// day
Oct 20, 2026
4 new incidents, 4 with updates.
## started
- highlivepatchedsince Oct 20, 2026
EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
› EG Secure Solutions SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.
CVE-2026-106931 - unknownlivepartial fixsince Oct 20, 2026
HTTP/3 QPACK “Header Accordions” memory-amplification DoS
› HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
CVE-2025-64702CVE-2026-12523CVE-2025-13945 - highlivepartial fixsince Oct 20, 2026
GMO Onamae Desktop Cloud malware on customer VPS
› Onamae Desktop Cloud (GMO Internet)
GMO Internet’s Japanese VPS service Onamae Desktop Cloud said an attacker installed malicious programs in customer environments, forcing shutdown of as many as ~26,739 servers with no immediate restart date (mid-October 2026 reporting).
- highlivepatchedsince Oct 20, 2026
Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability
› Siemens Software Center
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20.
CVE-2026-110936
## updated
- criticallivepartial fixsince Oct 18, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
CVE-2026-111943CVE-2026-91403 - criticallivepartial fixsince Oct 17, 2026
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
CVE-2026-109618CVE-2026-109619 - highlivepartial fixsince Sep 9, 2026
PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken
› PingCAP TiDB Cloud (hosted database platform)
PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.
- criticallivepatchedsince Oct 16, 2026
Plex2Shell: chained Plex Media Server RCE exploited for miners
› Plex Media Server
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656
