Aggregator

业务要升级，底座先打牢。

2026 年 10 月 21 日，#PHP 8.5.12 等版本紧急修复两个 CVSS 9.2 的未认证 RCE。本文从当晚半个互联网的停服现场说起，拆解 CVE-2026-109618 / 109619 的三条利用路径、可复用攻击原语，以及 9bie 在官方默认配置上跑通的纯 HTTP 武器化链，兼谈修复与检测。

A vulnerability marked as problematic has been reported in ash-project ash_postgres up to 2.15.1. The affected element is the function do_bulk_create/upsert of the component DataLayer. The manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-115635. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in Ash-Project Ash up to 3.34.6. Impacted is the function lateral_join? of the file lib/ash/actions/read/relationships.ex of the component Relationships. Executing a manipulation can lead to improper authorization. This vulnerability is registered as CVE-2026-114214. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in ash-project ash_postgres up to 2.15.1. This issue affects the function lateral_join_query/through_step_queries of the component Lateral Join. Performing a manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-115627. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-116284. The attack may be performed from remote. There is no available exploit. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Kameleo up to 5.0.1.26. It has been rated as problematic. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2026-116283. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in Kameleo up to 5.3.1. It has been declared as problematic. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. This vulnerability is identified as CVE-2026-116282. The attack can be executed remotely. There is not any exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Kameleo up to 5.0.1.26. It has been classified as problematic. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-116281. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Kameleo up to 5.0.1.26 and classified as problematic. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-116280. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component. The route has been removed and replaced with /general/test-proxy in 5.2.0.

A vulnerability has been found in AllenAI AllenNLP up to 2.10.1 and classified as critical. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability was named CVE-2026-116275. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as problematic, was found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-116274. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as problematic, has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. This vulnerability is handled as CVE-2026-116263. The attack can be initiated remotely. Additionally, an exploit exists. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

A vulnerability classified as problematic was found in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2026-116262. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic has been found in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. This vulnerability is traded as CVE-2026-116261. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as critical has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. This vulnerability appears as CVE-2026-116260. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as problematic has been reported in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. This vulnerability is reported as CVE-2026-116259. The attack requires a local approach. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as critical has been found in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. This vulnerability is documented as CVE-2026-116258. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.