Zero WireNeeds attentionReference

An unauthenticated remote attacker can reach the vulnerable Linux kernel code before application authentication. Researchers demonstrated root command execution against MPTCP listeners, and distribution-specific patch availability requires active review. Exploitation in the wild is not established in the reviewed sources.

Check the running host kernel against your distribution's CVE advisory, apply its fixed kernel, and complete the required reboot or vendor-supported activation procedure. Verify that the fix is active, including on container hosts and Kubernetes nodes.

CISA has listed CVE-2026-109618 and CVE-2026-109619 as known exploited. The related CVE-2026-115560 requires a separate session-configuration assessment; exploitation of that follow-up is not established in the reviewed sources. These PHP runtime issues require attention beyond application-code or plugin updates.

Patch the PHP runtime using the original security advisory and separately review PHP's session upload progress advisory for CVE-2026-115560. Keep compensating controls in place while patching, and ask managed hosting providers to confirm each issue's status.

Compromised intermediate certificates can affect how clients and services validate remote identities. The follow-up research documents forged certificates and continued acceptance of affected chains in sampled clients. Customer-managed clients, origins, mutual TLS deployments, and container images may still require action.

Identify systems that rely on the affected certificate chain, update trust stores and client software according to the official response, and review customer-managed origins, mutual TLS, and container images.

The risk extends beyond Node.js deployments, and affected runtime and server-side fetch paths require active assessment. Active exploitation is not established in the reviewed sources, but scope and remediation guidance are still developing.

Identify every Brotli decoder in running runtimes, dependencies, and container images, then use each vendor's security guidance to update or otherwise remove the vulnerable decoder.

Citrix reports exploitation on unmitigated deployments, and the affected gateway can be compromised before sign-in. Every customer-managed NetScaler ADC or Gateway appliance, including default configurations, needs prompt review.

Use Citrix's bulletin to identify and update affected appliances. Treat suspected compromise separately from patching, and review exposed gateway services and incident-response guidance.

Vendor remediation and applicability guidance are stable, and active exploitation was not established in the cited sources. The record remains relevant to organizations that have not verified their WordPress update state.

Confirm WordPress update status against the vendor release and patch guidance. Keep any compensating controls in place while remediation is completed.