A critical authentication bypass vulnerability, known as "sshole," affects OpenSSH deployments on musl-based Linux systems. The flaw can allow attackers to authenticate to accounts configured to reject password-based logins by submitting an oversized password. Affected environments include Alpine Linux, OpenWrt, Buildroot and Yocto-based systems where specific authentication conditions are present. Organisations should review exposed SSH services and apply the appropriate security updates or mitigations.

A critical zero-day vulnerability affecting Zyxel GS1900 Series network switches is being actively exploited, with approximately 996 devices reportedly compromised across 48 countries. Tracked as CVE-2026-107441 (CVSS 9.8), the flaw allows unauthenticated attackers to execute commands with root privileges through the web management interface. The vulnerability bypasses an earlier security fix, leaving devices running Patch 2 firmware exposed. Zyxel has released Patch 3 updates to address the issue.

North Korean-linked attackers reportedly stole US$6.34 billion from Binance following a five-month social engineering campaign targeting engineers through fake recruitment. Malware, compromised deployment credentials and abused internal AI tools enabled unauthorised transfers without exploiting software vulnerabilities.

Cisco has released security advisories addressing vulnerabilities in Cisco Unified Communications Manager and Cisco UCS Central Software. CVE-2026-76419 (CVSS 6.1) could allow unauthenticated attackers to conduct cross-site scripting attacks against users of the Unified Communications Manager interface.

Two security vulnerabilities have been identified in end-of-life SonicWall Global Management System (GMS) software. CVE-2026-109593 (CVSS 9.1) could allow unauthenticated attackers to read sensitive internal files, while CVE-2026-109594 (CVSS 6.8) could enable authenticated SQL injection attacks. Both vulnerabilities affect GMS version 9.5.2 and earlier.

A high-severity vulnerability in WordPress Core, tracked as CVE-2026-119977 (CVSS 8.1), is reportedly being actively exploited and has been added to CISA's Known Exploited Vulnerabilities catalogue.

A high-severity vulnerability in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated remote attackers to trigger a memory overflow, causing denial of service. The flaw affects appliances configured as SAML Service Providers or Identity Providers, potentially disrupting access to critical enterprise applications and services.

Coordinated attacks on Danfoss, Copeland and Dixell refrigeration controllers disrupt European retailers, causing temperature excursions and food losses.

A critical vulnerability in the Linux kernel's IPv4 TCP networking implementation, tracked as CVE-2026-98432 (CVSS 9.8), could allow unauthenticated attackers to achieve remote code execution under specific conditions.

Cisco ASA and FTD flaw CVE-2026-76418 (CVSS 8.6) lets unauthenticated attackers reload VPN devices. No workarounds; apply Cisco's fixed releases.

Brotli flaw CVE-2026-111497 affects Node.js in VMware SDDC Manager, enabling remote code execution. Apply Broadcom workarounds KB460732 or KB460734.

Jenkins 2.587 and LTS 2.580.1 and earlier have 15 flaws (CVSS up to 8.8) enabling code execution and XSS. Update to 2.588 or LTS 2.580.2.

Critical Brotli decoder flaw CVE-2026-111497 allows unauthenticated remote memory corruption and code execution. Patch Node.js and other bundled copies.

23 October 2026 advisories cover industrial products including SIMATIC, RUGGEDCOM and Kiloview E3, with flaws up to CVSS 9.9 and some with no fix.

Cisco discloses critical flaws in Expressway (CVSS 9.8), Unified Communications and Snort 3, and is investigating products exposed to the PHP flaws.

Splunk's October 2026 releases fix 16 flaws, including CVE-2026-76299 and CVE-2026-76302 (CVSS 9.9) and PostgreSQL sidecar flaw CVE-2026-76298 (CVSS 8.8).

GitLab CE/EE flaw CVE-2026-110264 (CVSS 10.0) allows unauthenticated remote code execution. Upgrade to 19.5.1, 19.4.3, 19.3.6 or your branch's fix.

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Oracle's October 2026 Critical Patch Update ships 1,295 patches, 112 critical, with remote code execution risk and exploitation of unpatched customers reported.

ICS advisories cover HMS PEAK-System PCAN drivers, Moxa AIG-302 and Hitachi Energy SYS600 and RTU500, with flaws enabling DoS and key disclosure.

BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) is exploited in the wild, letting remote attackers run file operations and deploy web shells.