IT security 2026-10-25

Level Critical — 84/100 — 2026-10-25

Critical day: 29 stories ranked, 2 of the top 10 reported as actively exploited, 1 flaw newly added to CISA’s exploited-vulnerabilities catalogue. Top story: GitLab patches unauthenticated code execution through regular expression compilation (85/100).

  1. GitLab patches unauthenticated code execution through regular expression compilation — 85/100 (CVE-2026-110264)
  2. PHP releases fixes for two unauthenticated remote code execution vulnerabilities — 79/100 (CVE-2026-109618)
  3. Collabora Online CODE Server OS Command Injection Vulnerability — 76/100 (CVE-2026-110447)
  4. Node.js RCE via Brotli Decoder Flaw — 70/100 (CVE-2026-111497)
  5. LiteLLM master key leak enables malicious package injection — 70/100
  6. eMudhra Certificate Authority Emergency Distrust — 60/100
  7. GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 — 60/100
  8. Stack-based buffer overflow in Tenda AC19 router — 50/100 (CVE-2026-113744)
  9. Stack-based buffer overflow in TOTOLINK EX200 router — 50/100 (CVE-2026-114382)
  10. Stack-based buffer overflow in TOTOLINK EX200 router — 50/100 (CVE-2026-114383)