facing website offline because it runs on PHP — a move that's either admirably cautious or a pointed statement about the severity, depending on how you read it. The PHP Foundation has acknowledged the release and indicated it is taking steps to strengthen its security processes in response to the pre-disclosure leak. Administrators should patch immediately and assume that exploit code is either already circulating or will be within hours given the public attention this has drawn.

Compromised LiteLLM Package on PyPI Delivered Credential Stealer and Backdoor

LiteLLM version 1.107.0, a widely used Python library providing a unified interface to large language model APIs, was found to contain a credential stealer and backdoor after the package on PyPI was compromised. The malicious package was designed to exfiltrate credentials — particularly concerning given that LiteLLM is frequently used in AI infrastructure that handles API keys for OpenAI, Anthropic, and similar services. Any environment that pulled this specific version during its window of availability should be treated as potentially compromised: rotate all LLM API keys, audit environment variables, and check for unexpected outbound connections. This is the latest in a sustained wave of supply chain attacks targeting the AI/ML ecosystem, where developers often install packages rapidly to prototype and may not scrutinise dependency integrity as carefully as in production software pipelines.

North Korea's Drift Heist Laundering Continues — $61M Through Tornado Cash

A wallet attributed to the North Korea-linked threat actor behind April's $295 million Drift protocol exploit pushed approximately 25,700 ETH (roughly $61 million) through the Tornado Cash mixer within a two-hour window, with an estimated $198 million still under the actor's control. The transaction pattern is consistent with DPRK's well-documented practice of staging large crypto thefts and then methodically laundering proceeds over months. For security teams operating in the Web3 space or managing DeFi treasury exposure, this is a reminder that the threat actor is still active, still holding substantial funds, and likely still operational — meaning further laundering events or new exploits targeting DeFi protocols remain a live risk. The speed and scale of the mixing operation also underscores the continued utility of Tornado Cash for state-level actors despite prior sanctions pressure.

Schrödinger's Feed

Black Kite has launched a Quantum Readiness assessment feature within its Cyber Rating engine, designed to surface whether third-party vendors in your supply chain are prepared for post-quantum cryptography — including alignment with regulatory deadlines like OMB M-26-15. The tool essentially operationalises what has been a largely theoretical concern: organisations can now get scored risk data on whether their vendors are still running cryptography that a sufficiently capable quantum computer would unravel. It's a meaningful development because PQC migration is a supply-chain problem as much as an internal one — your own NIST-approved algorithms mean little if your payment processor or SaaS vendor is still on RSA-2048. Practitioners building third-party risk programmes should start asking vendors pointed questions about their PQC migration timelines now, before regulatory deadlines force the conversation under pressure.

/dev/random

The Dutch National Cyber Security Centre — the government body literally responsible for telling everyone else to patch their systems — voluntarily took its own website offline because it runs PHP, in response to yesterday's CVSS 10.0 PHP RCE disclosures. The site remained dark while the rest of the internet waited for emergency patches, which is either the most self-aware thing a national security agency has ever done or a very public admission that government IT modernisation is moving at a characteristically measured pace. To be clear: they did the right thing. It's just genuinely funny that the Dutch cyber agency's primary communication channel for security advisories became inaccessible during one of the day's biggest security events because of the very vulnerability category they'd normally be issuing advisories about. Patch your PHP. Even if you run a cybersecurity website.