Skip to content
TrustList

TrustList daily digest · Tech and security

Wednesday, 21 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security13

  1. 1Security advisories

    Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw

    E-Business Suite alone gets 194 patches, 31 of them exploitable without a login, led by an Application Object Library flaw rated 9.8. Fusion Middleware gets 206, MySQL 98 and Java SE 55.

  2. 2Security advisories

    PHP fixes two critical remote code execution flaws, update now

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close CVE-2026-109618 and CVE-2026-109619. Every PHP install serving web requests is at risk, mod_php most of all, and PHP 8.1 and older get no official fix.

  3. 3Security advisories

    SafePay ransomware has hit 600 victims, says joint FBI and CISA advisory

    US, German and UK agencies list the five edge and backup flaws the group exploits, and warn that it resets backup storage to factory settings before encrypting.

  4. 4Security advisories

    Node.js fixes a Brotli remote code flaw and two TLS hostname bypasses

    Releases 26.12.1, 24.22.1 and 22.23.4 close ten CVEs, four rated High, and also drop trust in the compromised eMudhra intermediates through the bundled CA store.

  5. 5Security advisories

    Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up

    Two flaws rated Important hit all three supported lines, a third affects only Tomcat 11, and the fixed releases have been out since 12 October.

  6. 6Security advisories

    Chrome 156 ships 353 security fixes, six of them rated Critical

    Six Critical memory bugs in Skia, Accessibility, CSS, Paint and WebRTC lead the list, with 61 High, 197 Medium and 89 Low. Google gave no sign of exploitation in the wild.

  7. 7Security advisories

    GitLab ships another CVSS 10 regex fix, update to 19.5.1 now

    CVE-2026-110264 lets an attacker with no login run code by compiling a crafted regular expression. Fixes reach back to 18.11.13, and a High flaw allows takeover of LDAP-backed accounts.

  8. 8Security advisories

    Ransomware gangs exploit a PAN-OS GlobalProtect bypass fixed since May

    Unit 42 ties Qilin and Inc intrusions to CVE-2026-0257, an authentication bypass that opens VPN sessions without credentials, and in one case a pivot to vCenter and ESXi.

  9. 9Security advisories

    Cisco Expressway clusters open to root code execution, fixed in X15.5.20

    CVE-2026-76466 scores 9.8 and needs no login: persistent cookies and weak certificate checks between cluster peers reach the database service. There is no workaround, and X14 users must migrate.

  10. 10Security advisories

    OVHcloud CLI downloads were swapped for a stealer for 94 minutes

    A hijacked contributor account replaced the macOS, Linux and Windows binaries of five releases on GitHub; v0.16.0 is a clean, attested rebuild, and anyone who installed in the window should rotate secrets.

  11. 11Security advisories

    BIND 9.20.30 fixes four High flaws, one may allow remote code execution

    ISC's October release closes a GSS-TSIG replay that corrupts memory and three resolver crashes. No 9.18 build is listed, so 9.18 users must move to 9.20.30.

  12. 12Security advisories

    Craft CMS sites need 5.11.0 or 4.18.8 to close Twig sandbox code flaws

    Nine advisories published on 5 October cover four high-severity code execution paths through the Twig sandbox; Canada's Cyber Centre urged updates on 20 October. The fixes have been out since 1 September.

  13. 13Security advisories

    LiteLLM 1.107.0 shipped a credential stealer on PyPI and Docker

    Attackers used stolen GitHub tokens from three engineers to publish poisoned builds for about two hours. Pin 1.106.2, clean the files by hand before running Python, and rotate every key the proxy held.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy