NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-10-27 Daily Security Intelligence

CSSA 2 · CVE 2 · Poison 3

10.0 Critical · php-src stream-wrapper logic flaw leads to remote code executio…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 10.0 Critical

php-src stream-wrapper logic flaw leads to remote code execution and service disruption

An attacker can abuse a race or logic error between stream_wrapper_unregister and opendir so that a stream-wrapper object is still accessed after it has been destroyed, triggering a heap use-after-free. Remote unauthenticated users can craft malicious HTTP requests that cause memory corruption, which may crash the service process (denial of service) or, under certain conditions, achieve arbitrary code execution.

Component
php-src is the core source repository of the PHP interpreter. Its architecture aims to give web applications a high-performance scripting runtime: the Zend Engine parses and runs PHP, and a powerful stream layer abstracts filesystem, network, and other I/O behind a unified access model.
Type
Use After Free (CWE-416)
Repo
github.com/php/php-src · Stars 41686
Remediation
  • Fixing this class of bug requires strict object lifetime management—clear all references before a pointer becomes dangling—and double-checked locking on critical paths to prevent resource races under concurrency.
CSSA Exclusive Early Warning 10.0 Critical

php-src ODBC connection-string parsing flaw enables injection that can leak data and harm integrity

The flaw is in php_odbc_connstr_is_quoted when checking quote integrity of a connection string: it only tests whether a brace-prefixed string contains an unescaped closing brace, and does not require a valid closing brace to exist. An attacker can supply a username or password that starts with `{` and has no closing `}`, tricking the function into treating the string as safely quoted, bypassing later escaping and concatenating the raw malicious payload into the ODBC connection string. If the driver manager does not enforce strict checks, connection parameters can be rewritten, leading to sensitive information disclosure or service disruption.

Component
php-src is the PHP core source repository. Its ODBC extension gives PHP applications a standardized way to talk to database management systems by wrapping underlying ODBC driver interfaces for connection management, query execution, and result handling. It is critical infrastructure for the data-persistence layer of enterprise web apps and keeps application-to-storage interaction efficient and stable.
Type
Injection (CWE-74)
Repo
github.com/php/php-src · Stars 41686
Remediation
  • Fix the logic so a closing brace is tracked and confirmed, and only well-formed strings are treated as quoted. Also filter and whitelist inputs at the application layer rather than relying on a single boundary check, to eliminate injection risk at the root.

CVE Intelligence 2

CVE-2026-116232 CVSS 9.9 Critical 2026-10-26

Oray Pugongying X5 Pro SNMP Handler CRLF injection leads to remote code execution

In Oray Pugongying (Pgy) X5 Pro 7.6.1, the snmp_set function in the SNMP Handler lacks strict input validation on info.community and has a CRLF injection flaw (CWE-74). An attacker can inject carriage-return/line-feed characters via that parameter to break protocol structure or inject malicious commands. The vulnerability is remotely exploitable, exploit code is public, and it is easy to automate. The vendor was contacted early in disclosure but did not respond; no official patch is available.

Component
Oray Pugongying X5 Pro is an enterprise smart router/gateway that provides network management, SNMP monitoring, and remote access, widely used in SMB network environments.
Risks
  • Remote unauthenticated access: An attacker can trigger the flaw over the network without authentication; exploitation difficulty is low
  • Protocol-layer injection: CRLF injection may bypass security policy, forge SNMP responses, or inject malicious configuration, leading to information disclosure or device control
  • Public exploit threat: PoC is public and may be used by criminal groups for large-scale scanning and automated attacks that paralyze devices or steal data
Source
NVD · CVE-2026-116232
Remediation
  • At the network-edge firewall, restrict external access to SNMP ports (UDP 161/162) and allow only trusted management IPs
  • Monitor SNMP traffic for anomalous request patterns, especially community strings with special characters or unusual length
CVE-2026-116214 CVSS 9.8 Critical 2026-10-27

Generic software buffer overflow leads to remote code execution

In affected software versions, the input-handling module has insufficient bounds checking and a buffer-overflow flaw (CWE-120). Crafted malicious input can overwrite memory and lead to arbitrary code execution, seriously threatening integrity and availability. An attacker can run unauthorized instructions on the target, causing service disruption or full system takeover. All users of unpatched specific versions are affected. Only specially crafted input is required, so the bar for exploitation is low and impact is high.

Component
The software is an application with a version-specific defect that lacks adequate security validation when processing external input.
Risks
  • From ordinary user to administrator: If the victim runs the software with high privileges, the attacker gains the same privileges
  • Complete system control: The attacker can run arbitrary code and, depending on user rights, install software, view/change/delete data, or create fully privileged accounts
  • Remote code execution: By triggering the overflow with crafted input, the attacker can run a malicious payload on the target machine
Source
NVD · CVE-2026-116214
Remediation
  • Enforce strict length and format validation on input data
  • Enable system-level protections such as ASLR and DEP

Package Poisoning 3

Package Poisoning npm 2026-10-27

birch-css-utils@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
bf7135d10f9e1b66a2a38e725a2e852d
Package Poisoning npm 2026-10-27

harlow-css-mixer@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
5ecc267d5ecbb5423aa9d2da0a6c1866
Package Poisoning npm

postcss-semantic-themes@>= 0 flagged as malicious

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5
70f730f
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →