A newly disclosed OpenSSH flaw, CVE-2026-123158 or 'sshhole', lets attackers log into locked accounts on Alpine Linux and other musl-based systems by typing any password longer than 256 characters. Public exploits are already circulating, and fixes shipped within a day of the report.
A critical PHP flaw (CVE-2026-109618, CVSS 9.2) lets unauthenticated attackers turn out-of-memory errors into remote code execution and heap memory leaks. Apache mod_php and FrankenPHP are most exposed. Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now.
A critical PHP use-after-free (CVE-2026-109619, CVSS 9.2) lets unauthenticated attackers turn one failed request into code execution on the next. Researchers demonstrated it against default WordPress, Drupal and Joomla installs. Patches are out now.
A critical RCE in Ray AI compute engine lets malicious ads or sites execute code on developers' machines via Firefox and Safari. CISA KEV, active exploitation; fixed in 2.52.0.
CVE-2026-21962, a CVSS 10.0 flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, went from a quiet January patch line item to a confirmed, actively exploited threat when CISA added it to the Known Exploited Vulnerabilities catalog on August 24, 2026. Patch now.
A critical deserialization flaw in Microsoft SharePoint (CVSS 9.8) is being actively exploited in the wild, and its patch quietly shipped in June before public disclosure on July 14. Organizations that skipped a monthly update may already be compromised.
A critical CVSS 9.8 vulnerability in Splunk Enterprise's PostgreSQL sidecar allows unauthenticated attackers to achieve remote code execution. CISA has added it to the KEV catalog amid confirmed in-the-wild exploitation.
A maximum-severity, no-authentication-required remote code execution vulnerability in Oracle PeopleSoft PeopleTools 8.61 and 8.62 is being actively exploited, giving attackers full control over ERP systems holding sensitive HR, financial, and operational data.
A critical flaw in Arista EOS allows unauthenticated attackers to inject traffic into internal network segments by abusing tunnel decapsulation endpoints — and Arista says no software patch is coming. The vulnerability is actively being exploited and has been added to CISA's Known Exploited Vulne...
A publicly exploitable Linux kernel vulnerability dubbed 'Copy Fail' allows any unprivileged local user to silently overwrite root-owned binaries and seize full system control. Kernels from version 4.14 through 6.18.21 are affected, and a working Python exploit is already public.
A trivially exploited authentication bypass in ConnectWise ScreenConnect — requiring nothing more than appending a slash to a URL — hands attackers SYSTEM-level control over entire managed IT networks, and ransomware crews are already cashing in.
Patterns of CNA behavior for April 2026 worth noting
