Announcements

Security Advisory

Security Advisory 2026-019

Critical Vulnerabilities in PHP History: 20/10/2026 --- v1.0 -- Initial publication 21/10/2026 --- v1.1 -- Updates with additional information 23/10/2026 --- v1.2 -- Updates with information about a third vulnerability Summary On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP [1]. Public reports indicated that these vulnerabilities could lead to remote code execution (RCE) [2,3]. The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [4]. Both vulnerabilities can allow unauthenticated remote code execution. Technical details are now being discussed publicly, and initial proofs of concept (PoCs) have begun to circulate. This raises the likelihood that attackers are already exploiting the vulnerabilities. [New] On 23 October, PHP disclosed a new RCE vulnerability. However, it affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. PHP will not issue an out-of-band release for this vulnerability [8]. Instead, organisations are advised to apply mitigation to fully protect from this RCE vector [4]. Sengokusaku advises organisations to patch affected assets immediately. Where that is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is applied and verified. Technical Details The vulnerability CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), with a CVSS score of 9.2, allows remote code execution through memory corruption during out-of-memory (OOM) handling [4,6]. PHP enforces its user-configurable memory_limit by using longjmp() to abort any request that exceeds the limit, which raises an OOM error. This can interrupt PHP while internal request data is only partially initialised, for example, while parsing a form-based file upload. Request cleanup may then treat the invalid data as valid and try to free memory that was never initialised. That memory may still contain data from earlier allocations controlled by the attacker. The vulnerability CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), with a CVSS score of 9.2, allows remote code execution through stale global state [4,7]. Internal state owned by a request can survive after its backing memory has been freed, for example after a fatal error. A later request handled by the same worker may use that stale state before normal initialisation resets it. Every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the highest-risk setup. A demonstrated exploit shows that one unauthenticated request can trigger the attack before any application code runs [4]. [New] There is no detail available about the vulnerability CVE-2026-115560 which could lead to remote code execution. The PHP team will publish a full advisory with the next release. Affected Products PHP 8.5 versions prior to 8.5.12 PHP 8.4 versions prior to 8.4.27 PHP 8.3 versions prior to 8.3.36 PHP 8.2 versions prior to 8.2.35 End-of-life branches (PHP 8.1 and older), which no longer receive updates from the PHP project [4] Many commercial and open-source products use PHP as a backend technology - these could also be affected, even if they do not directly expose a PHP installation. CERT-EU recommends consulting the NCSC-NL GitHub repository to identify third-party software that embeds PHP and may be impacted by these vulnerabilities [5]. Recommendations Sengokusaku strongly recommends updating all affected PHP installations as soon as possible to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [4]. Distribution packages: Linux distributions and LTS vendors received the patches in advance. Check with your vendor for updated packages. End-of-life versions (PHP 8.1 and older): Some distributions and LTS vendors provide backported fixes, so contact your vendor or upgrade to a supported version. Because of the severity, the PHP security team has also published minimal source backports for PHP 7.4, 8.0 and 8.1 for organisations that build from source or have no LTS vendor. rpms.remirepo.net users: This volunteer-maintained repository will not have updates on release day. The PHP team urges users to switch to distribution packages or build from source. Where immediate patching is not feasible, organisations should consider isolating internet-facing resources from public networks until the fix is applied and verified. Temporary Mitigation Only an update fully fixes these vulnerabilities. The measures below reduce exposure to specific attack paths but do not make an installation safe [4]. CVE-2026-109618 (OOM corruption): Set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration. Check that no pool, directory or application setting puts a finite limit back. This removes the controllable memory limit failure, but an underlying allocation failure can still reach the vulnerable code path. Set a low post_max_size: 8M for applications that do not need file uploads, 32M if uploads are required. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count and nesting depth. These limits must also cover requests without a usable Content-Length. Use a container or cgroup memory limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not use RLIMIT_AS or RLIMIT_DATA instead, because they can trigger the vulnerable allocation failure. CVE-2026-109619 (stale global state): Set session.upload_progress.enabled=0 and restart every worker. Apply this in php.ini, an FPM pool or a server configuration that takes effect before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants. On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only. Remove invalid or deprecated per-request settings that emit diagnostics before initialisation. Hiding diagnostics with error_reporting, display_errors or @ does not help. Fix fatal errors and execution timeouts that attackers can reach, including failures in callbacks, upload or import processing, and cleanup. [New] CVE-2026-115560: Set session.upload_progress.enabled=0 and restart every worker until the next regular bugfix release, to fully protect from CVE-2026-115560. References [1] https://www.php.net/archive/2026.php#2026-10-20-1 [2] https://cyberplace.social/@GossiTheDog/117474220875882526 [3] https://x.com/watchtowrcyber/status/2112611507749982605 [4] https://www.php.net/index.php#2026-10-20-1 [5] https://github.com/NCSC-NL/php2shell [6] https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w [7] https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp [8] https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

Security Advisory

Security Advisory 2026-018

Critical Vulnerability in GitLab Community and Enterprise Editions History: 22/10/2026 --- v1.0 -- Initial publication Summary On 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server [1]. Sengokusaku recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets. Technical Details The vulnerability CVE-2026-110264, with a CVSS score of 10, is a critical integer overflow vulnerability within the regular expression compiler which could allow an unauthenticated user to execute arbitrary code on the affected GitLab server. GitLab also fixed 2 high severity, 5 medium severity and 4 low severity vulnerabilities [1]. Affected Products The vulnerability CVE-2026-110264 affects the following versions of GitLab Community and Enterprise Editions [1]: from 7.0 before 18.11.13 19.0 before 19.0.10 19.1 before 19.1.9 19.2 before 19.2.9 19.3 before 19.3.6 19.4 before 19.4.3 19.5 before 19.5.1 Recommendations Sengokusaku recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets. Compromise assessment GitLab has published two detection rules to identify exploitation attempts [1, 2, 3]. References [1] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ [2] https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md?ref_type=heads [3] https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md?ref_type=heads

Security Advisory

Security Advisory 2026-017

Critical Vulnerability in Cisco Secure Email Gateway History: 15/10/2026 --- v1.0 -- Initial publication Summary On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system [1]. The Cisco PSIRT is aware of active exploitation of this vulnerability [1]. Sengokusaku strongly recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS Software to a fixed release as soon as possible, prioritising appliances reachable from the internet. CERT-EU also recommends checking all affected appliances for indicators of compromise. Technical Details The vulnerability CVE-2026-76519, with a CVSS score of 9.8, is a relative path traversal flaw in the AMP feature of Cisco Secure Email Gateway that allows an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. The vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit it by sending an email that contains a crafted attachment through an affected device, and a successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges [1]. Cisco notes that Secure Email Gateway appliances can be part of clusters, and that private SSH keys used for authentication between cluster members could be accessed on a compromised appliance, which may allow the attacker to compromise other cluster members. Upon successful exploitation, attackers may also remove or hide evidence of exploitation and indicators of compromise [1]. Affected Products The vulnerability affects Cisco Secure Email Gateway (both physical and virtual) running the following versions of Cisco AsyncOS Software [1]: versions 15.5 before 15.5.5-014 versions 16.0 versions 16.5 before 16.5.0-780 The following conditions should also be met [1]: The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525. The information above reflects Cisco’s fixed release information. The fix is also distributed to all licensed and supported Cisco AsyncOS Software releases through an updated Content Scanner Tools package, and Content Scanner Tools versions 25.3.0.5525 and later contain the fix [1]. To determine whether the File Reputation service is enabled, administrators can choose Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection in the web-based management interface, select a mail policy, and inspect the Enable File Reputation check box. To determine the running Content Scanner Tools version, Cisco provides the following CLI command [1]: contentscannerstatus Cisco has confirmed that this vulnerability does not affect Secure Email and Web Manager or Secure Web Appliance. For Cisco Secure Email Cloud Gateway customers, Cisco states that no action is required, as a fixed version of Content Scanner Tools is already deployed [1]. Additional information is available in the vendor’s advisory [1]. Recommendations Sengokusaku strongly recommends updating the Content Scanner Tools package or upgrading Cisco AsyncOS Software to a fixed release as soon as possible, prioritising appliances reachable from the internet. CERT-EU also recommends checking all affected appliances for indicators of compromise. Compromise assessment Cisco recommends reviewing the system logs for each affected device, with the following command, to identify exploitation attempts [1]: grep "System Security" system_logs One of the log messages in the following table may be in the output [1]: Log message Recommended action System Security: Suspected compromise indicator was found. Contact TAC for further recommendations. A compromise is detected. Trigger the incident response plan. System Security: Security scan did not complete. Contact TAC for further recommendations. A compromise is suspected. Trigger the incident response plan, and contact the Cisco Technical Assistance Center (TAC) for further support. System Security: No compromise indicator was found. No compromise detected. Vendor’s note: Upon successful exploitation of this vulnerability, attackers may obtain command execution with root privileges. With this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise. Cisco strongly recommends cross-checking the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses. In their advisory, Cisco does not mention any actual Indicator of Compromise. It is also not known how the log messages described above are generated. References [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

Security Advisory

Security Advisory 2026-016

Critical Vulnerability in GitLab CE and EE History: 12/10/2026 --- v1.0 -- Initial publication Summary On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server [1]. Sengokusaku strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances. Technical Details The vulnerability CVE-2026-97229, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an integer overflow, and a specially crafted expression in a CI/CD configuration can then trigger code execution [1]. The same release also fixes other vulnerabilities [1]: CVE-2026-92883 (CVSS: 8.7): a cross-site scripting flaw in syntax highlighting that lets an authenticated user run arbitrary JavaScript in other users' browsers through a crafted repository [1]. CVE-2026-16301 (CVSS: 8.5): an authorisation flaw that lets a developer run pipelines on protected branches without permission [1]. 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1]. Affected Products The vulnerabilities affect the following versions of self-managed GitLab CE/EE instances [1]: before 19.4.2 before 19.3.4 before 19.2.8 Recommendations Sengokusaku strongly recommends upgrading all self-managed GitLab CE/EE instances to a fixed version, starting with internet-facing instances [1]. References [1] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

Security Advisory

Security Advisory 2026-015

Critical Vulnerability in Multiple Atlassian Products History: 06/10/2026 --- v1.0 -- Initial publication Summary On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye [1]. Sengokusaku strongly recommends upgrading all affected installations to a fixed version as soon as possible, starting with instances accessible from the internet. CERT-EU also recommends checking access logs for signs of exploitation. Technical Details The vulnerability CVE-2026-21589, with a CVSS score of 9.3, is an arbitrary file access vulnerability that allows an unauthenticated attacker to access specific files within the web application root directory [1]. To exploit the vulnerability, an attacker needs to know the target file's exact name and path in advance. The vulnerability does not allow attackers to enumerate or list directory contents. Atlassian notes that some configurations may contain sensitive files that increase the risk [1]. Affected Products All versions earlier than the fixed versions listed below are affected [1]: Product Fixed Versions Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1 Confluence Data Center 9.2.26, 10.2.19 Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12 Jira Software Data Center 9.12.40, 10.3.26, 11.3.12 Bamboo Data Center 10.2.24, 12.1.12 Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4 Crucible 4.9.15 Fisheye 4.9.15 Atlassian states that affected Atlassian Cloud products have been patched and that its investigation has not found evidence of exploitation [1]. Additional information is available in the vendor's advisory [1]. Recommendations Sengokusaku strongly recommends upgrading all affected installations to a fixed version or the latest version as soon as possible, starting with internet-facing instances. Atlassian recommends patching to the fixed LTS version or later [1]. CERT-EU also recommends checking access logs for signs of exploitation. Mitigation If patching is not immediately possible, remove the instance from the internet until it can be patched or mitigated (this includes instances accessible from the public internet that require user authentication) [1], or: Option 1 (all affected products): apply a rule on the Web Application Firewall or proxy layer that blocks any URL matching the regular expression below. Then test that the rule blocks .. immediately adjacent to /, \, or ::, including URL-encoded forms [1]. (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* Option 2 (Confluence, Jira Service Management, Jira, Bamboo and Crowd): on each node, enable Tomcat's RewriteValve in the application element and install a rewrite.config file in the WEB-INF directory to block such requests [1]. Option 3 (Bitbucket only): add a blocking rule at the top of ./app/WEB-INF/urlrewrite.xml on all nodes, mirrors and mirror farm nodes, then restart Bitbucket Data Center [1]. Back up the instance before applying Option 2 or Option 3. The exact configuration snippets are in the vendor's advisory [1]. Compromise assessment Sengokusaku recommends checking all affected instances for evidence of compromise. To investigate access logs, Atlassian suggests one of these approaches [1]: URL-decode each access-log request line, then check for .. immediately adjacent to /, \, or :: [1]. Search raw (non-decoded) log lines directly with the regular expression shown above [1]. If a compromise is suspected, CERT-EU recommends investigating the affected instances, reviewing and rotating any credentials or secrets that may have been exposed, and contacting the relevant cybersecurity authority. References [1] https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

Security Advisory

Security Advisory 2026-014

Critical Vulnerabilities in Citrix NetScaler ADC and Gateway History: 27/09/2026 --- v1.0 -- Initial publication Summary On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild [1]. Sengokusaku recommends updating affected software and running a compromise assessment on those exposed on the internet. Technical Details The vulnerability CVE-2026-88771, with a CVSS score of 9.5, is an unauthenticated RCE flow due to improper input validation. As there is no precondition for the exploitation, it affects all Citrix NetScaler ADC and Citrix NetScaler Gateway deployments. It is exploited in the wild [1]. The vulnerability CVE-2026-88772, with a CVSS score of 9.5, a memory overflow vulnerability leading to RCE or Denial of Service (DoS). It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where DTLS is enabled (default on VPN vServer). It is exploited in the wild [1]. The vulnerability CVE-2026-88773, with a CVSS score of 9.3, is an HTTP Request Smuggling vulnerability. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where an HTTP URL-based policy expression configured [1]. The vulnerability CVE-2026-88774, with a CVSS score of 7.0, is a feature policy bypass via HTTP URL-based expression flow. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where an HTTP URL-based policy expression configured [1]. The vulnerabilities CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777, each with a CVSS score of 8.8, are memory overflow vulnerabilities leading to unpredictable or erroneous behaviour or DoS conditions. They affect Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where respectively, a gateway or AAA vServer is configured, an LB vServer of type Oracle is configured, or an LB/CS or CGNAT-LSN/NAT64 with non-HTTP L7 protocol is enabled [1]. The vulnerability CVE-2026-88778, with a CVSS score of 8.8, is a TCP Initial Sequence Number (ISN) prediction vulnerability. It affects Citrix NetScaler ADC and Citrix NetScaler Gateway deployments where a TCP configuration is enabled with Enhanced ISN Generation disabled [1]. Affected Products The following products and versions are affected [1]: Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23 and 14.1 before 14.1-73.37. Citrix NetScaler ADC FIPS version 14.1 before 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP version 13.1 before 13.1-37.279 This bulletin applies to customer-managed deployments only. Secure Private Access Hybrid deployments using NetScaler instances are also affected and must be upgraded. For precondition verification steps, refer to the Citrix bulletin [1]. Recommendations Sengokusaku recommend to update all affected customer-managed appliances to the fixed version immediately. It is also recommended to enable Enhanced ISN Generation for deployments where a TCP configuration is enabled [2]. Sengokusaku strongly advise to run a compromise assessment on any internet-facing appliance running an affected build. References [1] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 [2] https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation

Security Advisory

Security Advisory 2026-013

Critical Vulnerability in F5 BIG-IP APM History: 22/09/2026 --- v1.0 -- Initial publication Summary On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild [1]. Sengokusaku recommends taking appropriate actions as soon as possible. Technical Details The vulnerability CVE-2026-94127, with a CVSS score of 9.8, is a heap-based buffer overflow vulnerability and allow unauthenticated attacker to achieve remote code execution (RCE) on the affected device [1]. Affected Products The vulnerability affects the following versions of BIG-IP APM if configured with an access policy and an OAuth profile on a virtual server [1]: 17.1.0 - 17.1.3 17.5.0 - 17.5.1 21.1.0 Recommendations Sengokusaku recommends taking the following actions as soon as possible: Preserve forensic evidence. Apply the relevant hotfix. Check for signs of compromise (see the compromise assessment section). If any sign of compromise is detected, start the incident response process. Mitigation If patching cannot be applied immediately, F5 provides an iRule-based mitigation for the affected virtual server. To obtain it, F5 BIG-IP clients should contact the F5 support [1]. Compromise Assessment Sengokusaku strongly advises to look for the following indicators of compromise provided by the vendor in its advisory [1]: At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system. OAuth authentication failures: check /var/log/apm for repeated occurrences of the following, especially 10 or more from a single IP in a short window. err tmm1\[30975\]: 01990004:3: : Request UserInfo from Source ID (null) IP failed. Error Code (invalid\_token) Error Description (The access token is invalid.) Increase of OAuth failure statistics. Run the following and look for an unexplained increase in total_failed: $ tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed Audit log anomalies: if OAuth failures are observed, review /var/log/audit around those timestamps for suspicious commands. TMM core files: Presence of a TMM core file alone is not an indicator, but core files should be investigated. The vendor indicates that they have observed TMM entering a loop, which causes the SOD daemon to send a SIGABRT. References [1] https://my.f5.com/manage/s/article/K000162605?mkt_tok=NjUzLVNNQy03ODMAAAGkaH9ofwJ_SRrYgVTlugDrbGmtsu1nH57-t7CLkyTTdZHlyphUFNtULl3ACEteoRszBciQ_4gjkNsWTnQqQfftwYMNCzWPXxGhUqTJ-emmdyUmrf_dqfI

Security Advisory

Security Advisory 2026-012

Critical Vulnerabilities in Check Point Products History: 10/09/2026 --- v1.0 -- Initial publication Summary On 9 September 2026, Check Point released emergency security updates addressing two critical vulnerabilities affecting Check Point Security Gateway, Security Management Server, and Spark Firewall deployments configured to use Remote Access VPN or Site-to-Site VPN [1,2]. Both vulnerabilities carry a CVSS score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary code on affected appliances [1,2]. Sengokusaku strongly recommends applying the available hotfixes as soon as possible, prioritising internet-facing and perimeter appliances. Technical Details The vulnerability CVE-2026-85102, with a CVSS score of 9.8, is an improper certificate-data validation vulnerability in the VPN negotiation flow of Check Point Security Gateway that allows an unauthenticated, remote attacker to execute arbitrary code on the affected appliance [1]. The issue affects deployments using either Site-to-Site VPN or Remote Access VPN [1]. The vulnerability CVE-2026-85103, with a CVSS score of 9.8, is a heap overflow vulnerability in the VPN certificate ASN.1 decoding flow of Check Point Security Gateway and Security Management Server that allows a remote attacker to execute arbitrary code on the affected appliance [2]. Unlike CVE-2026-85102, this vulnerability affects both the Security Gateway and the Security Management Server [2]. Affected Products The following Check Point products and versions are affected [1,2]: Check Point Security Gateway — R80, R80.10, R80.20, R80.30, R80.40 (End of Support) Check Point Security Gateway — R81, R81.10 (End of Support) Check Point Security Gateway — R81.10.X Check Point Security Gateway — R81.20 Check Point Security Gateway — R82 Check Point Security Gateway — R82.00.X Check Point Security Gateway — R82.10 Check Point Security Management Server — all versions listed above Check Point Spark Firewall (Centrally Managed and Locally Managed) — all versions listed above Exploitation of CVE-2026-85102 requires the deployment to be configured with either Remote Access VPN or Site-to-Site VPN [1]. Exploitation of CVE-2026-85103 additionally affects the Security Management Server in such configurations [2]. Additional information is available in the vendor's advisories [1,2]. Recommendations Sengokusaku strongly recommends that all organisations running affected Check Point products apply the available hotfixes immediately [1]. References [1] https://support.checkpoint.com/results/sk/sk1000117/ [2] https://support.checkpoint.com/results/sk/sk1000118/

Security Advisory

Security Advisory 2026-011

Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server History: 09/09/2026 --- v1.0 -- Initial publication. Summary On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products [1][3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed "OVERPASS" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it [2][3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed "S4GET", is a missing authentication check in the SAP NetWeaver Message Server [3][6]. Both are remotely exploitable without authentication. According to the reporting researchers, successful exploitation of either can result in arbitrary operating system command execution under the account that owns the SAP installation, leading to full compromise of the affected system and the business data it holds [2][6]. Sengokusaku strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as possible [1]. Technical Details CVE-2026-44756 - "OVERPASS" (CVSS 10.0) CVE-2026-44756 is a memory corruption vulnerability in the SAP Kernel library that processes the Extended Passport (EPP), addressed by SAP Security Note 3747649 [1][4]. SAP's CVE record states that boundary validation is missing during the deserialisation of EPP data, and that an unauthenticated attacker can send a crafted network request containing a malformed EPP header, potentially resulting in undefined behaviour and abnormal program termination, with a high impact on confidentiality, integrity, and availability [2][3]. Onapsis, which reported the vulnerability, assesses that successful exploitation allows a remote attacker to execute arbitrary operating system commands on the SAP host with SAP administrative privileges, resulting in full compromise of the underlying SAP business data and processes [2]. CVE-2026-58240 - "S4GET" (CVSS 9.8) CVE-2026-58240 is a missing authentication check in the SAP NetWeaver Message Server (component BC-CST-MS), addressed by SAP Security Note 3759472 [1][5]. The Message Server does not sufficiently validate the authenticity of internal application server components during registration. Consequently, an unauthenticated attacker with network access can register unauthorised components and potentially perform unauthorised actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system [3][5]. Onapsis, which also reported this vulnerability, states that an attacker can promote themselves to a trusted node inside an SAP cluster, that the Message Server propagates that trust to every application server in the cluster, and that a successful attack yields remote code execution as the operating-system user that runs SAP [6]. Onapsis notes the flaw is reachable through the same public port that SAP GUI clients connect to, which cannot be firewalled without breaking end-user logon [6]. Affected Products CVE-2026-44756 -- affected versions [1]: KRNL64NUC 7.22, 7.22EXT KRNL64UC 7.22, 7.22EXT, 7.53, 8.04 KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20 WEBDISP 9.16, 9.18, 9.19, 9.20 CVE-2026-58240 -- affected versions [1]: KERNEL 9.16, 9.18, 9.19, 9.20 Recommendations Sengokusaku strongly recommends following SAP Security Note 3747649 (CVE-2026-44756) and SAP Security Note 3759472 (CVE-2026-58240) to update the affected products to the relevant versions as soon as possible [1]. References [1] https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html [2] https://onapsis.com/blog/sap-overpass-remediation/ [3] https://onapsis.com/blog/sap-security-patch-day-september-2026/ [4] https://www.cve.org/CVERecord?id=CVE-2026-44756 [5] https://www.cve.org/CVERecord?id=CVE-2026-58240 [6] https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/

Security Advisory

Security Advisory 2026-010

Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway History: 19/08/2026 --- v1.0 -- Initial publication Summary On 19 August 2026, Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) [1]. Sengokusaku recommends updating affected devices as soon as possible. Technical Details The vulnerability CVE-2026-19489 (CVSS: 8.8) is a memory overflow vulnerability that can lead to unpredictable behaviour or Denial of Service. The vulnerability CVE-2026-19490 (CVSS: 9.3) is an authentication bypass using an alternate path. Affected Products The following supported versions of NetScaler ADC and NetScaler Gateway are affected: NetScaler ADC and NetScaler Gateway version 14.1 before 14.1-73.32 NetScaler ADC and NetScaler Gateway version 13.1 before 13.1-63.21 NetScaler ADC FIPS before 14.1-73.32 FIPS NetScaler ADC FIPS and NDcPP before 13.1-37.277 The vulnerability CVE-2026-19489 requires SIP ALG(Session Initiation Protocol Application Layer Gateway) to be enabled on a Large Scale NAT (LSN) group configuration. Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the specified string: add lsn group.*sipalg.* The vulnerability CVE-2026-19490 requires the appliance to be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. On versions 14.1-43.56 or later and 13.1-61.28 or later, the issue is applicable only when a SAML action is configured; on earlier builds and 13.1 FIPS, Gateway or AAA virtual server configuration is sufficient. Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the specified string: SAML action configuration: add authentication samlAction.* Auth or VPN vserver: add authentication vserver .* OR add vpn vserver .* Recommendations Sengokusaku recommends to install the relevant updated versions on affected devices as soon as possible [1]. References [1] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939

Security Advisory

Security Advisory 2026-009

Critical Vulnerabilities in Microsoft SharePoint History: 22/07/2026 --- v1.0 -- Initial publication 22/07/2026 --- v1.1 -- Updated to include additional actively exploited vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644) Summary [UPDATED] On 14 July 2026, Microsoft released security updates addressing critical remote code execution (RCE) vulnerabilities in Microsoft SharePoint Server [1]. On 20 July 2026, WatchTowr identified a proof-of-concept exploit code and subsequently observed active exploitation of CVE-2026-50522 [2], a vulnerability part of an ongoing series of actively exploited flaws [3] affecting on-premise SharePoint Server instances, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. Sengokusaku strongly recommends updating affected servers immediately, rotating credentials for any assets that may have been exposed to the internet, and conducting a compromise assessment. Technical Details [UPDATED] The vulnerability CVE-2026-50522 (CVSS: 9.8) is a critical deserialisation vulnerability in Microsoft SharePoint that allows a remote attacker to execute arbitrary code on affected systems. While Microsoft indicates that exploitation requires some level of authentication [1], recent findings suggest this may not be the case [2, 4]. [NEW] Over the past month, Microsoft also fixed the following vulnerabilities affecting Microsoft SharePoint Server: CVE-2026-32201: An improper input validation flaw enabling spoofing attacks by an unauthorised user (CVSS: 6.5) [5]. Fixed in April 2026. CVE-2026-45659: A deserialisation of untrusted data vulnerability allowing authenticated remote code execution (CVSS: 8.8) [6]. Fixed in May 2026. CVE-2026-56164: Missing authentication for a critical function, allowing unauthenticated privilege escalation (CVSS: 9.8) [7]. Fixed in July 2026. CVE-2026-58644: A deserialisation vulnerability enabling unauthenticated remote code execution (CVSS: 9.8) [8]. Fixed in July 2026. Affected Products [UPDATED] The vulnerability CVE-2026-50522 affects the following Microsoft SharePoint products. Refer to the respective Microsoft advisories [5–8] for the full list of affected products for the other vulnerabilities. Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Recommendations Sengokusaku strongly recommends updating affected servers as soon as possible, rotating credentials for any assets that may have been vulnerable and exposed to the internet, and conducting a compromise assessment to identify potentially affected SharePoint instances. Given the number of recent critical vulnerabilities affecting SharePoint, organisations should reconsider exposing any Microsoft SharePoint Server directly to the internet. References [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522 [2] https://www.linkedin.com/posts/watchtowr_exploitation-alert-watchtowr-is-observing-activity-7485278595850940416-LSP8/ [3] https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations [4] https://x.com/DefusedCyber/status/2079128402855116858 [5] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 [6] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 [7] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164 [8] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644

Security Advisory

Security Advisory 2026-008

Critical vulnerabilities in Ivanti Sentry History: 10/06/2026 --- v1.0 -- Initial publication Summary On 9 June 2026, Ivanti released a security advisory addressing two critical vulnerabilities in their Sentry products[1]. An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device. Technical Details The vulnerability CVE-2026-10520, with a CVSS score of 10, is an OS Command Injection vulnerability in Ivanti Sentry which allows a remote unauthenticated user to achieve root-level remote code execution[2]. The vulnerability CVE-2026-10523, with a CVSS score of 9.9, is an Authentication Bypass vulnerability in Ivanti Sentry which allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. Affected Products The following versions of Ivanti Sentry are affected: 10.5.1 and prior. 10.6.1 and prior. 10.7.0 and prior. Recommendations Sengokusaku recommends following the vendor's guidance to update their appliance to one of the fixed versions[1]. References [1] https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523 [2] https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/

Security Advisory

Security Advisory 2026-007

Critical Vulnerability in Windows Netlogon Download History: 10/06/2026 --- v1.0 -- Initial publication Summary On 12 May 2026, Microsoft published a security advisory addressing a critical vulnerability affecting Windows Server when acting as a domain controller [1]. This vulnerability allows an unauthenticated attacker to execute arbitrary code over a network. According to The Centre for Cybersecurity Belgium (CCB), this vulnerability is currently exploited by threat actors [2]. It is strongly recommended updating affected Windows servers as soon as possible. Technical Details The vulnerability CVE-2026-41089, with the CVSS score of 9.8, is a stack-based buffer overflow in Windows Netlogon [1]. An unauthenticated attacker could execute arbitrary code with SYSTEM privileges on targeted domain controllers by sending specially crafted packets [3]. Affected Products The following Windows Server versions are affected: Windows Server 2012 / 2012 R2 Windows Server 2016 (prior to 10.0.14393.9140) Windows Server 2019 (prior to 10.0.17763.8755) Windows Server 2022 (prior to 10.0.20348.5074) Windows Server 2022 23H2 (prior to 10.0.25398.2330) Windows Server 2025 (prior to 10.0.26100.32772) Additional information is available in the vendor’s advisory [1]. Recommendations It is recommended updating affected Windows Server asset as soon as possible. References [1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089 [2] https://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-may-2026-patches-118-vulnerabilities-16-critical-102#:~:text=It%20is%20now%20actively%20exploited%20in%20the%20wild [3] https://www.bleepingcomputer.com/news/microsoft/critical-windows-netlogon-remote-code-execution-flaw-now-exploited-in-attacks/

Security Advisory

Security Advisory 2026-006

Critical Vulnerability in PAN-OS History: 06/05/2026 --- v1.0 -- Initial publication Summary On 6 May 2026, Palo Alto published a security advisory addressing a critical vulnerability affecting PAN-OS [1]. This vulnerability allows an unauthenticated attacker to execute arbitrary code with root privileges. Palo Alto observed limited exploitation of this vulnerability. It is strongly recommended updating affected appliances as soon as patches will be available, and to apply workarounds and mitigation in the meantime. Technical Details The vulnerability CVE-2026-0300, with the CVSS score of 9.3, is a buffer overflow in the User-ID Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. [1] An unauthenticated attacker could execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. [1] Affected Products This issue is applicable only to PA-Series and VM-Series firewalls that are configured to use User-ID Authentication Portal. The following PAN-OS versions are affected: Versions prior to 12.1.4-h5 Versions prior to 12.1.7 Versions prior to 11.2.4-h17 Versions prior to 11.2.7-h13 Versions prior to 11.2.10-h6 Versions prior to 11.2.12 Versions prior to 11.1.4-h33 Versions prior to 11.1.6-h32 Versions prior to 11.1.7-h6 Versions prior to 11.1.10-h25 Versions prior to 11.1.13-h5 Versions prior to 11.1.15 Versions prior to 10.2.7-h34 Versions prior to 10.2.10-h36 Versions prior to 10.2.13-h21 Versions prior to 10.2.16-h7 Versions prior to 10.2.18-h6 Additional information is available in the vendor’s advisory [1]. Recommendations The patches are not available at the time of writing, but are scheduled to be released in the near future. It is recommended updating affected devices as soon as the patches will be released. Mitigation It is possible to mitigate the risk of this flaw by taking either of the following actions [1]: Restrict User-ID Authentication Portal access to only trusted zones. Disable User-ID Authentication Portal if not required. References [1] https://security.paloaltonetworks.com/CVE-2026-0300

Security Advisory

Security Advisory 2026-005

High Vulnerability in the Linux Kernel ("Copy Fail") History: 29/04/2026 --- v1.0 -- Initial publication Summary On 29 April 2026, a high local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named "Copy Fail", was publicly disclosed [1]. The vulnerability affects every mainstream Linux distributions shipping a kernel built since 2017. A public proof-of-concept exploit has been released. As of the date of this advisory, no distribution has shipped a fixed kernel package. The mainline fix was committed on 1 April 2026, but vendor updates are still pending across all major distributions. CERT-EU strongly recommends applying the interim mitigation immediately, prioritising Kubernetes nodes, and CI/CD runners exposed to untrusted workloads. Technical Details The vulnerability CVE-2026-31431, with a CVSS score of 7.8, is a local privilege escalation flaw in the Linux kernel's algif_aead module, the AEAD socket interface of the kernel's userspace crypto API (AF_ALG). The flaw originates from an in-place optimisation introduced in 2017 (commit 72548b093ee3), which allows page-cache pages to be placed into a writable destination scatterlist. By chaining an AF_ALG socket operation with splice(), an unprivileged local user can perform a controlled 4-byte write to an arbitrary page-cache-backed page, targeting a setuid binary such as /usr/bin/su to obtain a root shell [1]. The upstream fix is mainline commit a664bf3d603d, which reverts the 2017 optimisation. It was committed on 1 April 2026 [1]. Affected Products The vulnerability affects every mainstream Linux distribution shipping a kernel built between 2017 and the availability of the patch. The following distributions were directly verified by the researchers [1]: Distribution Kernel Version Ubuntu 24.04 LTS 6.17.0-1007-aws Amazon Linux 2023 6.18.8-9.213.amzn2023 RHEL 10.1 6.12.0-124.45.1.el10_1 SUSE 16 6.12.0-160000.9-default Other distributions running kernels in the affected range are implicitly affected, including Debian, Arch Linux, Fedora, Rocky Linux, AlmaLinux, Oracle Linux, and embedded Linux distributions. Patch availability by distribution (as of 30 April 2026): Distribution Status Ubuntu 20.04–24.04 No fix available Amazon Linux 2023 No fix available SUSE Linux Enterprise No fix available Red Hat Enterprise Linux Status unknown Note: Ubuntu 26.04 (Resolute) and later kernels are not affected [2]. Additional information is available in the researcher's advisory [1] and in vendor security trackers [2,3,4]. Recommendations CERT-EU strongly recommends applying the relevant kernel update as soon as possible once vendor patches become available, prioritising Kubernetes nodes and CI/CD runners. Temporary Mitigation Disable the algif_aead kernel module persistently on all affected systems until a patched kernel is available: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true This workaround does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH. It may affect applications explicitly configured to use the afalg engine or that bind aead/skcipher/hash sockets directly. Exposure can be assessed with lsof | grep AF_ALG. Hardening Containerised Environments and Pipelines Sengokusaku recommends blocking AF_ALG socket creation via seccomp policies on all containerised workloads and pipelines, regardless of patch status [1]. This applies to Docker and Podman-based environments [5] as well as Kubernetes clusters [6]. Since the exploit requires opening an AF_ALG socket as a first step, this measure effectively prevents exploitation even on unpatched kernels. References [1] https://copy.fail [2] https://ubuntu.com/security/CVE-2026-31431 [3] https://www.suse.com/security/cve/CVE-2026-31431 [4] https://access.redhat.com/security/cve/CVE-2026-31431 [5] https://docs.docker.com/engine/security/seccomp/ [6] https://kubernetes.io/docs/tutorials/security/seccomp/