Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
7 stories match your filters.
Drupal says attackers are exploiting CVE-2026-118539, a 'Highly critical' access bypass in Commerce Core that can hit store owners financially. Fixed in 3.3.13 and 8.x-2.41; audit your orders.
CVE-2026-98432, a 9.8-rated race in Linux's IPv4 TCP handshake dating to 4.4, can give a remote attacker root; Anthropic says Claude wrote a working exploit. Debian, Oracle, SUSE and Amazon have fixes; Ubuntu and RHEL are pending.
Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured.
CVE-2026-97631, a 9.5-rated overflow in EDK II's PXE driver dating to 2010, can let someone on the local network run code before Secure Boot on network-booting machines. Firmware updates are still pending.
CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.
GitLab fixed CVE-2026-110264, a CVSS 10.0 flaw in its bundled Ruby regex engine that could let unauthenticated attackers run code on self-managed servers as old as version 7.0. No exploitation seen yet, and no workaround.
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.