SAML provider confusion in @zitadel (10k+ GitHub stars): the callback verifies one provider's signature but identifies the user via another, enabling account takeover. Patched in 4.19.2. Found by a CyStack researcher. cystack.net/disclosures

#PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS 9.2): unauthenticated RCE in the #PHP core. Is your site at risk? Check it free in about a minute. Got the red PHP2Shell alert? Patch to 8.5.12/8.4.27/8.3.36/8.2.35 and restart workers. bit.ly/4dY6jQC #CyberSecurity

#PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS 9.2): RCE flaws in the #PHP core, no login needed. On default mod_php, one request is enough. Exploit attempts since Oct 17. Patch to 8.5.12/8.4.27/8.3.36/8.2.35, then restart workers. bit.ly/4igz6kI #CyberSecurity

CVE-2026-77524 (CVSS 9.9): Privilege escalation to cluster admin in KEDA. KEDA doesn't validate Vault addresses in TriggerAuthentication. A tenant captures the operator's token and reads every Secret cluster-wide. Patched in 2.21.0. Found by CyStack. cystack.net/disclosures

CVE-2026-91098, CVE-2026-91097: Two memory corruption flaws in HP HPLIP, the HP printer and scanner driver suite for Linux. A heap overflow and an out-of-bounds write when parsing attacker-supplied data. No authentication, one user action, and the attacker has a path to code execution on the workstation or print server. Patched in HPLIP 3.26.6. Found by a CyStack researcher. Details at cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #HP #HPLIP #Linux #EnterpriseSecurity #InfoSec

CVE-2026-84567, CVE-2026-86900: Two flaws in @Apple macOS file system drivers. cd9660 mishandles memory when parsing ISO images, so an ordinary app can panic the kernel. exFAT trusts volume metadata, so a crafted USB drive or disk image triggers a kernel panic or leaks kernel memory. All patched in macOS Golden Gate 27. Found by a CyStack researcher. Details at cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #Apple #macOS #EnterpriseSecurity #InfoSec

CVE-2026-94609: Privilege escalation to superuser in @AuthentikSec , the open-source SSO platform with 25.9k GitHub stars. Superuser status is inherited through the group hierarchy, but the permission checks only looked at each group's own setting. A helpdesk account managing one group could promote itself to superuser. Patched in 2026.2.7, 2026.5.7, 2026.8.2. Found by a CyStack researcher. Details at cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #authentik #SSO #IAM #EnterpriseSecurity #InfoSec

CVE-2026-85985: Authorization bypass in the CONNECT engine of @mariadb Server, the open-source database with 8.3k GitHub stars. UDFs like json_file() and jfile_make() read and write files without checking the FILE privilege or secure_file_priv. A low-privileged SQL account reaches any file the MariaDB process can. Patched in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Found by a CyStack researcher. Details at cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #MariaDB #Database #EnterpriseSecurity #InfoSec

CVE-2026-84637: Thunderbird calendar invitations could launch executables on Windows. A file URI attachment in a malicious invite bypasses Thunderbird's executable attachment protections and can show a misleading filename. The victim opens the invite, the attacker runs arbitrary programs. Patched in v153.2. Found by a CyStack researcher. Details at cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #Mozilla #Thunderbird #InfoSec

Use-after-free in the Lua script debugger of Valkey, the Redis fork with 27.1k GitHub stars. Patched in v9.1.2. Found by CyStack researchers. Details at cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #Valkey #UseAfterFree #EnterpriseSecurity #InfoSec