Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Artifex security patch release for CVE-2026-39919

Security Patch Release
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

Artifex shipped Ghostscript 10.08.0 on September 8, 2026, fixing CVE-2026-39919 and reducing remote-code-execution risk in affected PDF-processing deployments. The release also included backports to older versions, so operators must verify patch status rather than assume the mainline update is present. Systems that cannot upgrade immediately need to use the documented PDF-upload or PDF-rendering workaround.

Related Happenings

Ghostscript PDF upload hardening guidance for WordPress administrators

Defensive Guidance
H score26 First: 14.10.2026 00:33 Last: 14.10.2026 00:33 Sources 1

How related: If unable to upgrade to a fixed Ghostscript release, it is recommended to block PDF uploads to the server or disable PDF rendering in ImageMagick.

About this happening: Administrators handling Ghostscript-backed PDF workflows should harden upload and rendering paths because CVE-2026-39919 can enable unauthenticated remote code execution...

Open Happening

WordPress security patch release for CVE-2026-87902

Security Patch Release
H score47 First: 23.09.2026 21:31 Last: 23.09.2026 21:31 Sources 1

About this happening: WordPress released version 7.1.2 to fix CVE-2026-87902, a critical unauthenticated path traversal flaw that can lead to remote code execution under specific co...

Open Happening

HPE ArubaOS-CX security bulletin (CVE-2026-73749)

Security Patch Release
H score31 First: 03.09.2026 21:28 Last: 03.09.2026 21:28 Sources 1

About this happening: HPE released a security bulletin for ArubaOS-CX that patches CVE-2026-73749, a buffer overflow that could let unauthenticated remote attackers reach remote code...

Open Happening

ThemeFusion security patch release for CVE-2026-18431

Security Patch Release
H score43 First: 27.08.2026 00:33 Last: 27.08.2026 00:33 Sources 1

About this happening: ThemeFusion released security fixes for Avada and Fusion Builder after disclosure of CVE-2026-18431, a critical 9.8 chain that can lead to arbitrary PHP code...

Open Happening

Adobe security patch release for CVE-2026-71398

Security Patch Release
H score37 First: 11.08.2026 19:50 Last: 11.08.2026 19:50 Sources 1

About this happening: Adobe released a Priority 1 security update for Campaign Classic to address multiple critical vulnerabilities, including CVE-2026-71398, CVE-2026-27302, and CVE-2026-48381. The fl...

Latest development: 12.08.2026 14:13

Adobe shipped updates for ColdFusion, Commerce, and Campaign Classic to fix multiple critical flaws that could enable arbitrary code execution, privilege escalation, and application denial-of-service. The highest-severity issues include CVE-2026-48362, CVE-2026-48273, CVE-2026-71384, CVE-2026-71362, CVE-2026-71398, CVE-2026-27302, and CVE-2026-48381, with the Campaign Classic fixes tied to ACC v7 7.4.4 build 9400. The ColdFusion and Campaign Classic updates have a Priority 1 rating; the Campaign Classic changes apply only to fully on-premise deployments and on-premise components of hybrid deployments, while Adobe-hosted instances have already been remediated and require no customer action.

Open Happening

Timeline

  1. 14.10.2026 00:33 1 articles · 2h ago

    Researchers uncover CVE-2026-39919 in Ghostscript

    Technical Analysis Update

    Researchers at Wordfence used Argus to uncover CVE-2026-39919 in Ghostscript, a critical heap buffer overflow in the interpreter and rendering engine that can enable remote code execution through specially crafted PDF files; they also developed proof-of-concept exploits that could force a 1,024-byte write into a 256-byte buffer in a WordPress deployment.

    Show sources
    Open in new tab
  2. 14.10.2026 00:33 2 articles · 2h ago

    Artifex ships Ghostscript 10.08.0 to fix CVE-2026-39919

    Mitigation Patch Update

    Artifex released Ghostscript 10.08.0 on September 8 and backported the fix to older versions to remediate CVE-2026-39919; administrators running Ghostscript 9.21 through 10.07.1 were advised to upgrade, or to block PDF uploads and disable PDF rendering in ImageMagick if immediate upgrading is not possible.

    Show sources
    Open in new tab
  3. 14.10.2026 00:33 1 articles · 2h ago

    Wordfence says CVE-2026-39919 has not been exploited in the wild

    Initial Disclosure

    Wordfence said it had not seen in-the-wild exploitation of CVE-2026-39919 and reiterated that the flaw affects any online system running Ghostscript 9.21 through 10.07.1 when attacker-supplied PDFs reach the vulnerable decoding code.

    Show sources
    Open in new tab