Node.js shipped security updates on October 21 fixing 10 flaws across all three supported release lines (22.x, 24.x, 26.x), the most severe being a Brotli decompression bug that permits remote code execution.
Two CVSS 9.0 remote code execution flaws in the Linux kernel's built-in KSMBD SMB server (ZDI-CAN-33774 and ZDI-CAN-33549) were disclosed publicly on mailing lists before any mainline kernel fix exists, with one exploitable pre-authentication.
Microsoft patched a vulnerability in Age of Empires II that could have allowed remote code execution via a malicious game invite.
A critical remote code execution vulnerability in React Server Components (CVE-2025-55182) can be exploited with a single HTTP request; affects multiple frameworks and is widely used, prompting urgent patching of React and dependencies.
Subscribe for real-time topic updates and unlimited access to our intelligence platform.