Zero WireNeeds attentionReference

An unauthenticated attacker can run code in rare apps whose RSC payloads mix several typed arrays with attacker input. Public proof-of-concept code exists; React, Vercel and CISA had not reported exploitation as of November 11.

Update Next.js to 16.4.1 or later (15.5.28 on 15.x) or react-server-dom-* to a fixed 19.x release, then check the deployed version. Updating React alone does not fix Next.js.

• Next.js advisory
• Next.js security update
• React advisory

With password logins enabled, an unauthenticated attacker can log in to passwordless accounts if another account has a $5$ or $6$ hash. Neither OpenSSH nor Alpine had reported exploitation as of November 6.

Update OpenSSH to 10.6p2 or your distribution's fixed package, then restart sshd. If you cannot update yet, set PasswordAuthentication no and restart sshd.

• Alpine Linux advisory
• OpenSSH 10.6p2 release notes

CISA lists the original two flaws as known exploited. The separate session upload progress flaw was not in CISA's catalog on November 9.

Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.

• PHP security advisory
• PHP session upload progress advisory

Researchers demonstrated root command execution against MPTCP listeners; other IPv4 TCP services may also be affected. Reports reviewed on November 2 did not confirm real-world attacks.

Install your distribution's fixed kernel and verify it is running after a reboot or vendor-supported activation. Updating containers alone does not patch the host.

• Red Hat kernel advisory
• Linux CVE record

Researchers found that some clients still accepted affected certificate chains, allowing forged certificates to pass validation.

Apply the trust-store and client updates in the official response to systems that still trust the affected intermediates.

• Cloudflare certificate-compromise response

The decoder is used beyond Node.js, including in server-side fetches. The October 25 review did not confirm active exploitation.

Update or remove vulnerable Brotli decoders using each vendor's guidance, including copies bundled with runtimes or container images.

• Node.js security advisory

Citrix reports exploitation of unmitigated appliances. Attackers can compromise affected gateways before sign-in, including deployments using the default configuration.

Update affected appliances using Citrix's bulletin. Investigate suspected compromise using the vendor's incident-response guidance.

• Citrix security bulletin
• Citrix suspected-compromise guidance

Affected sites can be compromised before sign-in. The July 20 review did not confirm active exploitation.

Check each site's WordPress version and apply the vendor's update or backport guidance. Keep compensating controls in place during remediation.

• WordPress security release