Memory corruptionNeeds attention

An unauthenticated remote attacker can reach the vulnerable Linux kernel code before application authentication. Researchers demonstrated root command execution against MPTCP listeners, and distribution-specific patch availability requires active review. Exploitation in the wild is not established in the reviewed sources.

Check the running host kernel against your distribution's CVE advisory, apply its fixed kernel, and complete the required reboot or vendor-supported activation procedure. Verify that the fix is active, including on container hosts and Kubernetes nodes.

CISA has listed CVE-2026-109618 and CVE-2026-109619 as known exploited. The related CVE-2026-115560 requires a separate session-configuration assessment; exploitation of that follow-up is not established in the reviewed sources. These PHP runtime issues require attention beyond application-code or plugin updates.

Patch the PHP runtime using the original security advisory and separately review PHP's session upload progress advisory for CVE-2026-115560. Keep compensating controls in place while patching, and ask managed hosting providers to confirm each issue's status.

The risk extends beyond Node.js deployments, and affected runtime and server-side fetch paths require active assessment. Active exploitation is not established in the reviewed sources, but scope and remediation guidance are still developing.

Identify every Brotli decoder in running runtimes, dependencies, and container images, then use each vendor's security guidance to update or otherwise remove the vulnerable decoder.