cybr.cx Daily Digest — October 29, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-109618 & CVE-2026-109619 | PHP | No CVSS listed | PATCH NOW
Two PHP remote code execution vulnerabilities are actively being weaponised in the wild, with CISA remediation deadlines of today. CVE-2026-109618 exploits an out-of-memory corruption condition to achieve unauthenticated RCE; CVE-2026-109619 abuses stale internal request state for the same outcome. Any internet-facing PHP application is a candidate target — if you haven't patched, assume exposure.

⚠️ Actively exploited — CVE-2026-46300 | Linux Kernel | No CVSS listed | Due 2026-10-31
A missing variable initialisation in the Linux kernel's socket buffer coalescing logic fails to preserve the shared-fragment marker during ESP input processing, causing IPsec to decrypt shared fragments in place. Exploitation in the wild is confirmed. Distributions are shipping fixes — prioritise kernel updates on any IPsec-terminating host immediately.

⚠️ Actively exploited — CVE-2026-41709 | VMware ESX (Broadcom) | No CVSS listed | Due 2026-11-11
An insufficient logging vulnerability in VMware ESX allows a malicious actor with administrative access to execute privileged operations without generating audit log entries. Actively exploited — likely used post-compromise to suppress forensic artefacts. Review hypervisor admin access controls and out-of-band log aggregation pipelines now.

⚠️ Actively exploited — CVE-2026-48356 | Adobe Commerce & Magento | No CVSS listed | Due 2026-11-10
An unrestricted file upload flaw in Adobe Commerce and Magento allows arbitrary code execution in the context of the current user session, with potential for privilege escalation. Active exploitation makes this a high-priority patch for any e-commerce operation running either platform.

⚠️ Actively exploited — CVE-2026-111497 | Google Brotli | No CVSS listed | Due 2026-11-10
An unchecked return value in the Brotli decompression library allows a remote unauthenticated attacker to corrupt decoder state memory via a crafted compressed stream, enabling memory disclosure, DoS, or code execution. Brotli is embedded in browsers, CDN infrastructure, and countless HTTP stacks — blast radius is wide.

⚠️ Actively exploited — CVE-2026-114625 | Arista VeloCloud Orchestrator | No CVSS listed | Past due
A SQL injection vulnerability in the on-premises VeloCloud Orchestrator allows unauthenticated remote attackers to access privileged internal functionality and compromise the orchestrator host's confidentiality, integrity, and availability. CISA's remediation deadline has already passed — if you haven't acted, treat this as an active incident until proven otherwise.

⚠️ Actively exploited — CVE-2026-110447 | Collabora Online (Built-in CODE Server) / Nextcloud | No CVSS listed | Past due
An OS command injection flaw in Collabora's built-in CODE server, as deployed within Nextcloud, allows remote code execution when the CODE server process is not running. CISA deadline has passed. Nextcloud administrators should verify CODE server status and apply available patches or mitigations immediately.

CVE-2026-83831 & CVE-2026-85898 | Microsoft Edge (Chromium) | CVSS 8.8 | HIGH
Two distinct browser engine flaws affecting Chromium-based Edge: a double-free (CVE-2026-83831) and a type confusion vulnerability (CVE-2026-85898), both scoring 8.8 and both enabling remote code execution over a network without authentication. Neither appears in the KEV yet, but browser engine bugs at this severity tend to move fast. Update Edge enterprise deployments via standard patch channels.

CVE-2026-103401 | Juniper Networks Session Smart Router / Session Smart Conductor | CVSS 8.8 | HIGH
A link-following vulnerability in unauthenticated web server handlers allows a local unprivileged user to overwrite arbitrary files as root. The attack surface includes Mist-managed and standalone unmanaged routers. Local privilege escalation to root via file overwrites on network infrastructure is a serious lateral movement enabler.

CVE-2026-1928 | Rank Math SEO Plugin for WordPress (≤ 1.0.276) | CVSS 8.8 | HIGH
PHP Object Injection via the updateMeta REST API endpoint is exploitable by any contributor-level authenticated user. Combined with a POP chain, this achieves remote code execution. With Rank Math installed on millions of WordPress sites, contributor accounts — often lightly controlled — are the attack vector to lock down.

CVE-2026-109384 | IvyForms Plugin for WordPress (≤ 1.5.1) | CVSS 8.8 | HIGH
Arbitrary file upload is possible due to absent dangerous-extension denylisting and deliberate bypassing of WordPress's native MIME and extension defences in the filterFiletypeAndExt function. This is a textbook webshell upload path — disable or update the plugin immediately.

Headline News

Critical UEFI Firmware Flaw Threatens Server Infrastructure at Scale
A code-execution vulnerability has been disclosed in UEFI firmware affecting the vast majority of server hardware currently in production. The flaw enables pre-boot code execution, meaning a successful attacker can establish persistence that survives OS reinstallation, disk wiping, and most conventional incident response procedures. The severity is compounded by the breadth of affected hardware — UEFI is effectively ubiquitous across x86 server infrastructure — and by the operational difficulty of deploying firmware updates at scale in enterprise and cloud environments. Practitioners should identify affected firmware versions from their hardware vendors immediately, prioritise critical and internet-adjacent systems for patching, and audit Secure Boot configurations as a compensating control where firmware updates cannot be rapidly deployed.

Data Recovery Firm CEO Indicted for Ransomware Victim Fraud
Federal prosecutors have indicted the CEO of a data recovery company on charges of defrauding ransomware victims — allegedly collecting large fees while secretly paying ransoms directly to the threat actors and pocketing the difference, rather than performing any genuine decryption work. The case is a significant reminder that the ransomware ecosystem extends well beyond the initial extortionists: a grey market of intermediaries, some operating in bad faith, has grown up around victim desperation. For incident responders and procurement teams, this underscores the critical importance of vetting data recovery and negotiation vendors rigorously before engaging them during an active incident. Organisations should establish trusted IR relationships before a crisis, not during one — when the pressure to act fast can override due diligence.

GMO Cyberattack Triggers 150 Million Yen Bounty for Attacker Identification
Japanese internet conglomerate GMO has announced a reward of approximately 150 million yen (roughly $1 million USD) for actionable information leading to the identification of threat actors responsible for a cyberattack on its systems, while also committing to compensate affected customers whose personal data was exposed. The scale of the bounty signals both the severity of the breach and a growing trend among large organisations to pursue offensive attribution strategies as a complement to defensive response. While the technical specifics of the attack vector have not been publicly confirmed, the simultaneous data exposure and system compromise suggests the incident involved persistent access rather than a smash-and-grab. Security teams at organisations with significant exposure to Asia-Pacific threat actors should treat this as a signal to review detection coverage for lateral movement and data exfiltration paths.

Schrödinger's Feed

Molecular Qubits Meet Photonic Chips
NVision Quantum Technologies has published peer-reviewed research demonstrating coherent single-molecule control and optical readout of organic carbene molecules used as qubits — and immediately partnered with HyperLight Corporation to integrate these molecular qubits onto thin-film lithium niobate photonic chips. The approach is compelling because molecular spin systems can offer long coherence times, and co-locating them on photonic infrastructure opens a path toward scalable, room-temperature-compatible quantum interconnects. This doesn't break RSA tomorrow, but the trajectory of photonic-integrated quantum hardware is shortening the timeline to fault-tolerant systems that would make current public-key cryptography untenable. Practitioners overseeing long-lived secrets or infrastructure with decade-scale operational lifespans should be actively inventorying cryptographic dependencies and tracking NIST PQC migration progress — the window is narrowing faster than most patching cycles.

/dev/random

AI Agents Score Surprisingly Well on Professional Tax Work — Until They Don't
Surge HQ ran 50 professional-grade tax assignments through current AI agents and found performance that ranged from genuinely impressive to confidently, expensively wrong — the classic model behaviour of presenting a hallucinated tax code reference with the same composure as a correct one. The specific failure mode that should give practitioners pause isn't incompetence; it's calibration: the agents didn't know what they didn't know, which in a tax context translates to plausible-looking errors that require a human expert to catch. For security teams considering AI agents for compliance or audit tasks, "it got most of them right" is not a sufficient acceptance criterion. Treat AI tax (and security policy) output the way you treat unsigned code — verify before you execute.