Skip to content
TrustList

TrustList daily digest · Tech and security

Thursday, 22 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security8

  1. 1Security advisories

    Splunk Enterprise and SOAR fix critical flaws scoring up to 9.9

    Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16 and SOAR 8.7.0 close internally found flaws, an unauthenticated crash of Splunk Web and a sidecar password any low-privileged user could derive.

  2. 2Security advisories

    Oracle patches a CVSS 9.1 Java TLS flaw in an out-of-cycle alert

    CVE-2026-91403 in JSSE can be exploited over the network with no login. Every listed build is affected, including 25.0.5 and 21.0.13, so Java estates need to patch again.

  3. 3Security advisories

    PAN-OS and Panorama are hit by the PHP flaws, with no fix date yet

    Palo Alto lists every supported PAN-OS line and Panorama as affected by CVE-2026-109618 and CVE-2026-109619 through the management interface. Threat Prevention signatures and access limits are the stopgaps.

  4. 4Security advisories

    AWS fixes an agent SDK flaw that mixed up callers' conversations

    Four AWS bulletins on 22 October: Strands Agents A2A servers leaked conversation history between callers, SAM CLI's Terraform hook allowed command injection, Athena exposed query text, and aws-c-mqtt could crash clients.

  5. 5Security advisories

    Apache Camel 4.22.1 users need 4.22.2 for seven more flaws

    A week after 38 advisories, Camel published seven more on 22 October, led by a High-rated XXE in camel-saxon. On the 4.22 LTS line only 4.22.2 fixes them; 4.18.5 and 4.23.0 already do.

  6. 6Security advisories

    Microsoft ties ConnectWise breach to Storm-0940 and an AI attack framework

    Microsoft says a China-aligned group used ARTEX, an open-source multi-agent pen-testing tool, to reach privileged cloud access in under three hours in some cases, and lists the Entra checks every affected tenant should run.

  7. 7Security advisories

    QPACK flaws let one connection exhaust memory on HTTP/3 servers

    FoxIO found seven of ten HTTP/3 stacks open to header amplification. quic-go, Cloudflare quiche, lsquic and Wireshark are fixed; Bun, the h3 crate and aioquic are not, and a proof of concept is public.

  8. 8Security advisories

    Laravel fixes an API token bypass that hands over any account

    CVE-2026-114509 lets an attacker with no token log in as an existing user on apps using TokenGuard with MySQL or MariaDB. Upgrade to 13.29.0 or 12.68.0; a proof of concept is public.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy