Topic

Memory Corruption: news, advisories and analysis

22 articlesUpdated 22 Oct 2026

CyberSecureToday covers Memory Corruption across 22 articles published between 14 Sep 2026 and 22 Oct 2026. The coverage includes 22 vulnerability advisories. 21 advisories are rated critical or high severity, and 4 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Memory Corruption most often intersect with Remote Code Execution, Active Exploitation and HackerOne, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Critical 'PHP2Shell' Core Runtime Flaws Trigger Unauthenticated RCE Across Millions of Web Servers”, was published 22 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaS
Critical 'PHP2Shell' Core Runtime Flaws Trigger Unauthenticated RCE Across Millions of Web Servers
Emergency updates in PHP 8.5, 8.4, 8.3, and 8.2 fix the 'PHP2Shell' dual memory corruption flaws (CVE-2026-109618 and CVE-2026-109619), exposing servers to pre-execution code execution.
CST Editorial Desk22 Oct 202613 min read
ThreatsCloud & SaaSCritical
TOTOLINK Weakness has been identified in TOTOLINK EX200 Memory Corruption Flaw Disclosed
CVE-2026-114383 in TOTOLINK Weakness has been identified in TOTOLINK EX200 (Memory Corruption) allows remote attackers to trigger arbitrary code execution.
Aisha Noor22 Oct 202610 min read
ThreatsCloud & SaaSCritical
Tenda Security vulnerability has been detected in Tenda Memory Corruption Flaw Disclosed
CVE-2026-113744 in Tenda Security vulnerability has been detected in Tenda (Memory Corruption) allows remote attackers to trigger arbitrary code execution.
Aisha Noor21 Oct 202610 min read
ThreatsCloud & SaaSHigh
Nintendo Switch Local Wireless Multiplayer Flaw Allowed Remote Pre-Auth Stack Buffer Overflows
A remote stack buffer overflow in the Nintendo Switch LDN wireless multiplayer service allowed attackers within Wi-Fi range to hijack control flow.
Aisha Noor18 Oct 202614 min read
ThreatsCloud & SaaSCritical
MariaDB Critical RCE Chain Exploits SYS_REFCURSOR Use-After-Free and ST_Area Over-Read
A critical exploit chain in MariaDB combined a cursor-array use-after-free with a geospatial memory disclosure to achieve command execution from low-privilege accounts.
CST Editorial Desk18 Oct 202616 min read
ThreatsCloud & SaaSHigh
libcurl HTTP/2 Streaming Upload Use-After-Free Flaw Exposes Client Applications to Memory Corruption
A heap use-after-free defect in libcurl's HTTP/2 streaming upload engine enabled memory corruption when paused streams were aborted or reset.
Priya Raman18 Oct 202615 min read
ThreatsCloud & SaaSCritical
Windows OLE Untrusted Pointer Dereference Flaw Enables Network-Based Remote Code Execution
A critical untrusted pointer dereference vulnerability in Windows OLE (CVE-2026-96924) enables remote, unauthenticated code execution without user interaction.
CST Editorial Desk18 Oct 20269 min read
NewsCloud & SaaSCritical
Hugging Face Text Generation Inference Flaw Enables Rust FFI Memory Corruption and Host Takeover (CVE-2026-78320)
Hugging Face issues an urgent patch for Text Generation Inference (CVE-2026-78320, CVSS 9.3) fixing a critical Rust tokenizer deserialization vulnerability.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Mitsubishi Electric MELSEC-Q PLC Vulnerability Enables Unauthenticated Memory Corruption via SLMP Protocol Injection (CVE-2026-78820)
Mitsubishi Electric issues an emergency advisory for MELSEC-Q PLCs (CVE-2026-78820, CVSS 9.3) resolving an unauthenticated SLMP protocol injection flaw.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Schneider Electric Foxboro DCS Flaw Allows Unauthenticated Fieldbus Module Memory Corruption (CVE-2026-77880)
Schneider Electric releases emergency fixes for Foxboro DCS Fieldbus Modules (CVE-2026-77880, CVSS 9.6) resolving a critical memory corruption flaw.
CST Editorial Desk12 Oct 20268 min read
ThreatsCloud & SaaSHigh
Hugging Face Transformers Dynamic Cache Offloading Flaw Allows Local Host Memory Corruption (CVE-2026-59114)
Hugging Face security bulletins document a memory corruption vulnerability in transformers parameter offloading modules enabling arbitrary host execution.
Aisha Noor9 Oct 20268 min read
ThreatsCloud & SaaSCritical
NVIDIA Triton Inference Server Memory Corruption Flaw Enables Remote Execution in GPU Clusters CVE-2026-34902
NVIDIA Product Security advisory addresses a critical memory corruption defect in Triton Inference Server enabling code execution across enterprise AI clusters.
Daniel Okafor6 Oct 20268 min read
ThreatsCloud & SaaSCritical
Google Ships Emergency Desktop Stable Channel Update Fixing Critical Chrome WebGL Memory Corruption (CVE-2026-103628)
Google released Chrome 154.0.8037.97 resolving a critical out-of-bounds write flaw in WebGL (CVE-2026-103628) that exposes memory to arbitrary code execution.
Priya Raman5 Oct 20268 min read
ThreatsCloud & SaaSCritical
Apache HTTP Server mod_http2 Use-After-Free Flaw Exposes Web Fleets to Remote Exploitation (CVE-2026-57941)
A critical use-after-free in Apache HTTP Server mod_http2 via shared session bucket brigades enables remote unauthenticated memory corruption.
Mei-Lin Chen2 Oct 20269 min read
ThreatsCloud & SaaSCritical
Apple Patches CoreGraphics In-The-Wild Zero-Day Memory Corruption Across iOS and macOS (CVE-2026-86950)
Apple resolves a critical out-of-bounds write zero-day in CoreGraphics (CVE-2026-86950) exploited in targeted cyber-espionage attacks against iOS and macOS.
CST Editorial Desk29 Sep 20268 min read
ThreatsCloud & SaaSHigh
Microsoft Outlook Memory Parsing Flaw Enables Remote Code Execution via Crafted Documents
Microsoft MSRC discloses high-severity 8.8 CVSS RCE flaw CVE-2026-70125 in Microsoft Outlook enabling arbitrary code execution via crafted compound documents.
CST Editorial Desk26 Sep 202614 min read
ThreatsIndustrial & OTHigh
lwIP TCP/IP Stack Double Free Flaw Exposes Industrial Controllers to Remote Hijacking
CISA and lwIP maintainers warn of high-severity flaw CVE-2026-91018 in the lwIP TCP/IP stack allowing unauthenticated remote memory corruption across IoT and PLCs.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSHigh
Linux Kernel In-Kernel TLS Receive Path Flaw Weaponized in Active Multi-Tenant Cloud Attacks
Threat actors weaponize improper condition check flaw CVE-2025-39682 in Linux kernel kTLS receive path, triggering out-of-bounds corruption in multi-tenant workloads.
CST Editorial Desk19 Sep 202611 min read
ThreatsCloud & SaaSHigh
Linux Kernel ebtables SNAT Out-of-Bounds Write Flaw Exploited in Active Attacks
CISA adds Linux kernel ebtables SNAT memory corruption flaw CVE-2026-53266 (CVSS 8.8) to KEV catalog following active hypervisor privilege escalation.
Mei-Lin Chen18 Sep 202610 min read
ThreatsCloud & SaaSCritical
Microsoft SQL Server Memory Corruption RCE Flaw Exploited in Database Infiltration Attacks
CISA adds Microsoft SQL Server vulnerability CVE-2019-1068 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against enterprise database clusters.
CST Editorial Desk17 Sep 202614 min read
ThreatsCloud & SaaSHigh
Citrix NetScaler Gateway Memory Buffer Overflow Exploited in Active Attacks
CISA issued a binding directive on CVE-2026-8452, a high-severity memory buffer vulnerability in Citrix NetScaler ADC and Gateway appliances triggering perimeter denial of service.
Priya Raman15 Sep 20267 min read
ThreatsTelecom & MediaHigh
Cisco Fixes High-Severity Memory Corruption Flaw in Carrier-Grade IOS XR Routing Core
Cisco resolved CVE-2026-20274, an unauthenticated memory corruption flaw in IOS XR software that enables crash-loops or remote code execution in telecommunications cores.
Daniel Okafor14 Sep 20267 min read