Data & infrastructure
-
Drupal fixes critical Field UI flaw with unauthenticated exploit path
Drupal has released security updates for a critical core Field UI vulnerability, explaining that contributed modules and custom code can make a remote execution path reachable without login.
-
Next.js patches conditional code-execution flaws and Server Actions denial of service
Next.js fixes two critical remote-code-execution issues affecting particular caching and SVG processing paths, alongside a separate denial-of-service flaw in App Router Server Actions.
-
NCSC updates TLS guidance for post-quantum key establishment
The UK’s NCSC now recommends hybrid and pure post-quantum options for TLS 1.3, urging early deployment for high-priority data in transit while warning older TLS versions cannot be upgraded.
-
Nextcloud built-in CODE proxy flaw exposes installations when local service is down
Collabora reports a critical unauthenticated command-injection flaw in the optional Nextcloud richdocumentscode app when its local CODE service is not running. Version 26.4.303 contains the fix.
-
Cisco Secure Email Gateway flaw is exploited as CERT-EU urges emergency fixes
Cisco confirms exploitation of a critical Secure Email Gateway vulnerability that can allow remote, unauthenticated file writes and root-level execution in affected appliances.
-
Microsoft documents Remote Desktop failures for non-admin users after update
Microsoft has added a known issue to Windows 11 update notes warning that some Remote Desktop connections fail for non-administrative users with error 0xC000000D.
-
Ghostscript PDF flaw exposes servers that process uploaded documents
Security researchers have detailed a Ghostscript buffer overflow that could turn some PDF-processing workflows into a route to remote code execution, including through server-side previews.
-
Google releases Chrome desktop update addressing 37 security flaws
Google has released a Chrome desktop stable-channel update with 37 security fixes, including critical memory-safety vulnerabilities, for Windows, macOS and Linux.
-
Adobe October fixes cover Commerce and enterprise application security
Adobe has issued October security updates across products including Commerce and enterprise applications, with a Commerce hotfix and credential rotation recommended for a reported flaw.
-
Fortinet discloses critical path traversal flaw in FortiSIEM
Fortinet has published a critical FortiSIEM vulnerability that could allow unauthenticated attackers to execute unauthorised commands against affected security-monitoring deployments.