Home

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

A Vulnerability in Brotli Library Could Allow for Remote Code Execution

A vulnerability has been discovered in the Brotli library that could allow for remote code execution. Brotli is a compression algorithm developed by Google and commonly used to compress web content before it is sent over HTTP. Successful exploitation could allow an unauthenticated remote attacker to trigger memory corruption, disclose sensitive information, crash affected processes, or potentially achieve remote code execution (RCE). Web servers and applications that decompress Brotli data from untrusted sources, such as those running Node.js, may be affected.

Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution.

• iOS is a mobile operating system for mobile devices, including the iPhone and iPod touch.
• iPadOS is the operating system for iPad devices.
• macOS is the operating system for Mac computers.
• tvOS is the operating system for Apple TV devices.
• watchOS is the operating system for Apple Watch devices.
• visionOS is the operating system for Apple Vision Pro.
• Safari is a web browser available for macOS, iOS, and iPadOS.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected application or, in some cases, with root, system, or kernel privileges. Depending on the privileges associated with the application or service, an attacker could then install programs; view, change, or delete data; or take further control of the affected device.

Multiple Vulnerabilities in PHP Could Allow for Remote Code Execution

Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow for remote code execution. PHP is a widely-used, open-source server-side scripting language designed primarily for web development. All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are considered at risk. Successful exploitation of the most severe of these vulnerabilities could allow for unauthenticated remote code execution in the context of the affected service account. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Services whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.

A Vulnerability in BeyondTrust Remote Support Could Allow for Arbitrary Upload of Files

A vulnerability has been discovered in BeyondTrust Remote Support that could allow for arbitrary upload of files. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. Successful exploitation of this vulnerability could allow a remote attacker to perform file operations on an affected appliance.

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

A Vulnerability in Ivanti Connect Secure Could Allow for Arbitrary Code Execution

A vulnerability has been discovered in Ivanti Connect Secure (ICS) that could allow for arbitrary code execution. Ivanti Connect Secure is an enterprise-grade SSL VPN and zero-trust remote access gateway. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands.

Critical Patches Issued for Microsoft Products, October 13, 2026

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.

• Adobe Bridge is a digital asset management application used to organize, browse, preview, and manage creative files and assets across Adobe applications.
• Adobe Commerce is a flexible, enterprise-level e-commerce platform built on top of Magento technology that helps businesses create and manage online stores.
• Adobe ColdFusion is a commercial rapid web application development platform used to build, deploy, and scale dynamic enterprise web and mobile applications.
• Adobe Content Credentials SDK is a software development kit that enables developers to integrate Content Credentials capabilities, including digital content provenance and authenticity information, into applications and workflows.
• Adobe Dimension is a 3D design and rendering application used to create photorealistic product mockups, composite 3D objects with 2D designs, and produce realistic visualizations.
• Adobe FrameMaker is a document authoring and publishing application used to create, manage, and publish structured technical documentation and long-form content.
• Adobe Photoshop is a professional raster graphics editor used to create, edit, and manipulate digital images.
• Adobe Substance 3D Designer is a node-based 3D material authoring application used to create procedural textures, materials, patterns, and other 3D assets.
• Adobe Substance 3D Sampler is a 3D material creation application used to transform photographs and real-world scans into digital materials, textures, and environmental assets.
• Adobe Substance 3D Stager is a 3D scene composition and rendering application used to arrange models, materials, lighting, and cameras to create realistic product visualizations and scenes.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

A Vulnerability in Atlassian Data Center Products Could Allow for Arbitrary File Access

A vulnerability in Atlassian Data Center products could allow for arbitrary file access. Atlassian Data Center products are self-managed, enterprise-grade editions of Atlassian tools such as Jira, Confluence, Bitbucket, and Jira Service Management, which organizations host on their own infrastructure or private cloud and which offer clustering, high availability, and greater control over data, security, and scaling. Successful exploitation of this vulnerability could allow for arbitrary file access.