CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… (GitHub Security Advisories)

2026-10-27T15:38:39Z

[GitHub Security Advisories · GITHUB GHSA-2phh-27fw-q4gc + CVE-2026-108360 VERIFIED] ## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetches it with `file_get_contents()` using a stream co — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… (GitHub Security Advisories)

2026-10-27T19:01:39Z

[GitHub Security Advisories · GITHUB GHSA-r925-mgvr-h9cc + CVE-2026-108082 VERIFIED] ### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… (GitHub Security Advisories)

2026-10-27T19:01:50Z

[GitHub Security Advisories · GITHUB GHSA-2v3c-qxhr-7vpv + CVE-2026-109413 VERIFIED] ### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `m — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… (GitHub Security Advisories)

2026-10-27T21:07:12Z

[GitHub Security Advisories · GITHUB GHSA-mf2p-h6hf-fcwm + CVE-2026-116675 VERIFIED] ### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with th — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day… (The Hacker News)

Wed, 28 Oct 2026 23:38:33 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train u — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Google to Allow One-Tap Android App Installs From Approved… (The Hacker News)

Wed, 28 Oct 2026 22:38:09 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge… (The Hacker News)

Wed, 28 Oct 2026 21:53:34 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five mon — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

PHP2Shell Attack Roots 25 Servers, Breaches U.S.… (The Hacker News)

Wed, 28 Oct 2026 21:32:45 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days… (The Hacker News)

Wed, 28 Oct 2026 18:18:03 +0530

[The Hacker News · CVE TRACKED (CVE-2026-101767)] Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authe — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Mitsubishi Electric GENESIS, ICONICS Suite & MobileHMI Advisory (CISA Advisories)

Tue, 27 Oct 26 12:00:00 +0000

[CISA Advisories · GOV/VENDOR + CVE-2023-4863 VERIFIED] View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in info — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

EPICS Base (CISA Advisories)

Tue, 27 Oct 26 12:00:00 +0000

[CISA Advisories · GOV / OFFICIAL VENDOR VERIFIED] View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are a — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA Advisories)

Tue, 27 Oct 26 12:00:00 +0000

[CISA Advisories · GOV/VENDOR + CVE-2026-111497 VERIFIED] CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Goog — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CISA Adds One Known Exploited Vulnerability to Catalog (CISA Advisories)

Fri, 23 Oct 26 12:00:00 +0000

[CISA Advisories · GOV/VENDOR + CVE-2026-110447 VERIFIED] CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability This type of vulnerabil — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

From industry concern to practical action: the value of working… (UK NCSC Advisories)

Tue, 27 Oct 2026 12:00:00 +0000

[UK NCSC Advisories · GOV / OFFICIAL VENDOR VERIFIED] How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

FaultyPacket Live UK Cyber Threat & CVE Advisory Radar

CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… (GitHub Security Advisories)

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… (GitHub Security Advisories)

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… (GitHub Security Advisories)

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… (GitHub Security Advisories)

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day… (The Hacker News)

Google to Allow One-Tap Android App Installs From Approved… (The Hacker News)

Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge… (The Hacker News)

PHP2Shell Attack Roots 25 Servers, Breaches U.S.… (The Hacker News)

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days… (The Hacker News)

Mitsubishi Electric GENESIS, ICONICS Suite & MobileHMI Advisory (CISA Advisories)

EPICS Base (CISA Advisories)

CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA Advisories)

CISA Adds One Known Exploited Vulnerability to Catalog (CISA Advisories)

From industry concern to practical action: the value of working… (UK NCSC Advisories)