Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

**Ghostscript critical RCE (CVE-2026-39919, CVSS 9.8):** Artifex released Ghostscript 10.08.0 to fix a heap buffer overflow in the JPEG 2000 output adapter that can allow unauthenticated remote code execution via crafted PDFs (affects 9.21–10.07.1); Wordfence validated the bug and built working lab exploits but reports no confirmed exploitation in the wild, and site owners should update system/container Ghostscript packages, rebuild images, or apply mitigations (disable PDF processing, adjust ImageMagick policies) until patched.