← All stories

Vulnerabilities

Urgent PHP release to fix two critical 9.2-rated flaws; exploited Palo Alto GlobalProtect VPN bug flagged

By Help Net Security1 min read

PHP's security team has scheduled an urgent security release for 21 October 2026 to patch two vulnerabilities each rated 9.2 (Critical) under CVSS v4.0, according to Help Net Security. The outlet's weekly roundup also highlights an exploited Palo Alto Networks GlobalProtect VPN flaw, though the supplied excerpt contains no technical details on that issue.

Cover for a vulnerabilities story

Help Net Security's weekly roundup highlights an urgent PHP security release alongside an actively exploited vulnerability affecting Palo Alto Networks' GlobalProtect VPN.

According to the announcement cited by the outlet, the PHP security team has scheduled a critical security release for Wednesday, 21 October 2026, at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The PHP project said it would publish full details of the flaws, along with the patched version numbers, when the release goes out. Administrators running PHP deployments are therefore advised to prepare to apply the updates as soon as the new versions become available, given the critical severity ratings involved.

The same weekly overview also covers an exploited flaw in Palo Alto Networks' GlobalProtect VPN. However, the excerpt supplied from the roundup does not include technical information about that vulnerability, such as a CVE identifier, the affected product versions, the nature of the observed exploitation, or any mitigation guidance. Because the source item is a summary of the week's stories, no indicators of compromise or patching instructions for the GlobalProtect issue were included in the material provided.

The roundup also points readers to other news, interviews and videos from the week, but no further specifics were given in the excerpt.

All details in this report come from Help Net Security's "Week in review" article.

Source: Help Net Security

Cover for a vulnerabilities story

Vulnerabilities

Brotli Compression Bug (CVE-2026-111497) Reaches Far Beyond Node.js

A remotely exploitable out-of-bounds write flaw in Google's widely used Brotli compression library, publicly disclosed by Node.js on October 21, 2026, affects software well beyond the Node.js ecosystem, Help Net Security reported. Attackers who can get an application to decompress crafted Brotli data via node:zlib can corrupt process memory, potentially causing crashes or memory disclosure.

1 min read

AI-written summary Source: Help Net Security · Fetched

Cover for a vulnerabilities story

Vulnerabilities

Hackers Flood Inboxes With Spam, Then Pose as IT Support on Microsoft Teams

Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.

1 min read

AI-written summary Source: Help Net Security · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.