// day
Oct 14, 2026
5 new incidents, 2 with updates.
## started
- highlivepatchedsince Oct 14, 2026
Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability
› Ahsay AhsayCBS
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. CISA added CVE-2026-105134, CVE-2026-105133 to the Known Exploited Vulnerabilities catalog on 2026-10-14 based on evidence of active exploitation.
CVE-2026-105134CVE-2026-105133 - highlivepatchedsince Oct 14, 2026
Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
› Cisco Secure Email Gateway
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Added to CISA KEV on 2026-10-14.
CVE-2026-76519 - mediumclosedpatchedclosed Oct 14, 2026
nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)
› nginx
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
CVE-2026-15176CVE-2026-93479CVE-2026-95101CVE-2026-97629+1 more - highlivepatchedsince Oct 14, 2026
Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability
› Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Added to CISA KEV on 2026-10-14.
CVE-2026-0322 - criticallivepartial fixsince Oct 14, 2026
Zeabur breach exposes 3.2M env-var records; company to shut down
› Zeabur (PaaS)
Zeabur disclosed an October 14–15 2026 security incident in which attackers reused leaked internal credentials to access shared clusters and the platform database, exposing ~3.22 million environment-variable records across 321,810 accounts. Zeabur later announced it would wind down by year end. Users were told to rotate all stored secrets.
## updated
- highlivepartial fixsince Sep 9, 2026
PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken
› PingCAP TiDB Cloud (hosted database platform)
PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.
- criticallivepatchedsince Oct 8, 2026
PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)
› Linux kernel networking (host side of KVM/Firecracker and similar)
Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.
CVE-2026-99999
