Skip to content
TrustList

TrustList daily digest · Tech and security

Tuesday, 20 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security9

  1. 1Security advisories

    FortiSIEM 7.5.0 has a critical unauthenticated file-write flaw

    CVE-2026-106173, rated 9.4, lets an attacker write files through the phQueryMaster gRPC service on TCP port 27918; 7.5.1 fixes it, 7.6 and FortiSIEM Cloud are not affected.

  2. 2Security advisories

    Thunderbird fix stops Exchange setup sending passwords over plain HTTP

    Thunderbird 158.0.1 and 153.5.1 fix three high-rated flaws, including XMPP stanza injection and an NTLM memory leak; Firefox 158.0.1 and both ESRs build in the block on compromised eMudhra intermediates.

  3. 3Security advisories

    Roundcube 1.7.5 and 1.6.20 fix 20 flaws, including IMAP injection

    The webmail project fixes command and header injection, an SSRF filter bypass, object injection in sessions and a password driver that could change another user's password; Italy's ACN rates the IMAP flaw high.

  4. 4Security advisories

    Siemens Software Center flaw exploited through signed copies

    Attackers bundle a genuine, signed copy of the installer tool with a malicious DLL in a ClickFix campaign; version 4.0.9.8 fixes CVE-2026-110936 and installs itself on the next start.

  5. 5Security advisories

    Shopware 6.7 media upload flaw can hand attackers the admin, no patch yet

    CERT/CC says HTML files uploaded as media are served without protective headers, letting a user with upload rights steal an administrator's token and, with plugin rights, run PHP code; it could not reach Shopware.

  6. 6Security advisories

    Zoom fixes three high-severity flaws in Workplace and Rooms apps

    A Zoom Phone buffer overflow, CVE-2026-53420, scores 8.0, and two certificate validation flaws in the Windows app and the My Notes feature score 7.4; version 7.2.0 or the 7.1.9 branch fixes them.

  7. 7Security advisories

    Advantech fixes 30 flaws in ADAM-3600 controllers, some rated 9.3

    EdgeLink v2.8.5.0 closes CVE-2026-43829 to 43858 in the industrial edge controller, including stack overflows and forged firmware uploads; Canada's Cyber Centre flagged the advisory on 20 October.

  8. 8Security advisories

    CERT/CC finds TLS libraries disagree on certificate name constraints

    Thirteen records across GnuTLS, OpenSSL, Go, NSS, wolfSSL, pyca/cryptography and others; fixes are out for three libraries, and CERT/CC stresses that a disagreement alone is not an exploit.

  9. 9Security advisories

    AOMEI update servers were hijacked for minutes at a time to push malware

    Google's threat team says UNC7017 rewrote AOMEI Backupper and AnyViewer update files for five to ten minutes at a time between April and July 2026; the vendor's server fix does not clean infected PCs.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy