Good morning. PHP publishes fixes for two critical flaws at 10 AM Eastern today, so the morning is for finding every server that runs it. Oracle’s quarterly update landed on Tuesday with no-login bugs in E-Business Suite and WebLogic, Chrome 156 needs a restart on every laptop, and Python teams that handle image uploads have a Pillow upgrade to make.
Lead Story
PHP’s security team ships fixes for two critical vulnerabilities at 14:00 UTC today. Build your PHP list →
Also Worth Your Attention
Oracle’s October update carries 1,295 patches, including no-login bugs in E-Business Suite and WebLogic. See what to patch first →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Chrome 156 fixes six critical bugs, but only after the browser restarts. Push the relaunch →
Pillow 13.0.0 fixes two image bugs that can run code on upload servers. Upgrade path →
Also on the radar: Apache Camel fixed CVE-2026-78162 in camel-hazelcast, an incomplete earlier fix that leaves some Hazelcast instances without a deserialization filter; upgrade to 4.18.5, 4.22.1 or 4.23.0 (Apache advisory). OVHcloud says versions 0.11.0 to 0.15.0 of its CLI on GitHub were swapped for a secret-stealing build on October 19; anyone who ran one should rotate every secret on that machine (BleepingComputer).
Source: PHP security notice; Oracle CPU October 2026; Chrome Releases; Pillow 13.0.0 notes
Go Deeper
- Identity and access management: rotating secrets and reviewing admin access
- Cybersecurity tools for asset inventory and patch tracking
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
