Skip to content
TrustList

TrustList daily digest · Tech and security

Thursday, 15 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security9

  1. 1Security advisories

    Next.js 16.4.1 fixes two critical flaws that need no login to exploit

    One flaw sits in image optimisation of SVG files and reaches back to Next.js 10; the other hits the use cache directive in 16.x and has no workaround. A third advisory fixes a Server Actions denial of service.

  2. 2Security advisories

    Cisco patches exploited root-access flaw in Secure Email Gateway

    CVE-2026-76519 scores 9.8, was found in Cisco's own scanning, and can be fixed without a restart by updating the Content Scanner Tools package.

  3. 3Security advisories

    Drupal fixes critical Field UI flaw with a no-login path via add-ons

    SA-CORE-2026-014 scores 19 out of 25. Sites on 11.2 or 10.5 and older have no patch; uninstalling the Field UI module blocks the flaw until an upgrade is possible.

  4. 4Security advisories

    Ahsay says its first AhsayCBS patches were incomplete and ships new hotfixes

    The backup server maker now tells partners on versions 7 to 10 to apply hotfix 10.3.4.45 or 9.15.2.70 and to rebuild any server that shows signs of compromise from a clean install.

  5. 5Security advisories

    AWS patches Gremlin import flaw in Amazon Neptune graph database

    Bulletin 2026-136-AWS covers every engine from 1.2.0.0. Clusters with automatic minor upgrades get the fix in their next maintenance window; the rest must move to 1.4.7.1, 1.4.8.1 or 1.5.0.0.

  6. 6Security advisories

    Palo Alto Networks fixes exploited root-level flaw in PAN-OS

    The company found CVE-2026-0322 itself, saw very limited attacks from three IP addresses, and lists no workaround. One fix, for 11.2.16, was still due on 15 October.

  7. 7Security advisories

    Exploit attempts hit Langflow flaw that runs any command via MCP

    Any signed-in Langflow user could run shell commands on the server by adding an MCP server. The flaw was patched in September; a related one was fixed only in 1.10.3, and the current release is 1.12.6.

  8. 8Security advisories

    Slican fixes three flaws in IPx phone exchanges; old models stay exposed

    CERT Polska says a hardcoded key lets anyone with the firmware files decrypt traffic. The fix needs IPx 6.62.0100; CCT-1668, MAC-6400 and CXS-0424, discontinued in 2011 and 2012, will not get one.

  9. 9Security advisories

    nginx 1.31.7 and 1.30.6 fix five flaws, one present since 2005

    The alias and rewrite overflow affects every release since 0.1.29. The fix release also moves HTTP/2 to RFC 9218 prioritisation and adds MaxMind DB support to the GeoIP modules.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy