10/14/2026-10/21/2026 Next.js Ships Out-of-Band Patch; PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws; OpenCode Security Breach And More.

1. Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14, fixing two critical unauthenticated remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) flaw. Fixes are in versions 16.4.1 and 15.5.28.

The flaws:

• use cache RCE (CVSS 9.5): Affects version 16 apps with Cache Components enabled, where a use cache function returns multiple typed arrays. It’s far narrower than December 2025’s React2Shell.
• SVG RCE (CVE-2026-96889, CVSS 9.5): A librsvg memory bug reached through sharp. It affects apps passing attacker-supplied SVGs on glibc-based Linux, including next/og on Node.js.
• Server Actions DoS: Crafted requests can max out a server process’s CPU in App Router apps with at least one Server Action.

What to do:
Upgrade to 16.4.1 or 15.5.28, then rebuild and redeploy. Version 16.4.1 requires sharp 0.35.5, but 15.5.28 may keep an older, vulnerable sharp. Check with npm ls sharp and update if needed. Without upgrading, you can mitigate the SVG flaw by updating sharp or blocking SVG rendering. The other two flaws have no workaround.

Scanners may miss the use cache and Server Actions flaws, which had no CVE or npm advisory as of October 15. No attacks have been reported.

2. PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Details of two critical PHP vulnerabilities, dubbed PHP2Shell, have leaked online ahead of coordinated disclosure and official patches. Both carry a CVSS score of 9.2.
PHP has scheduled patches for Wednesday, 21 October 2026 and urged users to prepare for immediate upgrades. It warned that fixes may come sooner if technical details are published or in-the-wild exploitation emerges.

The flaws, reportedly CVE-2026-109618 and CVE-2026-109619, could allow remote code execution. Given their scores, CERT-EU says both are likely exploitable without authentication. Public reporting suggests all versions from PHP 5 onwards are affected, and one report describes the first flaw as a use-after-free bug. The root cause, affected component, and attack path remain undisclosed.

WatchTowr says it reproduced CVE-2026-109618 but is withholding details until patches ship. Both WatchTowr and Huntress report no exploitation in the wild so far.

3. OpenCode Security Breach Exposes Third-Party API Keys of its Console Users

OpenCode disclosed a security breach affecting 1.4% of its Console users (not its entire user base). Third-party API keys saved in affected workspaces, including those for OpenAI and Anthropic, may have been exposed. In an October 17 statement, the company linked the incident to a large-scale distillation attack and said it was working with Anthropic, OpenAI, and Google. Affected users were emailed that morning; those who received no email were not impacted.

According to the notification, attackers gained unauthorized access to a legacy system that OpenCode was already preparing to shut down. The wording describes possible exposure, not confirmed theft or use of every key.

Affected users should revoke and replace keys through each provider’s dashboard, update every application using them, and review recent usage and billing for unexpected activity.

Distillation means training one AI model on another’s outputs. OpenCode has not explained how attackers got in, how long they stayed, how many keys were involved, or whether stolen credentials were used for the distillation requests. It also named no attacker and reported no confirmed loss figure.

The incident was still ongoing at publication, and OpenCode said it could not share more details.

4. Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Rank Math PRO copies downloaded from rankmath.com or delivered as updates contained malware, according to a company notice. The affected version was 3.0.123, but version number alone doesn’t show exposure: only copies obtained during that window are affected. The free WordPress.org plugin isn’t named.
Sites that installed and activated an affected copy should be treated as compromised, even if later updated to clean version 3.0.124. The malware can recreate a hidden backdoor, and may have added backdoor files, administrator accounts, scheduled tasks, SSH keys, and .htaccess changes. Any credentials the site could reach should be considered exposed. Wordfence rates the incident (CVE-2026-111862) 9.8.

Recovery:
Restoring a pre-20:02 UTC October 15 backup is preferred, followed by a security scan and changing all credentials. Without a clean backup, first delete the entire rank-math-pro folder, remove three malicious wp_options entries, and block rank1cdn[.]com. Then hunt for rogue files, admin accounts (wpsupport_), and server persistence. Change all credentials, and install 3.0.124 last, directly from rankmath.com.

Rank Math hasn’t explained how the files entered its system or how many customers were affected. This is at least the third premium WordPress plugin update-channel compromise this year.

5. CVE-2026-99999: Critical PwnEscape Linux Kernel Flaw Enables Guest-to-Host Escape

CVE-2026-99999 (“PwnEscape”) is a Linux kernel flaw, present since version 2.6.27, that lets a guest VM break out to the host. Malformed checksum metadata can make skb_checksum_help() alter an IPv4 header after it was validated. Researchers used this to change a 20-byte header into a 60-byte one, leaking 32 bytes of host memory. It scores CVSS 9.3 (Critical) with a Local attack vector, since the attacker needs code execution inside a guest.

In a controlled KVM environment, researchers chained the leak into host-kernel writes and root execution. Only the memory disclosure was reproduced on Vercel’s live sandbox infrastructure, with no evidence of customer data exposure. Multi-tenant platforms running untrusted code are most at risk. No exploitation or CISA KEV listing has been reported.

Mitigation:
Upgrade the host kernel (guest updates don’t help) to a fixed stable release, such as 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 or 7.2.11. Check distribution advisories, since fixes may be backported. Reboot, then verify the active kernel on every host. Monitor for host crashes and anomalous fragmentation tied to guest traffic. If an escape is suspected, treat the host as compromised.