Oracle issued an out-of-cycle Java SE security alert (CVE-2026-114820, CVSS 9.1, JSSE) on top of its October CPU. Also: PHP2Shell was exploited four days before disclosure, new Kubernetes CVEs, GitHub's npm package firewall, and AWS on taming the Linux kernel CVE flood.
OracleOracle published a Security Alert on 24 Oct for an easily exploitable, unauthenticated, network-reachable flaw in the JSSE component of Java SE, GraalVM for JDK and GraalVM Enterprise (CVSS 3.1 base score 9.1, confidentiality and integrity impact). Affected: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1 (the .0.2 builds). The fix removes the impacted eMudhra root CA certificates; update to the latest Java build or apply the mitigations. Oracle credits no reporter.
OracleOracle's quarterly CPU carries 1,295 new security patches across its product families, and again warns that attackers exploit flaws for which patches already exist. Java Management lists the October CPU Java SE releases as 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33 and 8u511; check every JDK in images, CI runners and application servers.
AWS Security BlogAmazon Threat Intelligence saw a PHP2Shell (CVE-2026-109618 and CVE-2026-109619) attempt in MadPot telemetry on 17 Oct, four days before the 21 Oct disclosure, and broad exploitation attempts followed within hours of the patch. AWS notes it is unclear whether any attempts would have succeeded on real systems. Treat the disclosure date as not the earliest date of compromise, and patch PHP quickly.
