PatchClock

PHP security digest · Packages

october/system security advisories

2 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Low 14 Sep 2026

    October CMS: PHP Object Injection via Backend Widget Session Storage

    Fixed in 3.7.17, 4.2.23 · CVE-2026-49400

  2. Low 14 Sep 2026

    October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

    Fixed in 3.7.17, 4.2.23 · CVE-2026-46696

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including october/system, and the version that fixes it.