Pinned Tweet
The reason I built disban.io is we have seen lot of fake signups coming from disposable users consuming credits and exhausting your system. You as a product owner want genuine users even with free tier, where you can reach out to your users. Disposable emails prevent you from that communication with users.
Looks it’s a good time we start saying “in god we trust”
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
As high as CVSS 9.0. Whoops.
phoronix.com/news/LKML-New-T…
BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet.
Upgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC.
kb.isc.org/docs/cve-2026-943…
GitLab: another CVSS 10.0 RCE in the regex compiler, a week after the last one. A crafted regex can run code on your server. Public PoC is out for the first one.
Self-managed? Update to 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9. GitLab.com is already patched.
docs.gitlab.com/releases/pat…
Citrix NetScaler: a SAML zero-day exploited to crash appliances, then a new critical flaw found in the very builds that fixed September's zero-days. If you run SAML and patched in September, patch AGAIN.
And that's not even the full list.
bleepingcomputer.com/news/se…
A Windows zero-day lets malicious files skip SmartScreen and Protected View once opened. It's being exploited now.
The fix is in October's Patch Tuesday, a record 1,400+ CVEs. Install it.
securityweek.com/microsoft-p…
Cisco Secure Email Gateway: one crafted attachment = root. CVSS 9.8, actively exploited, and nobody has to open it. Affects you if File Reputation is on.
Update Content Scanner Tools to 25.3.0.5525+.
securityweek.com/cisco-warns…
An Ivanti Connect Secure zero-day allows unauthenticated RCE on the VPN. The attackers wipe logs, and one bug in the chain is still unpatched.
Patch now. The integrity checker can miss this one.
rapid7.com/blog/post/etr-iva…
A BeyondTrust Remote Support zero-day has been exploited since Aug 29, linked to China-nexus ARMORY CASTLE. Attackers got root and went after stored credentials. It's now in CISA KEV.
Apply BT26-05 and hunt for webshells.
beyondtrust.com/blog/entry/b…
Plex2Shell was weaponized about a day after the PoC dropped. Attackers are deploying XMRig miners and proxy backdoors.
Update to Plex Media Server 1.43.3.10861+.
securityweek.com/plex2shell-…
PingCAP was breached through stolen service-account credentials. The attacker had a month inside, and account, SQL editor and billing data were copied. The attacker claims 10.6 TB. Read their release, fun stuff.
Rotate your TiDB Cloud keys.
pingcap.com/trust-hub/securi…
TWO critical (9.5) unauthenticated RCEs in Next.js, one in SVG image optimisation and one in "use cache". Some have no CVE yet, so npm audit may stay quiet.
Upgrade to 16.4.1 or 15.5.28 and redeploy.
nextjs.org/blog/nextjs-secur…
Node.js security release: a Brotli decoder RCE, TLS hostname check bypasses, and 10 CVEs in total.
Move to 26.12.1 / 24.22.1 / 22.23.4.
nodejs.org/en/blog/vulnerabi…
A certificate authority's intermediate keys were tiny numbers. One of them was literally 4. 🤦
Anyone could have forged certs. Update your browsers, OS and trust stores.
scotthelme.co.uk/eight-bits-…
LiteLLM 1.107.0 on PyPI was BACKDOORED. It steals cloud, SSH, CI/CD and AI tool keys on every Python start. No import needed.
Pin 1.106.2. Treat the machine as compromised. Rotate everything.
stepsecurity.io/blog/litellm…
PHP2Shell: two critical unauthenticated RCEs in PHP itself. WordPress, Drupal, Magento, Laravel all exposed. Exploit attempts already seen.
Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart workers.
thehackernews.com/2026/10/ph…
It’s a rough week to run production or just be in system security.
stacksandstories.substack.co…
#Security #securitynews
