Critical-severity threat briefing for 8 November 2026. Top story: CVE-2026-123551, a CVSS 10.0 information disclosure flaw in OpenAM 14.0.0 to 16.1.3, plus two CVSS 9.3 OpenAM CVEs, checked against NVD and CISA KEV.
What the Tailscale “Tailworm” research report means for your tailnet: no confirmed exploitation and no advice to disable Tailscale SSH, but review your exposure and enable Tailnet Lock while fixes land.
18 critical and high security issues in self-hosted software for 31 October to 7 November 2026, including an LXD authentication bypass (CVE-2026-112816) and vulnerabilities in Traefik, Caddy and Keycloak.
11 critical and high security issues in self-hosted software for 29 October to 4 November 2026: an actively exploited WordPress core RCE, a CVSS 10.0 Incus/LXD auth bypass, Traefik, BIND, Caddy and pgAdmin fixes.
CVE-2026-98432 is a CVSS 9.8 use-after-free in the Linux IPv4 TCP handshake, reachable by one unauthenticated SYN on kernels since 4.4. How to patch, and which MPTCP mitigations actually hold up.
10 critical and high security issues in self-hosted software for 22 to 28 October 2026: the actively exploited Brotli “Node2Shell” and Nextcloud Collabora CODE bugs, and a CVSS 10.0 LiteLLM key leak.
Debian security update DSA-6607-1 fixes CVE-2026-109518 in APT, where a man-in-the-middle could swap a package after verification and run code as root. Update to apt 3.0.4 on Debian trixie.