What you need to know today.

A critical vulnerability in the Linux kernel, CVE-2025-39682, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. This flaw, related to the handling of zero-length TLS records on the receive list, could allow for denial-of-service conditions. While the CVSS score is 9.8, its inclusion in the KEV catalog signifies active exploitation, making it a priority for patching. Organizations are urged to apply updates as soon as possible to mitigate potential risks. CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild and CISA Adds One Known Exploited Vulnerability to Catalog.

A supply-chain attack targeting Rank Math SEO PRO for WordPress has been disclosed, affecting versions downloaded or updated between October 15-16, 2026. CVE-2026-111862 is a critical vulnerability within a subset of these packages, which Rank Math states was designed to be self-restoring. This incident highlights the ongoing risks associated with software supply chains, particularly for widely used platforms like WordPress. Users are advised to review their installations and follow vendor guidance for remediation. WordPress: Critical Rank Math Supply-Chain Attack and 24 Other Plugin Flaws Disclosed and Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor.

Multiple critical vulnerabilities have been disclosed across various WordPress plugins and themes, with CVE-2026-110887 and CVE-2026-111406 being notable examples. CVE-2026-110887, an improper control of code generation in HivePress, allows for remote code inclusion, while CVE-2026-111406 in MapSVG permits the upload of web shells. These vulnerabilities underscore the importance of maintaining up-to-date WordPress installations and actively monitoring for security advisories related to plugins and themes. WordPress Plugins: 25 Vulnerabilities Disclosed, Including Critical Deserialization and SQLi Flaws.

Critical vulnerabilities affecting Adobe Commerce (CVE-2026-103849) and Adobe ColdFusion (CVE-2026-105899) have been reported. The Adobe Commerce flaw involves improper neutralization of template engine elements, leading to arbitrary code execution, while the ColdFusion vulnerability is an unrestricted file upload with dangerous types, also resulting in code execution. These vulnerabilities pose a significant risk to organizations using these Adobe products, necessitating prompt patching and security reviews. Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More.

Several critical vulnerabilities have been identified in open-source and self-hosted tools, including Coolify (CVE-2025-66209) and DB-GPT (CVE-2026-77933, CVE-2026-77932). Coolify's authenticated command injection in database backup functionality and DB-GPT's hardcoded credentials and unauthenticated remote code execution vulnerabilities highlight the risks associated with misconfigurations and insecure defaults in popular developer tools. Users of these products should review their configurations and apply updates where available.

A batch of critical vulnerabilities has been disclosed in Apache Kylin (CVE-2026-64959), with potential impacts on services exposed to the public network. This SQL injection and missing authentication flaw emphasizes the need for robust security practices when deploying data analytics platforms. Apache Kylin & Airflow: Batch of 16 Vulnerabilities Disclosed, Including Injection Flaws.