What you need to know today.

CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. These flaws, which can lead to remote code execution, have been observed in the wild and are being actively exploited. The vulnerabilities stem from how PHP handles out-of-memory errors and global state management, potentially leaving request memory in an uninitialized state or allowing global state to persist after being reset. As reported by GovInfoSecurity, exploitation attempts have escalated from probes to working shells, with proof-of-concept exploits widely available. Organizations are urged to patch immediately to mitigate the risk of compromise.

Apple has released security updates addressing multiple vulnerabilities, including an actively exploited out-of-bounds write in CoreGraphics, tracked as CVE-2026-86950. This critical flaw was fixed in iOS 18.7.11, iPadOS 18.7.11, macOS Sequoia 15.8.1, and their respective newer versions. As The Hacker News reported, Apple backported the fix to older versions of iOS and iPadOS, highlighting the severity of the vulnerability. The issue was addressed with improved bounds checking, and users are advised to update their devices to the latest available versions to protect against potential exploitation.

Several critical vulnerabilities have been disclosed across various products, including Ahsay CBS, Nvidia NeMo Agent Toolkit, TOTOLINK routers, Microsoft Azure VM Inspector, and the vm2 Node.js sandbox. Ahsay CBS is affected by CVE-2026-105134 and CVE-2026-105133, which involve improper handling of arguments in specific API endpoints and functions, potentially leading to code execution or unauthorized access. Nvidia's NeMo Agent Toolkit has a missing authentication vulnerability (CVE-2026-65145) that could allow for code execution and privilege escalation. TOTOLINK's A950RG router has a critical flaw in its Device-Information CGI component (CVE-2026-116508), and Microsoft's VM Inspector for Azure VMs has an improper link resolution vulnerability (CVE-2026-110063) enabling privilege escalation. The vm2 Node.js sandbox is impacted by multiple critical vulnerabilities (CVE-2026-44006, CVE-2026-44005, CVE-2026-43997) that could allow attackers to escape the sandbox and gain access to host objects or execute arbitrary code.

Hitachi JP1 and HiRDB products are facing multiple critical vulnerabilities. Hitachi JP1/Base is affected by a heap-based buffer overflow (CVE-2026-86574), and JP1/Automatic Job Management System 3 has a heap-based buffer overflow (CVE-2026-76939) and an authentication bypass vulnerability (CVE-2026-76938). Additionally, Hitachi's HiRDB database system is subject to several critical flaws, including heap-based buffer overflows (CVE-2026-86574, CVE-2026-82120, CVE-2026-82118), OS command injection (CVE-2026-82119), authentication bypass (CVE-2026-82117), and missing authentication for critical functions (CVE-2026-82116). These vulnerabilities, affecting various versions of JP1 and HiRDB, could lead to significant system compromise, including remote code execution and unauthorized access.

GitLab Community Edition and Enterprise Edition are affected by a critical vulnerability (CVE-2026-110264) that could allow for unauthorized access under specific conditions. The vulnerability impacts all versions prior to recent patches in the 18.x and 19.x release lines. While details on the exact attack vector are limited, the potential for unauthorized access in a widely used DevOps platform underscores the importance of timely patching. Check Point Research noted this vulnerability alongside the actively exploited PHP flaws, indicating a busy period for security teams managing diverse software stacks.