On 21 October 2026 the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They can allow an attacker to run code on a server without logging in, through any PHP that serves websites: PHP-FPM, Apache mod_php, p...

In early August 2026, five security advisories were published affecting the Proxmox platform and the Linux kernel: Zapscape (CVE-2026-64561, PSA-2026-00036-1), a use-after-free in the shadow MMU emulation code of KVM on x86_64. Under the right nested virtualization condition...

Two further serious Linux kernel vulnerabilities were publicly disclosed in early July 2026: GhostLock (CVE-2026-43499), a use-after-free in the kernel futex priority-inheritance code that lets any unprivileged local user gain root and escape containers, disclosed with a workin...

On 9 July 2026, two high-severity Linux kernel vulnerabilities were publicly disclosed: Januscape (CVE-2026-53359), a KVM guest-to-host escape affecting both Intel and AMD systems, and Bad Epoll (CVE-2026-46242), a local privilege escalation with a public proof-of-concept explo...