The PHP security team has announced an emergency security release scheduled for October 21, 2026, at 14:00 UTC (10:00 AM Eastern), addressing two critical vulnerabilities, each rated CVSS 4.0 9.2.
Technical details, affected PHP versions, and patched releases have not yet been disclosed. The PHP team warned that patches could be released ahead of schedule if vulnerability details become public or evidence of active exploitation emerges.
Active exploitation is targeting SonicWall SMA1000 appliances through CVE-2026-83548 and CVE-2026-83549, a pre-authentication SSRF flaw and a post-authentication OS command-injection flaw that can be chained to reach unauthenticated remote code execution. Affected models are SMA 6210, SMA 7210 and SMA 8200v on 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier; fixed builds are 12.4.3-03526 and 12.5.0-02952 or later.
Gambit Security says an Aurora ransomware operator used Cursor Agent inside 10 victim networks and paired it with tooling to find and encrypt VMware ESXi environments.
According to Gambit Security, the operator used Cursor Agent, running Claude Sonnet, during hands-on activity across 10 organizations between April 8 and May 21, 2026. Gambit said the sessions started with credentials or an existing route into the network, then used the agent for internal scanning, VPN or proxy setup, privilege enumeration, NTLM relay attempts and certificate attacks. Gambit also reported that many agent commands failed on the first try and were sometimes retried with refined prompts or scripts.
Microsoft Azure says patch validation and deployment timelines no longer match current exploitation speed and is urging enterprises to add adaptive, network-based compensating controls during remediation.
In a Microsoft Azure Blog post, Microsoft argues the usual sequence of disclosure, exposure assessment, testing and patch rollout is increasingly out of step with attacker timelines. Microsoft says organizations may need days or weeks to validate and deploy fixes, while exploitation can emerge within hours. Help Net Security separately reported Rapid7’s assessment that the gap between patch release and weaponization has approached zero.
Oracle released its August 2026 Critical Security Patch Update on August 18 with 943 new patches across its enterprise software portfolio, including 262 for Fusion Middleware, 120 for E-Business Suite, and 66 for Commerce. Covered products include WebLogic Server, PeopleSoft Enterprise PeopleTools, Oracle Internet Directory, Oracle Identity Manager, WebCenter, BI Publisher, Payments, Helidon, Hyperion, and Siebel Applications.
Microsoft’s August 11 Patch Tuesday addressed hundreds of vulnerabilities across Windows, Office, Azure, Exchange Server, SharePoint, .NET, Teams, and other products. Qualys ThreatPROTECT and CyberHub Podcast counted 421 fixes, while other supplied coverage reported lower totals, with the difference attributed to counting method or update scope.
SecurityWeek reported that Cisco released fixes for roughly two dozen vulnerabilities across its products, including critical issues in Catalyst SD-WAN, IOS XE and Secure Firewall Management Center.
For Catalyst SD-WAN, SecurityWeek and Secure ISS said Cisco identified CVE-2026-20303, CVE-2026-20304 and CVE-2026-20310 as critical vulnerabilities, and listed fixed releases 20.9.10, 20.12.8.1, 20.15.6, 20.18.4 and 26.1.2 by branch. The reporting also listed IOS XE fixes for CVE-2026-20272 and CVE-2026-20267, with fixed releases including 17.9.10, 17.12.8, 17.15.6, 17.18.4 or 17.18.4a, and 26.1.2.
N-able’s N-central RMM platform is under active exploitation through an authentication-bypass flaw, with Huntress reporting multiple affected organizations and observed follow-on activity including reconnaissance, process-list requests, and abuse of the Take Control remote-access feature on downstream hosts. N-central is a remote monitoring and management platform used to administer and remotely access systems across customer environments.
CBS News, NBC News, and CNN Newsource via KEYT reported that the FBI and EPA said water and wastewater utilities in at least seven U.S. states experienced malicious cyber incidents, with some activity degrading operations. The reporting says the activity targeted internet-facing programmable logic controllers, or PLCs, which utilities use to monitor and control equipment such as pumps, valves, pressure and chemical processes.
Security Affairs, Mallory.ai, and Field Effect reported that Broadcom released patches on July 29 for five VMware vulnerabilities affecting ESXi, vCenter, Workstation, and Fusion, including three rated critical.
They said the most severe issue, CVE-2026-59309, is a critical vCenter authentication bypass rated CVSS 9.8, and that Broadcom also fixed CVE-2026-59310, a critical directory traversal flaw in the Syslog Server component that can lead to remote code execution over the network. vCenter is VMware’s centralized management platform for ESXi hosts and virtual machines.