What Got Pwned: supply-chain watch

YOOtheme Pro 5 image handler flaw allows unauthenticated remote code execution (CVE-2026-102785, CVSS 10.0)

Thu, 22 Oct 2026 18:29:37 GMT

Source: NVD: CVE-2026-102785 (YOOtheme Pro unauthenticated RCE via image handler)

Ecosystem: WordPress, Joomla · Kind: library / plugin flaw

In plain English: YOOtheme Pro, a popular theme and page builder used to design Joomla and WordPress websites, had a serious flaw in how it resizes images. An attacker with no login could abuse it to plant their own code on the website and take it over. YOOtheme fixed it in version 5.0.53 on 21 October. The official record's score marks it as attacked, but no details of real-world attacks have been published, so active exploitation is not confirmed.

What this means:

If your site runs YOOtheme Pro 5.0.0 to 5.0.52, update to 5.0.53, which YOOtheme's changelog lists as the fix for CVE-2026-102785.
The NVD record says the attack needs no login and only a public image URL from your site, so any site on an affected version is exposed until it is updated.
Updating stops new attacks but does not remove files already planted; site owners may want to check public media folders for unexpected PHP or image files.
YOOtheme hasn't said whether the flaw has been used in real attacks.

Affected: YOOtheme Pro 5.0.0 to 5.0.52 (website builder theme for Joomla and WordPress; fixed in 5.0.53)
CVE: CVE-2026-102785 · CVSS 4.0 10.0 (CNA (Joomla Project, security@joomla.org) via NVD; NVD analysis pending)

TeamUpdraft breach exposes UpdraftCentral keys used to push backdoor plugins to WordPress sites

Thu, 22 Oct 2026 16:24:36 GMT

Source: TeamUpdraft: Security incident, what customers need to know (updated 21 October 2026)

Ecosystem: WordPress · Kind: vendor compromise

In plain English: TeamUpdraft, the company behind the popular UpdraftPlus backup plugin for WordPress websites, confirmed that attackers broke into its website and likely took its customer database, including the keys its UpdraftCentral service uses to remotely manage customers' sites. The company says attackers then used those keys to add hidden admin accounts and malicious plugins to some connected WordPress sites. How many sites were hit is not known.

What this means:

TeamUpdraft says to make sure every site runs UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later, which disconnects old UpdraftCentral keys, and to delete the UpdraftCentral connection key from each site's own dashboard.
TeamUpdraft urges UpdraftPlus Premium users to check sites for unknown administrator accounts and unexpected plugins, including the Must-Use tab, even if they never used UpdraftCentral; updating the plugin does not remove a backdoor that was already installed.
Everyone with a teamupdraft.com account should change that password, and anywhere it was reused, and reset two-factor login; TeamUpdraft says it stores no card details and will never ask for passwords or keys by email.
TeamUpdraft says the number of sites accessed through UpdraftCentral is unknown and its investigation is ongoing.

Affected: TeamUpdraft (teamupdraft.com customers; WordPress sites connected to UpdraftCentral cloud via UpdraftPlus)
CVE: none · CVSS: n/a

Signal RingRTC flaw CVE-2026-113380 (CVSS 9.3) could keep a call running after hang-up

Thu, 22 Oct 2026 16:23:36 GMT

Source: NVD - CVE-2026-113380

Ecosystem: source library · Kind: library / plugin flaw

In plain English: Signal, the private messaging app, had a flaw in the part that handles voice and video calls. A caller could flood the call with data so that pressing hang-up did not actually end it, possibly keeping your microphone or camera connected. It is fixed in newer versions of Signal's calling library; active exploitation is not confirmed.

What this means:

Update Signal on every device to the latest version from your app store or signal.org; the NVD record says RingRTC 2.72.0 and later fix the issue.
According to the NVD record, the attacker has to be the other party on a call with you, so the risk is from calls with people you don't trust.
The NVD record does not say the flaw has been exploited in the wild, and Signal has not published its own advisory about it.

Affected: Signal RingRTC calling library before 2.72.0 (used by Signal Android, iOS and Desktop)
CVE: CVE-2026-113380 · CVSS 4.0 9.3 (MITRE (CNA); NVD has not published its own score)

Laravel TokenGuard authentication bypass CVE-2026-114509 (CVSS 9.2) fixed in 12.68.0 and 13.29.0

Thu, 22 Oct 2026 16:22:36 GMT

Source: Laravel security advisory GHSA-f9x3-7vq9-cph6: Token-based API guard Auth Bypass

Ecosystem: Composer · Kind: library / plugin flaw

In plain English: Laravel, a popular toolkit for building PHP websites and web apps, has a serious login flaw. In apps that use its built-in token login for APIs (the way other programs connect to a web app) with a MySQL or MariaDB database, an attacker could log in as another user without their key. Fixes are out; active exploitation is not confirmed.

What this means:

If your app uses laravel/framework with the built-in token API guard, update to 13.29.0 or 12.68.0 or later, the fixed versions listed in Laravel's advisory.
According to the advisory, the risk applies to the standard token-based API guard under certain MySQL or MariaDB configurations; apps that don't use that guard are not described as affected.
Laravel's advisory lists fixes only for the 12.x and 13.x lines, so apps on older versions need to move to a fixed release.
Italy's national CSIRT says a proof-of-concept exploit is public, which usually makes attacks easier; neither Laravel nor the NVD record says it has been exploited in the wild.

Affected: Laravel framework (laravel/framework) before 12.68.0 and 13.x before 13.29.0, apps using the built-in token API guard with MySQL/MariaDB
CVE: CVE-2026-114509 · CVSS 4.0 9.2 (GitHub (CNA); NVD has not published its own score)

Node.js security releases fix 10 flaws, including Brotli decoder RCE CVE-2026-111497

Thu, 22 Oct 2026 10:31:18 GMT

Source: Node.js: Wednesday, October 21, 2026 Security Releases

Ecosystem: Node.js · Kind: runtime flaw

In plain English: Node.js, the software that runs JavaScript on millions of web servers and developer tools, has released security updates fixing 10 problems. The worst lets an attacker who sends specially compressed data run their own code on the server, and two others can let a fake website certificate be accepted. Updates are out; active exploitation is not confirmed.

What this means:

If you run Node.js 22.x, 24.x or 26.x, update to v22.23.4, v24.22.1 or v26.12.1, which the Node.js project says fix these issues.
The Node.js project says end-of-life versions are always affected when a security release happens and get no fix, so anything older than 22.x should be moved to a supported line.
Node.js is often bundled inside other software, containers and desktop tools, so check those too, not only the node binary installed on your servers.
The Node.js advisory rates the highest issue as high and does not say any of these flaws have been exploited in the wild.

Affected: Node.js 26.x, 24.x and 22.x before v26.12.1, v24.22.1 and v22.23.4 (and all end-of-life versions)
CVE: CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 · CVSS: n/a

OVHcloud CLI releases v0.11.0-v0.15.0 replaced with secret-stealing binaries

Thu, 22 Oct 2026 10:28:18 GMT

Source: GitHub Security Advisory GHSA-862f-55f5-vmvw: ovhcloud-cli security incident - October 19th, 2026

Ecosystem: GitHub Releases · Kind: malicious release

In plain English: OVHcloud, a French cloud provider, says an attacker used a staff developer's hijacked GitHub account to swap the downloads of its command-line tool (a program admins use to manage their cloud services) for malware that hunts for passwords and keys. The bad files were up for about an hour and a half on 19 October and were downloaded about 250 times. OVHcloud has confirmed it and removed them.

What this means:

Only people who installed or updated the OVHcloud CLI on 19 October 2026 between 14:47 and 16:21 (UTC+2) are affected, according to OVHcloud; earlier downloads of the same versions are not.
OVHcloud says to check whether you are affected by comparing your binary's hash with the list in its advisory, without running the binary, and to look for a temp folder named envchecker-xxxx.
If you were affected, treat every secret on that machine as exposed: change them, remove the tool and install v0.16.0, which OVHcloud says is clean.
Changing leaked keys stops future misuse but does not undo anything already done with them, so also review account activity.

Affected: OVHcloud CLI (ovhcloud-cli) release binaries v0.11.0-v0.15.0 downloaded 19 Oct 2026 14:47-16:21 UTC+2 (macOS, Linux, Windows)
CVE: none · CVSS: n/a

Oracle out-of-band Security Alert for Java SE / GraalVM JSSE flaw CVE-2026-91403 (CVSS 9.1)

Thu, 22 Oct 2026 06:01:00 GMT

Source: Oracle Security Alert Advisory - CVE-2026-91403

Ecosystem: Java · Kind: runtime flaw

In plain English: Oracle has put out an emergency fix for Java, the software platform that runs many business and web applications. The flaw is in the part of Java that handles secure (encrypted) connections, and Oracle says attackers could use it over a network without needing a password. Oracle's alert does not say it is being exploited; active exploitation is not confirmed.

What this means:

If you run Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 or 27.0.1, Oracle GraalVM for JDK 17.0.21 or 21.0.13, or GraalVM Enterprise Edition 21.3.20, apply the patch listed in Oracle's Security Alert.
Oracle says server software that passes data to the affected APIs, for example through a web service, can be attacked, as can sandboxed Java clients that run untrusted code.
Oracle says unsupported older releases are not tested but are likely also affected, and recommends upgrading to supported versions.
Oracle has not said whether the flaw has been exploited or who reported it.

Affected: Oracle Java SE (8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1), Oracle GraalVM for JDK (17.0.21, 21.0.13), GraalVM Enterprise Edition 21.3.20
CVE: CVE-2026-91403 · CVSS 3.1 9.1 (Oracle (CNA))

Pillow image library flaw CVE-2026-96639 (CVSS 9.8) fixed in 13.0.0

Thu, 22 Oct 2026 05:59:00 GMT

Source: NVD - CVE-2026-96639

Ecosystem: PyPI · Kind: library / plugin flaw

In plain English: Pillow, a widely used Python library that programs use to open and edit pictures, has a serious flaw. A specially crafted image file in certain formats can crash a program that opens it and, in some setups, let an attacker run commands. A fix is out in version 13.0.0; active exploitation is not confirmed.

What this means:

If you use Pillow 11.0.0 or later but older than 13.0.0, upgrade to 13.0.0, which the NVD record says fixes the issue.
According to the NVD record, the risk comes from crafted PSD, MPO, DCX or MIC image files, so services that open images uploaded by users are the most exposed.
Pillow is often installed as a dependency of other Python software, so check your installed packages and container images, not only code that imports it directly.
The NVD record does not say the flaw has been exploited in the wild.

Affected: Python Pillow 11.0.0 to before 13.0.0
CVE: CVE-2026-96639 · CVSS 3.1 9.8 (GitHub (CNA); NVD has not published its own score)

Rank Math SEO PRO 3.0.123 downloads shipped malware (CVE-2026-111862)

Wed, 21 Oct 2026 21:56:00 GMT

Source: Rank Math: PRO 3.0.123 security incident

Ecosystem: WordPress · Kind: malicious release

In plain English: Rank Math is a popular plugin that helps WordPress websites rank in search engines. For about 11 hours on 15-16 October, some downloads of its paid PRO version 3.0.123 contained malware that can take over a website once the plugin is turned on. The company confirms this; the free version from WordPress.org is not affected.

What this means:

If you installed and activated Rank Math PRO 3.0.123 in that window, Rank Math says to treat your site as compromised and, ideally, restore it from a backup made before 15 October, 20:02 UTC.
Change every password and secret the site could reach, including WordPress, database, hosting, API and payment keys, even if you restored from a backup.
Then install the clean version 3.0.124 from your Rank Math account; if you only downloaded 3.0.123 and never installed it, Rank Math says there is no sign from this incident alone that your site was hacked.
Rank Math says it never sends login or download links by email, so treat such emails as suspicious.

Affected: Rank Math SEO PRO 3.0.123 (WordPress plugin)
CVE: CVE-2026-111862 · CVSS 3.1 9.8 (Wordfence (CNA))

LiteLLM 1.107.0 on PyPI and Docker was malicious (release pipeline compromise)

Wed, 21 Oct 2026 21:48:00 GMT

Source: LiteLLM: Oct 21, 2026 release v1.107.0 compromised (incident report)

Ecosystem: PyPI, Docker · Kind: malicious release

In plain English: LiteLLM is a popular open-source tool that developers use to connect their apps to AI models. On 21 October attackers hijacked its release process and published a fake version, 1.107.0, containing malware that steals passwords and access keys from any machine that installs it. LiteLLM has confirmed the incident and removed the bad version.

What this means:

If you installed litellm 1.107.0 from PyPI (11:39 to 13:23 UTC, 21 October) or ran the v1.107.0, latest, main-latest or main-stable Docker images in that period (until 14:20 UTC), LiteLLM says to treat that environment as compromised.
Rotate every secret the affected host could reach, including cloud roles, AI provider keys stored in the LiteLLM database, LiteLLM master and virtual keys, and database passwords.
Reinstall pinned to litellm 1.106.2, ideally by rebuilding from scratch; LiteLLM warns that starting Python on an infected machine, even to run pip, re-triggers the malware.
LiteLLM says earlier versions and its private enterprise registry were not affected.

Affected: BerriAI LiteLLM (PyPI litellm==1.107.0; Docker/GHCR v1.107.0, latest, main-latest, main-stable)
CVE: none · CVSS: n/a

PHP2Shell: critical unauthenticated PHP RCE flaws now exploited in the wild (CVE-2026-109618, CVE-2026-109619)

Wed, 21 Oct 2026 21:47:00 GMT

Source: php.net security advisory: critical RCE vulnerabilities, update now

Ecosystem: PHP · Kind: runtime flaw

In plain English: PHP, the programming language behind a large share of websites, released updates on 21 October that fix two serious flaws that can let someone with no login take control of a web server. Amazon's security team says attackers are now broadly trying these flaws against real internet-facing systems, with a first attempt seen on 17 October, four days before the fix came out. Active exploitation is confirmed by Amazon's own monitoring.

What this means:

If you run PHP on a server, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution's patched package) and restart PHP services; PHP and Amazon both say updating is the only complete fix.
Amazon advises starting any investigation from at least 17 October, not the disclosure date: review web server logs, look for POST requests containing PHP_SESSION_UPLOAD_PROGRESS, and check for unexpected processes or changed files, because an update does not undo a break-in that already happened.
PHP 8.1 and older get no official fix. CISA and the NSA say that if you can't update right away, or still run 8.1 or older, you should take PHP-based systems offline until they are patched; CISA adds that a web application firewall may give some protection in the meantime.
Amazon says it is not yet clear whether the attempts it saw succeeded on real systems, and no one has published how many servers were actually compromised.

Affected: PHP (all supported branches; mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed)
CVE: CVE-2026-109618, CVE-2026-109619 · CVSS 4.0 9.2 (PHP (CNA); NVD scores both 9.8 under CVSS 3.1)