Security news.
Critical remote code execution and privilege escalation flaws take center stage today, led by active exploitation alerts from CISA and emergency patches across core enterprise infrastructure. Tailscale users face uncoordinated disclosures enabling root escalation, while Microsoft issues out-of-band updates to neutralize compromised eMudhra certificate authorities. Meanwhile, Apple has extended protections for an actively exploited CoreGraphics zero-day to older operating systems.
CISA Adds Adobe Commerce and Google Brotli Flaws to KEV Catalog
CISA added an Adobe Commerce/Magento arbitrary file upload flaw (CVE-2026-48356) and a Google Brotli vulnerability (CVE-2026-111497) to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation.
Tailscale Rushes Fixes After Zero-Day SSH Disclosure
Tailscale is urgently addressing a cluster of vulnerabilities dubbed 'Tailworm' that were publicly disclosed without coordination, allowing attackers to crash servers, steal credentials, and escalate to root privileges.
Microsoft Issues OOB Updates to Revoke Compromised eMudhra Certificates
Microsoft released out-of-band security updates to distrust intermediate certificate authority keys from eMudhra to protect Windows systems from potential adversary-in-the-middle attacks.
Apple Backports Fix for Exploited CoreGraphics Zero-Day to Older Devices
Apple has backported patches for CVE-2026-86950, an out-of-bounds write flaw in CoreGraphics leading to arbitrary code execution, which was actively exploited against iOS devices.
CISA Orders Federal Agencies to Patch Exploited PHP2Shell Vulnerabilities
Critical PHP remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) have been targeted in active attacks, prompting CISA to mandate rapid remediation across enterprise environments.
HPE Resolves Dozens of Critical Vulnerabilities in Networking Devices
Hewlett Packard Enterprise issued fixes for multiple critical networking security flaws, including eight maximum-severity bugs allowing unauthenticated remote code execution and authentication bypass.
Microsoft Authenticator Flaw Allowed Android Token Hijacking
Vulnerability CVE-2026-80097 permitted permissionless malicious Android applications to impersonate trusted Microsoft apps and exfiltrate work account authentication tokens before being patched in version 6.2606.4246.
ZDI Details Active Exploitation Chain in Oracle PeopleSoft
Researchers revealed technical specifics for CVE-2026-35273, an SSRF-to-RCE chain in Oracle PeopleSoft that has seen widespread mass exploitation by the ShinyHunters threat group.