This briefing covers 10 cybersecurity and geopolitics stories published around Sunday, October 18, 2026, and 8 disclosed vulnerabilities (CVE-2026-111882, CVE-2026-111893, CVE-2026-111901, CVE-2026-111908 and others). Each entry links to the original reporting.
Canada's planned surveillance legislation adds to a multinational pattern of governments legislating backdoors or weakened encryption standards. Each new national precedent normalizes the framework, accelerating erosion of strong encryption as a baseline internet security guarantee.
A court-ordered military psychiatrist has found the USS Cole bombing case defendant competent to stand trial before a Guantanamo military commission; a federal judge declined to intervene.
Fleet before 4.83.0 allows unauthenticated attackers to exhaust server memory by sending compressed gzip payloads to open endpoints, scoring 8.7 HIGH. Unpatched Fleet deployments managing device fleets become trivially deniable by any external attacker with HTTP access.
Fleet before 4.89.0 crashes via unbounded recursion when parsing crafted binary plist payloads at Apple MDM enrollment endpoints, no credentials required, severity 8.7. Organizations using Fleet for mobile device management face full server outage from a sub-200-byte unauthenticated request.
phpMyFAQ 4.0.0 before 4.1.9 lets attackers register a passkey to any account without authentication by submitting a forged fmt=none WebAuthn attestation, bypassing passwords and TOTP. The unauthenticated attack path to full account takeover sets a high-privilege escalation ceiling requiring immediate patching.
phpMyFAQ before 4.1.9 fails to enforce authorization in deleteUser(), letting any user with delete_user permission send a DELETE request to wipe superadmin accounts. Targeted deletion of administrators enables privilege takeover or accountability destruction in any exposed phpMyFAQ instance.
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta checks only global edit_faq permission in its REST API, ignoring object-level access controls on individual FAQ records. Attackers with minimal privileges can silently corrupt restricted content and bypass moderation workflows.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta loads entire database record sets into PHP memory on unauthenticated FAQ and search API calls, enabling resource exhaustion via concurrent GET requests, severity 8.7. No credentials required to crash the server makes this a low-barrier availability attack.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta allows category-restricted administrators to POST out-of-scope categoryIds, granting groups unrestricted category access beyond their delegated authority, severity 8.5.
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta skips TOTP validation for users authenticating via Keycloak or Entra ID OIDC flows, granting full sessions including admin access. Phishing a linked IdP identity is now sufficient to own 2FA-hardened phpMyFAQ admin accounts.