Patch this week:Next.js: Two Critical Unauthenticated RCEs (Oct 14). Teams running self-hosted Next.js on glibc Linux with the built-in Image Optimization API, and any Next.js 16 App Router app using Cache Components.
Patch this week:PAN-OS CVE-2026-0322: Exploited Management-Interface RCE. Anyone running PAN-OS 10.2 through 12.2 on PA-Series or VM-Series firewalls or on Panorama, most urgently where the management web interface is exposed beyond a trusted admin network.
Patch this week:SiteGuard WAF CVE-2026-106931: Exploited Command Injection. Organizations running SiteGuard Server Edition 2.20 or later for Apache httpd, Nginx or IIS below 8.00 Update 5 (7.00 Update 6 on FreeBSD) with the default-on statistics feature, a product JPCERT/CC says is widely used in Japan.
Do you run any of these? Cisco Secure Email Gateway, Ahsay AhsayCBS, Palo Alto Networks PAN-OS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-17.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Self-hosted Next.js apps should move to 16.4.1 or 15.5.28 this week; both RCEs have preconditions and no exploitation is reported, but the fix is a routine minor upgrade.
Must act: Teams running self-hosted Next.js on glibc Linux with the built-in Image Optimization API, and any Next.js 16 App Router app using Cache Components.
Can relax: Static exports with no Next.js server, apps on Alpine/musl without the image optimizer in play, and apps not using 'use cache' still should upgrade but need not drop everything.
Upgrade: npm install next@16.4.1 (16.x) or next@15.5.28 (15.x), then rebuild and redeploy.
Confirm the resolved sharp is 0.35.5 or later: npm ls sharp.
If you use React Server Components outside Next.js, upgrade react-server-dom-* to 19.0.9/19.1.10/19.2.9/19.3.1.
Patch every PAN-OS firewall and Panorama this week, and today if the management interface is reachable from the internet; the bug needs an admin login but is already being exploited.
Must act: Anyone running PAN-OS 10.2 through 12.2 on PA-Series or VM-Series firewalls or on Panorama, most urgently where the management web interface is exposed beyond a trusted admin network.
Can relax: Cloud NGFW and Prisma Access customers (not affected), and teams whose management interface is reachable only from a locked-down jump host can patch on a normal but prompt cycle.
List every PA-Series, VM-Series and Panorama instance and its PAN-OS version (show system info).
Upgrade to the fixed release or hotfix for your train from the vendor table, starting with any device whose management interface is internet-reachable.
Restrict the management interface to trusted internal addresses or a single jump host; remove any internet exposure.
If you run SiteGuard Server Edition, save its diagnostic data and patch this week, sooner on public web servers; the bug is exploited, but its local rating means attackers need a foothold first.
Must act: Organizations running SiteGuard Server Edition 2.20 or later for Apache httpd, Nginx or IIS below 8.00 Update 5 (7.00 Update 6 on FreeBSD) with the default-on statistics feature, a product JPCERT/CC says is widely used in Japan.
Can relax: Anyone not running SiteGuard Server Edition: the advisories do not list SiteGuard Proxy Edition, Cloud Edition or the SiteGuard WP Plugin, and IIS versions 3.10 through 4.00 Update 4 are not affected.
Before changing anything, download the diagnostic information from the SiteGuard web admin console and store it safely; the vendor warns that updating can erase attack traces.
Upgrade to Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD), or apply the vendor's statistics-file patch, which also covers end-of-life versions.
If you cannot upgrade or patch yet, disable the statistics feature, which JPCERT/CC says avoids the vulnerability.