Vulnerabilities & Exploits
Cybersecurity news in this category
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution
Trend Micro ZDI Reports on Critical Linux KSMBD Vulnerabilities Leak to Public Mailing Lists Before Patches
Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket
Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.
Node.js Addresses 10 Vulnerabilities Including High-Severity RCE Risk in Brotli Decompression
The Node.js development team disclosed ten vulnerabilities across multiple versions of the JavaScript runtime on October 21, 2026. Four of the issues received a High severity rating, with one carrying a remote code execution risk through improper handling of Brotli-compressed data. The flaw tracked as CVE-2026-111497 affects Node.js 26.x, 24.x, and 22.x branches and stems from out-of-bounds memory writes during decompression. Additional High-severity problems involve DNS name resolution truncation when NUL characters are present and hostname verification bypasses in TLS certificate validation. The project also resolved three Medium and three Low severity issues related to certificate validation, snapshot entropy reuse, and file-access permission checks. Updated releases Node.js 26.12.1, 24.22.1, and 22.23.4 incorporate fixes for both the core issues and vulnerabilities in bundled components such as c-ares, OpenSSL, SQLite, and Undici. Users of unsupported older branches are advised to migrate to currently maintained versions.
HPE Discloses 72 Vulnerabilities in AOS-10 and AOS-8 Wireless LAN Operating Systems, 33 Rated Critical
Hewlett Packard Enterprise has published a security advisory detailing 72 vulnerabilities affecting its wireless LAN operating systems AOS-10 and AOS-8. The flaws impact mobility controllers, gateways, access points, and virtual machines running these platforms. Thirty-three of the issues received the highest severity rating of Critical, with eight vulnerabilities scoring the maximum CVSSv3.1 base score of 10.0. Specific examples include a buffer overflow tracked as CVE-2026-79847 in AOS-10, plus command injection and SQL injection flaws in AOS-8 that allow unauthenticated remote code execution. No exploitation of these vulnerabilities has been observed at the time of disclosure. The advisory was released on October 22, 2026, and organizations are urged to apply available patches promptly.
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.
Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.
Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.
PHP2Shell Vulnerabilities Targeted in Exploitation Attempts Four Days Before Public Disclosure
Amazon Threat Intelligence detected early exploitation attempts against PHP vulnerabilities on October 17, four days prior to the public disclosure and patch release. The activity was observed through the MadPot honeypot network, with initial requests originating from a commercial anonymization service. Additional probing with varied payloads occurred on October 21, indicating multiple threat actors were involved before fixes became available. OpenAI reported that researchers from the Calif team identified one critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, while Wiz independently discovered and reported both issues. PHP developers prepared the patches with support from security researchers and infrastructure providers. Amazon advises organizations to investigate potential compromise traces dating back to at least October 17, as new proof-of-concept exploits appeared within hours of the advisory and were quickly deployed against company sensors.
Anatomy of HTC Sense Vulnerability: Bypassing FRP Lock on HTC U11 Plus Without PC
A detailed technical breakdown reveals how an old HTC U11 Plus running Android 8 or 9 can have its Factory Reset Protection bypassed after a forgotten pattern lock. The method uses the device's own email client and credential storage system to force a new PIN without any PC or external tools. Multiple standard bypass attempts failed due to HTC Sense restrictions, including muscle memory recovery, Google account removal, Find My Device, and bootloader unlocking. The working exploit leverages the Exchange account setup flow to trigger Credential Storage Bypass, which overrides FRP flags by prioritizing certificate requests over setup wizard locks. A combined fingerprint and PIN option then allows creation of a new credential that survives reboot and passes the post-reset Google verification. The technique exploits architectural priority conflicts between the Biometric Framework and FRP enforcement in HTC Sense firmware.
Node.js Issues Security Updates Patching Ten Vulnerabilities Including High-Severity TLS Name Verification Bypasses
The Node.js project released security updates on October 21 for release lines 26, 24, and 22, addressing ten vulnerabilities with four rated high severity. The most critical issue, CVE-2026-111497, resides in the Brotli decoder and involves an out-of-bounds write that could enable remote code execution across all three supported lines. Two additional high-severity flaws affect TLS name verification: CVE-2026-105483 bypasses checks when addresses contain full-width digits, while CVE-2026-106069 fails on imprecise IP address resolution, potentially allowing a certificate to be accepted for an unintended destination. A fourth high-severity vulnerability, CVE-2026-105482, causes the dns.resolve function to truncate names containing null characters, creating inconsistencies between queried and resolved names. Medium-severity issues include out-of-order processing in HTTP socket keep-alive, improper certificate validation for non-standard IPv4 addresses, and repeated cryptographic random values in snapshot initialization and single-executable applications affecting crypto.randomUUID and crypto.randomInt. The updates also refresh c-ares, CA certificates, Undici, OpenSSL, and SQLite, with recommendations to test HTTPS outbound connections, DNS handling, Brotli-compressed content, and permission-restricted workloads.
Yandex Station Root Access Flaw Exploited via Trusted Certificates Error, Patch Now Rolling Out
Enthusiasts discovered a method to obtain root access on their own Yandex Station smart speaker by exploiting an error in the trusted certificates system, bypassing the need to physically disassemble the device. The technique involved instructing the Alice voice assistant to play music and then probing for administrator privileges on the hardware. Yandex confirmed the vulnerability and has begun distributing an over-the-air update to close the access vector. Root privileges enable users to modify device software with far fewer restrictions than standard settings allow, expanding options for custom experimentation. The company emphasized that the flaw only affected a user's own device and that remote compromise of third-party units remained nearly impossible before the fix. Yandex also noted that owners previously could achieve similar customization by opening the device and flashing custom firmware, but the new method avoids any hardware intrusion. Work continues on refining the factory reset process, though specific details remain undisclosed.
PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
CISA Urges Immediate Patching of Critical PHP Remote Code Execution Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding two severe vulnerabilities in the PHP programming language that allow unauthenticated remote code execution. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws affect all environments processing web requests with PHP and have been nicknamed php2shell. CISA recommends applying patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay, or taking affected systems offline if updates cannot be applied immediately. Although no exploitation has been observed yet, organizations are instructed to inventory PHP usage, prioritize internet-facing systems, and monitor for suspicious activity such as shell processes spawned from PHP workers. Web application firewalls may offer partial protection but are not considered a substitute for patching.
GitLab Issues Critical Patches for CVE-2026-110264 Affecting Wide Range of Versions
GitLab has released emergency security updates to address multiple vulnerabilities, including one rated critical that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-110264, stems from an integer overflow in the regular expression compiler and carries a maximum CVSSv3.1 base score of 10.0. It impacts GitLab Community Edition and Enterprise Edition starting from version 7.0, with patches now available for both current and older branches. The company strongly urges immediate updates due to the severity and potential for arbitrary code execution on affected servers. Additional lower-severity issues were also resolved in the same release cycle.
PHP Issues Emergency Patches for Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released urgent patches for two critical vulnerabilities collectively known as PHP2Shell that enable unauthenticated remote code execution on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0 and have already seen active exploitation attempts with malicious payloads adjusted to bypass WAF rules. The issues affect multiple PHP deployment methods including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and do not require complex application code to be exploitable. CVE-2026-109618 involves a memory corruption chain leading to code execution under the web process privileges, while CVE-2026-109619 stems from an obsolete global state issue causing use-after-free conditions that can result in memory disclosure and code execution. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators advised to restart all persistent workers after updating. Temporary mitigations such as setting memory_limit to -1 and disabling session.upload_progress.enabled are available for environments that cannot patch immediately.
Two Critical RCE Vulnerabilities Patched in PHP with CVSS 9.2 Scores
The PHP development team has disclosed two severe remote code execution vulnerabilities affecting the widely used scripting language. Both issues, tracked as CVE-2026-109618 and CVE-2026-109619, received a CVSSv4.0 base score of 9.2 and were rated Critical. The flaws stem from improper memory handling during request processing and cleanup phases. Exploitation could allow attackers to execute arbitrary code by manipulating uninitialized or residual data in worker processes. Security updates addressing both vulnerabilities were released on October 21, 2026, and users are strongly urged to apply the patches immediately. The advisories were previewed the previous day, highlighting the urgency of the fixes.
Critical PHP Core Flaws Enable Unauthenticated Remote Code Execution
The PHP project released emergency patches on October 21 for two critical vulnerabilities in the language core, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell. Both issues received a CVSS 4.0 score of 9.2 and allow remote code execution without authentication. CVE-2026-109618 resides in memory-handling routines where longjmp can leave request data partially initialized, and subsequent shutdown operates on invalid data; multipart requests with many headers or empty file fields can trigger the condition. CVE-2026-109619 affects an obsolete global state in long-lived workers that retain references to freed memory, with confirmed paths involving fatal errors, error reporting data, and session upload progress. Researchers demonstrated unauthenticated code execution over HTTP against the first flaw on Apache with mod_php using default limits, while PHP-FPM exposure was identified through code analysis. The FBI Cyber Division issued an alert urging immediate updates, and Cloudflare deployed WAF rules while confirming early attacks in the wild.
Oracle Releases October 2026 Critical Patch Update Fixing 1,295 Vulnerabilities Across Multiple Products
Oracle has published its quarterly Critical Patch Update (CPU) on October 20, 2026, delivering a total of 1,295 security patches for a wide range of products. After removing duplicates, the update addresses 1,209 unique CVEs. The highest number of fixes went to Oracle Fusion Middleware with 206 patches, followed by Oracle E-Business Suite with 194, Oracle Communications with 110, Oracle MySQL with 98, and Oracle Java SE with 55. Among the vulnerabilities, 587 received a CVSSv3 base score of 7.0 or higher, including 112 rated 9.0 or above. Six vulnerabilities scored the maximum 10.0, one of which is CVE-2026-101809 in Oracle E-Business Suite Workflow Notification Mailer that can be exploited remotely without authentication over HTTP.
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.
Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21
The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.
Mozilla Releases Firefox 158.0.1 Security Update Fixing High-Severity Vulnerabilities and Compromised Certificates
Mozilla Foundation has published Firefox 158.0.1 on October 20, 2026, delivering fixes for four CVEs rated at high overall severity. Two vulnerabilities received a High rating, including a boundary condition flaw in the SVG component tracked as CVE-2026-113399 and a certificate blocklist issue identified as CVE-2026-113470. The update also refreshes the OneCRL list to block an intermediate certificate from eMudhra that was compromised earlier in the month. Mozilla delivered the updated blocklist via RemoteSettings on October 17 and embedded the changes directly into the browser release. This approach ensures compromised certificates remain blocked even when RemoteSettings is disabled or network access is unavailable. One Moderate and one Low severity issue complete the set of addressed flaws.
Drupal Patches Critical Unauthenticated RCE Vulnerability in Field UI Module
The Drupal team has released patches for a critical vulnerability in the Field UI module that can enable remote code execution under specific component combinations. Although the core CMS alone is insufficient for exploitation, at least one known attack path requires no authentication, eliminating the need for an administrator password. The flaw, tracked as CVE-2026-108097, arises when combined with third-party modules or custom site code that exposes vulnerable functionality. Fixes are included in Drupal versions 11.4.10, 11.3.19, and 10.6.19, with temporary mitigation achieved by removing the Field UI module. Drupal Steward provides partial protection against known variants but does not cover all possibilities. A separate RCE issue, CVE-2026-108099, was also fixed in the Entity List module version 3.0.10, which similarly allows unauthenticated exploitation in certain configurations. Prior to the patches, developers warned that exploits could appear within hours or days, though no active attacks have been reported.
Roundcube Webmail Issues Security Updates to Address Multiple Vulnerabilities
The Roundcube Webmail development team released versions 1.7.5 and 1.6.20 on October 19, 2026, to resolve approximately 20 security issues affecting email viewing, authentication, and external content handling. The updates address command injection flaws in IMAP actions that could be triggered via newline characters, as well as header injection vulnerabilities involving sender display names and parameters such as References, In-Reply-To, Message-ID, and From. Additional fixes cover subject lines and data URIs in forwarded attachments, media types in inline images, and bypasses in server-side request forgery filters. The patches also mitigate cross-site request forgery evasion in spam reporting and cross-site scripting issues stemming from password driver error responses. Administrators are urged to apply the updates promptly to prevent exploitation of these weaknesses.
Cybercriminals Exploit Command Injection Vulnerability in SiteGuard WAF Server Edition
EG Secure Solutions has confirmed active exploitation of CVE-2026-106931, a command injection flaw in the statistics processing function of SiteGuard Server Edition. The vulnerability, classified as CWE-78, allows local attackers with low privileges to execute arbitrary system commands as root on Unix systems or SYSTEM on Windows without user interaction. CVSS scores rate the issue at 8.5 under version 4.0 and 7.8 under version 3.0, affecting installations from version 2.20 onward when statistics are enabled by default. Specific version ranges for Apache, Nginx, and IIS editions on FreeBSD and other platforms determine the exact impact, with some IIS versions remaining unaffected. The vendor notified direct support customers on September 29, followed by public advisories from JVN on October 14 and JPCERT/CC. Organizations unable to update can apply a targeted patch or disable the statistics feature, though the patch erases attack traces, requiring prior diagnostic data collection.
Check Point Discloses Two High-Impact Vulnerabilities in LiteLLM AI Gateway Allowing Low-Privilege Users to Steal API Keys
Check Point Research has disclosed two vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in the LiteLLM AI gateway that affect all versions prior to 1.83.9. The flaws enable low-privilege authenticated users to modify gateway configurations, read server files, redirect traffic, and perform SSRF attacks to access internal resources. LiteLLM serves as a unified proxy for over 140 AI providers including OpenAI, Anthropic, and Azure OpenAI, managing API keys, routing, and usage monitoring for enterprises worldwide. The configuration update endpoint lacks role-based access controls, allowing any authenticated user to alter settings and potentially achieve remote code execution. Combined with the SSRF vulnerability, attackers can pivot from low-privilege accounts to compromise internal networks and exfiltrate stored credentials. The project has exceeded 61,000 GitHub stars and recorded over 90 million monthly downloads, making the issues particularly widespread due to its embedding in numerous internal AI platforms. Organizations are advised to upgrade immediately, audit access to management endpoints, rotate all API keys, and scan for hidden LiteLLM instances in requirements files and dependencies.
Gezine Demonstrates Debug Settings Access on PlayStation 5 Firmware 14.10
Security researcher Gezine has published a video showing access to the hidden Debug Settings menu on a retail PlayStation 5 running firmware version 14.10. Sony shipped the 14.00 update on October 1, which closed the previous kernel vulnerability used on 13.xx firmware, yet a new method was demonstrated only 18 days later. The technique is unrelated to the earlier Relapse exploit chain that worked up to version 13.60. Full system control is not achieved, and the previous method for extracting game executables no longer functions on 14.xx builds, likely requiring a separate hypervisor bypass. Gezine has stated that the new exploit details will not be released immediately and that any future disclosure decision will be made later.
Multiple Vulnerabilities Found in nginx Web Server, Three Rated Critical by F5
F5 disclosed an out-of-band security advisory on October 14, 2026, revealing a total of 11 vulnerabilities across nginx and related products. Five issues affect the core open-source nginx server while six more impact associated offerings including NGINX Gateway Fabric and NGINX Ingress Controller. The flaws can lead to denial of service, remote code execution, authentication bypass, and sensitive information disclosure. Although the official nginx project rates all five core vulnerabilities as Medium severity, F5 assigns a CVSS v4.0 base score of 9.2 to three of them, classifying them as Critical. One example is CVE-2026-15176, a heap buffer overflow in the ngx_http_core_module that triggers under specific URL rewrite and file-path configuration settings.
CISA Adds BeyondTrust Remote Support and Fortinet Flaws to KEV Catalog Following Zero-Day Exploitation by ARMORY CASTLE
The US Cybersecurity and Infrastructure Security Agency has added two vulnerabilities affecting Fortinet and BeyondTrust products to its Known Exploited Vulnerabilities catalog. CVE-2026-102764 is an authentication bypass flaw in BeyondTrust Remote Support that allows remote attackers to manipulate appliance files without credentials due to insufficient source validation. BeyondTrust released an advisory on October 15, 2026, rating the issue 9.3 on CVSS v4.0 as Critical. Mandiant attributes the zero-day exploitation to the suspected Chinese group ARMORY CASTLE, which deployed web shells for persistence and privilege escalation in late August. The second CVE, CVE-2025-61624, also appears on the KEV list but lacks further public technical details in the current advisory. Organizations are urged to apply patches immediately to prevent further compromise.
Use-After-Free in HTTP/2 Upload Leads to Potential RCE in curl: Detailed Analysis of CVE-2026-92392
In curl 8.23.0, developers fixed a high-severity Use-After-Free vulnerability tracked as CVE-2026-92392 that could allow remote code execution during HTTP/2 uploads. The flaw stems from a dangling pointer left on an easy handle after a server resets an HTTP/2 stream, which later gets dereferenced when the multi handle closes. An attacker controlling the server can influence memory contents to hijack a function pointer and execute arbitrary code, though successful exploitation requires precise conditions including upload size, memory layout, and knowledge of the target architecture. The issue was discovered by Luna Tong at Anthropic using their OSS Scanner and reported to the curl security team on September 15. The team accelerated the release cycle by two weeks to deliver the fix while maintaining standard procedures. curl maintainers continue reducing internal handle pointers in favor of identifiers and are adding more tests and static analysis to prevent similar memory-safety errors. The vulnerability highlights ongoing risks in C-based networking code handling multiplexed protocols like HTTP/2.
Automating Asset Scanning in MaxPatrol VM via API: Part 4 on Authentication
A detailed technical guide explains how to build asset scanning automation in MaxPatrol VM using its API, starting with authentication methods. The author covers three authorization options including local account login-password, domain account credentials, and reference tokens, providing working Python examples for local accounts. Code reads secrets from an .env file and obtains a Bearer token valid for 24 hours from the Core role instance. The post details required privileges in both the Management Console and MaxPatrol 10 for tasks such as vulnerability exports, dynamic asset group management, scan task creation, and report exporting. It credits Alexey Leonov for an early GitHub script that enabled practical API usage and lists additional resources including webinars, SDK, CLI, Jira integration, and a Postman collection. All subsequent API calls rely on the generated headers containing the Bearer token.
Securing Hadoop Clusters: Removing Passwords from XML Configs with Credential Provider API and JCEKS
Hadoop configurations frequently expose sensitive credentials such as database passwords and cloud access keys in plain text within files like hive-site.xml and core-site.xml. The Credential Provider API, introduced in Hadoop 2.6, allows applications to retrieve secrets from an external JCEKS keystore instead of embedding them directly in XML. This mechanism uses conf.getPassword() to fetch decrypted values from the keystore when hadoop.security.credential.provider.path is configured. JCEKS relies on the outdated PBEWithMD5AndTripleDES algorithm, which remains vulnerable to Sweet32 attacks in theory though practical risk for small keystore files is low. Master password protection for the keystore itself is the weakest link, with options including environment variables, protected password files, or HDFS Transparent Data Encryption. Arenadata has automated credential encryption management in its ADH platform through ADCM to handle keystore creation, permission setting, and rotation across cluster nodes.
CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Four vulnerabilities were registered on October 14, 2026, and one additional entry followed on October 15. Among the newly listed issues are two critical flaws affecting the AhsayCBS backup management server: CVE-2026-105133, an authentication bypass in the API, and CVE-2026-105134, a command injection vulnerability in the replication feature. When chained together, the pair allows unauthenticated remote attackers to execute arbitrary operating system commands. Vendor Ahsay has released hotfixes in versions 10.3.4.45 and 9.15.2.70 because standard patches cannot fully address the issues. The advisory also references vulnerabilities in Atlassian products and multiple network security solutions from other vendors.
Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch
Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.
543 Vulnerabilities in FFmpeg: Hunting Flaws in the Industry Standard
FFmpeg, the open-source library serving as the de facto standard for audio and video processing in mobile apps, carries approximately 543 registered CVEs that frequently appear in bug bounty programs. A Quokka report on over 150,000 applications found critical third-party CVEs in 11% of Android and 13% of iOS apps, with high-severity issues in 65% of Android applications. The article examines three notable vulnerabilities including PixelSmash (CVE-2026-8461), HTTP chunked overflow (CVE-2016-10190), and an AV1 RTP depacketizer flaw (DFVULN-127), each enabling remote code execution through memory corruption. It provides practical guidance on locating FFmpeg binaries inside APKs, identifying integration patterns, determining versions via strings and NDK timestamps, and extracting build configurations to confirm enabled components. Analysts are shown how to locate protocol handlers that serve as entry points without requiring malicious media files. The material targets reverse engineers experienced with ELF libraries and memory corruption issues.
Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes
Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The companyโs models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.
Palo Alto Networks Discloses Seven PAN-OS Vulnerabilities Including One Already Exploited in the Wild
Palo Alto Networks has published seven security advisories addressing vulnerabilities in its PAN-OS operating system used on PA-series and VM-series firewalls as well as the Panorama management platform. One flaw tracked as CVE-2026-0322 allows authenticated remote code execution with root privileges through the management interface and has already been observed in limited exploitation attempts. The company rated the issue with a CVSS v4.0 base score of 8.6 and assigned it the highest remediation priority. Four additional medium-severity issues and two low-severity issues were also fixed in the same set of advisories. Products such as Cloud NGFW and Prisma Access are confirmed to be unaffected. Palo Alto Networks urges immediate patching for all impacted PAN-OS deployments.
Critical Vulnerability CVE-2026-76519 in Cisco Secure Email Gateway Allows Arbitrary File Writes Without Authentication
Cisco Systems has disclosed a critical vulnerability in its Cisco Secure Email Gateway product that affects the Advanced Malware Protection feature responsible for processing email attachments. The flaw, tracked as CVE-2026-76519, permits unauthenticated attackers to write arbitrary files to the underlying operating system by sending a specially crafted email attachment. Successful exploitation can lead to remote command execution with root privileges. The vulnerability received a CVSS v3.1 base score of 9.8 and is rated Critical. Cisco confirmed active exploitation of the issue in October 2026, shortly after publishing the security advisory on October 14, 2026. This marks the second publicly disclosed exploited vulnerability in the product within a short period, though the flaws are unrelated.
Cyberattack Exploits Exposed Danfoss Refrigeration Controllers Across French Supermarkets
A remote cyberattack targeted Danfoss AK-SM 8xxA Series controllers in French supermarkets, allowing attackers to manipulate refrigeration parameters and trigger defrost cycles that raised temperatures and spoiled food stock. The incident impacted an estimated 250 to 350 stores belonging to major chains including Intermarchรฉ, Carrefour Market, Leclerc, and others. Paris prosecutors have opened a large-scale investigation into the attack and associated damages, including potential fires. The root cause traces to outdated software on internet-exposed OT management interfaces, with multiple CVEs enabling authentication bypass and remote code execution. Thousands of similar Danfoss systems remain publicly accessible worldwide, highlighting persistent OT exposure risks. Immediate remediation steps include closing web consoles, enforcing VPN access, and applying updates to versions 4.2 and 4.3.1 or later.
Three Zero-Days Chained in Ivanti Connect Secure Grant Root Access Without Login
An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure to execute commands as root without authentication. The compromised appliance was running the fully patched version 22.8R2.4 when exploitation began on October 3. Volexity discovered the intrusion, attributed the activity to UTA0576 with low confidence in criminal rather than espionage motives, and reported the flaws to the vendor. Ivanti acknowledged limited in-the-wild exploitation on October 13. The first two issues, an authentication bypass and remote code execution, were combined under CVE-2026-104935 with a CVSS score of 8.6, allowing code execution as the cgi-server user. A third privilege-escalation flaw then elevated access to root. The final flaw lacked a patch at disclosure time, with a fix promised in an upcoming release. CISA classified the exploitation as active with total technical impact.
CTEM Without the Hype: Understanding Gartner's Continuous Threat Exposure Management Framework
The article explains the evolution of vulnerability management from basic scheduled scanning to risk-based approaches and finally to Continuous Threat Exposure Management (CTEM). It positions CTEM as a comprehensive program introduced by Gartner in 2022 that integrates asset management, EASM, CAASM, automated pentesting, and business-context prioritization. The five-stage cycle of Scoping, Discovery, Prioritization, Validation, and Mobilization is detailed with practical examples such as protecting customer databases in an e-commerce environment. Gartner predicts organizations prioritizing CTEM will suffer three times fewer breaches by 2026, though only 16% have reached operational maturity. The piece also covers common implementation pitfalls and the emergence of the first Magic Quadrant for Exposure Assessment Platforms featuring vendors like Tenable, Qualys, and Rapid7.
Microsoft Patches Over 1,400 Vulnerabilities in October 2026 Security Update, Some Already Exploited
Microsoft released its October 2026 Patch Tuesday updates on October 13, 2026, addressing a total of 1,407 CVEs plus one additional advisory. The update covers a wide range of issues including 315 remote code execution flaws, 673 privilege escalation vulnerabilities, and 252 information disclosure problems. Severity ratings show 78 vulnerabilities classified as Critical and 1,329 as Important. Several of the addressed flaws have already been confirmed as exploited in the wild. The release aligns with the regular second Tuesday of the month schedule for coordinated vendor patching. Related security advisories from other vendors were also highlighted in the same reporting cycle.
Google Chrome Update Patches 37 Vulnerabilities Including Seven Critical Flaws
Google has released a security update for its Chrome browser that addresses 37 vulnerabilities across Windows, macOS, and Linux platforms. Seven of the issues are rated Critical, the highest severity level, while 29 are rated High and one is rated Medium. The update brings Chrome to versions 155.0.8059.80 on Windows and macOS and 155.0.8059.79 on Linux and macOS. Among the critical fixes is a buffer overflow in the ANGLE graphics component tracked as CVE-2026-110152, plus six Use After Free flaws affecting Browser, PDF, Network, Core, SVG, and Media components. The High-severity issues primarily involve Use After Free problems in V8, WebRTC, PDF, DOM, and Media. The single Medium issue is also included in the advisory.
Ivanti Connect Secure VPN Hit by Zero-Day Authentication Bypass Vulnerability CVE-2026-104935
Ivanti has disclosed a critical authentication bypass vulnerability in its Ivanti Connect Secure remote access product that allows remote attackers to execute arbitrary commands without authentication. The flaw, tracked as CVE-2026-104935, carries a CVSSv3.0 base score of 8.6 and has already been exploited in the wild against certain customer environments. Affected versions include 25.1.2.2, 25.1.1.1, and 22.8R2.4 along with earlier releases in those branches, while versions 22.7R2.14 and prior remain unaffected. Ivanti discovered the issue through its product security program and released the fix in version 25.1.3.0 during July. The company published its security advisory on October 13, 2026, confirming active exploitation of the zero-day in unpatched branches.
NICT Warns of A2B Attacks Where Reverse-Engineered Android Apps Expose Vulnerable Backend Servers
Japan's National Institute of Information and Communications Technology (NICT) has issued an alert on A2B attacks, in which publicly available Android apps are reverse-engineered to identify and target their backend servers. The technique, called App-to-Backend Attack, allows threat actors to discover internal server endpoints even when organizations do not publish connection details. Once identified, attackers exploit vulnerabilities, weak authentication, or misconfigured APIs on those servers, leading to unauthorized access and data theft. NICT notes that multiple recent membership-service breaches in Japan stem from this vector rather than flaws in the mobile apps themselves. The institute urges developers and operators to harden backend infrastructure, conduct thorough compromise assessments, and apply proper access controls. Related incidents include unauthorized access to Lawson ID services, Yakiniku King app member data, and Japan Post's postal app.
From HFT to Infosec: How AI Accelerates the Developer-Hacker Arms Race
An experienced security researcher draws a parallel between high-frequency trading evolution and modern vulnerability research, showing how artificial intelligence compresses the time between patch release and working exploit. The author describes the classic workflow where developer Rob fixes buffer overflows in an FTP server while researcher Dave reverse-engineers the diff to locate the exact change. With AI assistance, both sides now generate patches or exploits in minutes rather than days or weeks. The piece highlights that publishing a patch effectively discloses the location of the flaw, allowing automated tools to produce reliable exploits almost instantly. Historical examples such as wu-ftpd CVEs and the EternalBlue/MS17-010 worm illustrate how quickly mass exploitation follows disclosure. The author warns that open-source projects face an existential dilemma: withhold patches and leave users exposed, or release them and trigger immediate automated scanning. Recommendations include mandatory back-porting of fixes and wider use of runtime protections, yet the overall outlook remains pessimistic about the coming wave of fully automated attacks.
Ghost Assets in Vulnerability Management: How Identification, Merging and Asset History Eliminate Anomalies in MaxPatrol VM
Positive Technologies experts explain how infrastructure changes create duplicate, merged and phantom assets that distort vulnerability management. The article details three core mechanisms inside MaxPatrol VM: unique asset identification across scan sources, non-destructive merging of new and existing data, and full lifecycle history with configurable aging policies. It describes how the system distinguishes assets using prioritized keys such as system ID, FQDN, MAC address and VM ID, then applies recursive merging rules that respect multiple data sources. Policies allow teams to set freshness and obsolescence thresholds, automatically hiding assets after 90 days while preserving historical snapshots for PDQL queries. The piece also covers practical cloning and partial-scan scenarios that can produce misleading duplicates or lingering collections.
GreyNoise Detects Active Exploitation Attempts of CVE-2021-36260 Against Hikvision Cameras
GreyNoise recorded exploitation attempts targeting CVE-2021-36260 in Hikvision cameras and recorders between September 21 and October 1. The vulnerability carries a CVSS score of 9.8 and allows unauthenticated remote command execution through insufficient input validation in the embedded web server. Attack traffic originated from four IP addresses, three routed through a commercial VPN in Lithuania and one from a Ukrainian residential network, with all targets located in Ukraine. Attackers leveraged a publicly available Nuclei template to probe devices, though GreyNoise confirmed only scanning activity and not successful compromises. The five-year-old flaw remains actively scanned despite an available firmware patch from Hikvision and a CISA advisory recommending immediate updates. Password changes provide no protection because the attack requires no authentication. Defenders are advised to apply firmware updates, remove devices from public internet exposure, and segment video surveillance networks from critical infrastructure.
Splunk Enterprise Discloses 46 Vulnerabilities Including Critical Patroni Authentication Flaw
Splunk has published three security advisories detailing a total of 46 vulnerabilities affecting Splunk Enterprise and related components. Three of the issues were rated critical, with CVE-2026-76268 receiving a CVSS v3.1 base score of 9.8. The flaw resides in the Patroni REST API used for PostgreSQL cluster management within search head clusters, allowing unauthenticated remote attackers to execute arbitrary operating system commands. Another high-severity issue, CVE-2026-76266, enables local privilege escalation to root on Linux systems during package updates. The remaining vulnerabilities cover product code, internally identified problems, and third-party packages. Organizations are urged to apply the available patches promptly.
Smart Fish Tank Power Strip Server Breached, Killing Aquarium Fish During National Day Holiday
During China's National Day holiday, the cloud servers of Woda Technology's smart power strips for fish tanks were compromised by malicious hackers, causing widespread remote disconnections and power outages for user devices. The attack left heating rods, oxygen pumps, and circulation systems offline for hours, resulting in the deaths of koi, arowana, and other ornamental fish that users had maintained for years. Woda issued a public notice confirming the intrusion was not a product defect or user error but a deliberate network attack, and the company has since upgraded firewalls, added multi-layer cloud protections, deployed backup servers, and improved local offline logic to prevent future failures. The incident highlights a critical IoT design flaw where devices rely entirely on vendor cloud platforms for control, allowing attackers who breach the server to remotely manage household appliances at scale. Security experts note that the same architecture is used across smart speakers, locks, cameras, and other consumer devices, creating a broad attack surface with minimal updates or segmentation. Woda has reported the case to authorities and preserved logs for forensic investigation.
CISA Adds Five Actively Exploited Vulnerabilities in Apache Struts, BIND, ProFTPD, Strapi and ONLYOFFICE Docs to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, confirming active exploitation in the wild. The affected products include Apache Struts, BIND, ProFTPD, Strapi, and ONLYOFFICE Docs, with CVEs issued between 2015 and 2023. Federal agencies have until October 11, 2026, to apply mitigations or remove affected systems. One highlighted issue, Strapi CVE-2023-22894, stems from plaintext storage of sensitive information, allowing authenticated attackers to extract user data via query filters. When combined with CVE-2023-22621, the flaws enable remote code execution. CISA also warned that some impacted products may no longer receive vendor support.
FBI Issues Alert on Active FortiBleed Campaign Harvesting Credentials from Exposed FortiGate Firewalls
The FBI and United States Secret Service have issued a joint alert regarding the FortiBleed campaign, an ongoing operation that targets internet-exposed FortiGate firewalls and SSL VPN gateways. Attackers have already collected 86,644 valid credentials from devices across 194 countries as of June 19, demonstrating the global scale of the indiscriminate scanning effort. The campaign relies on reused or previously leaked credentials combined with legacy SHA-256 password storage that enables offline cracking. Operators employ automated credential stuffing, the Go-based FortigateSniffer tool capable of intercepting 24 authentication protocols, and GPU-accelerated password cracking. Once inside, attackers create unauthorized administrator accounts and often delete legitimate ones, forcing victims to perform full device recovery rather than simple password resets. The activity was first documented in June, with the official alert released on October 7, confirming that scanning continues.
Cisco Patches 14 Vulnerabilities in NX-OS Software, Four Rated Critical
Cisco Systems has released security updates addressing 14 vulnerabilities in its Cisco NX-OS Software used in network devices. Four of the seven security advisories published on October 7, 2026, are rated Critical, while three are rated Medium. Several critical issues affect the Cisco Nexus 3000 Series and Nexus 9000 Series switches, impacting features such as NGOAM, MPLS OAM, and the NX-API management interface. Seven vulnerabilities received CVSSv3.1 base scores of 9.0 or higher, with multiple flaws enabling remote code execution as root or denial-of-service conditions. Specific CVEs including CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 stem from input validation failures in the NGOAM feature and may require SRv6 or NV Overlay configurations to be exploitable. The advisories also cover control plane denial-of-service issues, Python sandbox escapes, and endpoint group contract bypasses in ACI mode.
HPE Networking ClearPass Policy Manager Hit by 28 Vulnerabilities Including 10 Rated Critical
Hewlett Packard Enterprise has disclosed 28 vulnerabilities in its HPE Networking ClearPass Policy Manager product and released security updates to address them. The issues span the web management interface, APIs, endpoint agents, and client software components. Ten of the flaws received a Critical severity rating. Notable issues include SQL injection, multiple authentication bypasses, unsafe deserialization leading to remote code execution, and path traversal. No public exploit code or active discussions were observed at the time the advisory was published on October 6, 2026. The company urges customers to apply the available patches promptly.
Attackers Exploit Critical Atlassian Data Center Flaw CVE-2026-21589 Hours After PoC Release
Exploitation attempts against CVE-2026-21589 began almost immediately after technical details and a Nuclei template were published. The vulnerability allows unauthenticated arbitrary file read in multiple Atlassian Data Center products and carries a CVSS v4.0 score of 9.3. In environments integrated with Crowd, attackers who obtain crowd.properties can extract plaintext credentials and escalate to administrator privileges via the Crowd API. The flaw stems from improper handling of double-colon sequences in a shared web resource library, enabling path traversal against plugin resource endpoints. Affected products include Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian urges immediate patching outside normal cycles and recommends WAF rules or Tomcat RewriteValve configurations to block traversal patterns. Organizations should also review access logs for double-decoded URLs containing .., /, \, or :: sequences.
LibreOffice and Apache OpenOffice Flaw Enables Remote Code Execution via Malicious Calc Tables Without Macro Warnings
Researchers have demonstrated an attack against LibreOffice and Apache OpenOffice users that executes arbitrary Java code simply by opening a malicious spreadsheet, without requiring macro permissions or triggering any security prompts. The vulnerability requires Java support to be enabled in the office suite and exploits legitimate features in the Calc component that automatically fetch data from external database sources. When a crafted document is opened, Calc loads a linked database file that references a malicious Java driver, allowing the attackerโs code to run inside the office process. LibreOffice has already patched the issue tracked as CVE-2026-63277 with the release of versions 26.2.5 and 26.8.0 on October 5, while Apache OpenOffice remains vulnerable up to version 4.1.16 under CVE-2026-59265 with a fix expected in 4.1.17. The attack chain works on both Windows and Linux and bypasses macro protections entirely because no user consent dialog appears. Although only a proof-of-concept exploit that launches the calculator has been published so far, the same technique can execute any Java payload. Users of OpenOffice are advised to disable Java or avoid untrusted files until the patch is available.
Atlassian Fixes Critical Path Traversal Flaw CVE-2026-21589 Exposing Files in Jira and Confluence
Atlassian has patched CVE-2026-21589, a CVSS 9.3 path traversal vulnerability that allows unauthenticated attackers to read files across eight products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye in Data Center editions. The flaw accepts manipulated paths where traversal sequences appear adjacent to forward slashes, backslashes or double colons, including URL-encoded variants. Attackers must know the exact file name and path because the vulnerability does not permit directory listing and is restricted to the web application root directory of each product. Configuration files located in predictable locations remain accessible to attackers familiar with the products. Patches have been released in specific versions such as Bitbucket 10.5.1, Confluence 10.2.19, Jira Software and Jira Service Management 11.3.12, Bamboo 12.1.12, Crowd 7.2.4 and Crucible and Fisheye 4.9.15. Atlassian found no evidence of exploitation in its cloud products, though the advisory does not address on-premises customer installations.
Apache Struts CVE-2026-104711 Enables Remote Code Execution via Legacy RESTful Mapper
Apache Struts has patched four vulnerabilities, one of which permits unauthenticated remote code execution through an OGNL injection flaw. The issue, tracked as CVE-2026-104711, only affects applications that still rely on the legacy RESTful mapper; modern configurations using the default mapper, restful2, or the official Struts REST plugin remain unaffected. Exploitation occurs when the legacy mapper extracts action names and parameters directly from the URL, allowing attackers to inject malicious OGNL expressions. Vulnerable releases span 2.0.0โ2.3.37, 2.5.0โ2.5.33, 6.0.0โ6.11.0, and 7.0.0โ7.3.0, with fixes available in 6.12.0 and 7.4.0. The remaining three flaws impact availability or cause cross-request data leakage but do not lead to code execution, and only one received an โimportantโ severity rating.
Automated Pentesting and BAS: How AI Systems Like XBOW Outpace Human Researchers in Vulnerability Discovery
The article explores how automated penetration testing and Breach and Attack Simulation tools have evolved to provide continuous validation of security controls beyond annual manual pentests. It explains the distinction between BAS, which tests individual attack techniques against security tools using frameworks like MITRE ATT&CK, and autopentest solutions that build complete attack paths to critical assets. Russian vendor Positive Technologies released PT Dephaze 3.0 in October 2025, incorporating machine learning for controlled internal pentesting and earning the National Runet Award. Globally, AI-driven systems demonstrated superior performance, with XBOW topping HackerOne rankings by discovering over 1,000 vulnerabilities including 54 critical ones in just 90 days. Googleโs Big Sleep project, combining DeepMind and Project Zero, identified and helped patch CVE-2025-6965 in SQLite before widespread exploitation. These developments underscore the need to integrate automated validation into vulnerability management processes under the emerging CTEM framework.
Critical SSRF Vulnerability Affects SonicWall SMA1000 Series Remote Access Appliances
SonicWall has disclosed four vulnerabilities in its SMA1000 series remote access products, with one rated critical. The most severe issue, CVE-2026-102255, is a server-side request forgery flaw in the WorkPlace interface that allows unauthenticated attackers to abuse the appliance as a forward proxy and reach internal functions. The vulnerability received the maximum CVSSv3.0 base score of 10.0. Two additional flaws, CVE-2026-102256 and CVE-2026-102257, enable authenticated OS command injection and unauthenticated path traversal via crafted archives, respectively. No exploitation has been observed in the wild at the time of disclosure. SonicWall has released updates to address all issues.
WordPress 7.1.3 Security Release Fixes Seven Vulnerabilities Including Stored XSS and SQL Injection
The WordPress development team has released version 7.1.3 as a maintenance and security update addressing multiple vulnerabilities. The release includes seven security fixes and four additional bug corrections. Among the security issues resolved is a stored cross-site scripting flaw that allowed pending comments to execute scripts in the administrative interface. Other fixes cover a denial-of-service condition in URL handling, an SQL injection vulnerability in the WXR export feature, and unauthorized disclosure of comments attached to private or unpublished posts. Additional patches address an XSS issue in the Imgur embed functionality, improper sticky post permissions for users with the Author role, and a parameter manipulation problem affecting hook action names.
Google Releases Chrome 155 Fixing 247 Vulnerabilities Including Four Critical Use-After-Free Flaws
Google has released Chrome 155 on October 6, 2026, addressing a total of 247 security issues across Windows, macOS, and Linux platforms. The update includes four critical vulnerabilities, all classified as use-after-free flaws that affect Chromecast, Browser, Navigation, and Track components. Fifty-three high-severity issues were also resolved, covering problems in SiteIsolation, Core, Omnibox, FileSystem, ANGLE, WebGL, and multiple other modules. The critical CVEs fixed are CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347. Additional fixes address use-after-free conditions, race conditions, type confusion, and integer overflows in V8, WebRTC, PDF, Media, Parser, Storage, and WebAudio. The new versions are Chrome 155.0.8059.40 for Windows and macOS and 155.0.8059.39 for Linux and macOS.
LibreOffice and Apache OpenOffice Flaws Enable Remote Code Execution via Malicious Spreadsheets Without Macro Warnings
Two vulnerabilities, CVE-2026-63277 in LibreOffice Calc and CVE-2026-59265 in Apache OpenOffice, allow attackers to execute arbitrary code simply by tricking users into opening specially crafted spreadsheet files. The flaws exploit Java integration and class path handling, bypassing traditional macro security prompts entirely. LibreOffice has already released fixes in versions 26.2.5 and 26.8.0 that restrict class path entries to local file URLs only. Apache OpenOffice 4.1.16 and earlier remain vulnerable, with the stable patch expected in 4.1.17; interim mitigation requires disabling Java integration. The issues highlight risks in office suites that process untrusted documents containing external data connections or JDBC references. Organizations are advised to enforce least-privilege execution and avoid opening files from unknown sources until patches are applied.
Web Application Vulnerabilities Surge as AI-Driven Development Outpaces Security Testing
The number of vulnerabilities in web applications continues to grow each quarter, driven in part by the rapid adoption of artificial intelligence in software development pipelines. While integrating AI tools boosts productivity and shortens release cycles, many organizations fail to match this speed with equivalent security testing and validation processes. As a result, increasing amounts of code reach production environments without ever being assessed from an attackerโs perspective. Cybercriminals have quickly recognized this gap, exploiting repeated flaw patterns in applications that skip security reviews. The article emphasizes that pentesting must become a recurring part of the development cycle, conducted weekly or monthly to match the pace of updates. Continuous security testing allows teams to identify and remediate issues before they can be weaponized. Developing rapidly with AI is not inherently risky, but releasing unvalidated code transforms speed into exposure.
Microsoft Fixes CVE-2026-96940 in Exchange Server Allowing Authenticated Mailbox Access
Microsoft has patched CVE-2026-96940, a CVSS 8.8 vulnerability in Exchange Server that lets any authenticated user read other users' mailboxes without administrative rights. The flaw exposes full message content and attachments including contracts, spreadsheets, and sensitive documents. Affected on-premises versions include Exchange Server Subscription Edition RTM, Exchange 2016 CU23, Exchange 2019 CU15, and Exchange 2019 CU14. Exchange Online users are protected because the fix was applied server-side. Microsoft rates exploitation as likely but reports no confirmed attacks in the wild at disclosure time. The issue turns a single low-privilege credential into broad access to executive, legal, and financial correspondence.
New Spectre-v2 Variant Uses JIT Compiler Branch Target Reuse for Cross-Process Data Extraction
Researchers from the Netherlands and Italy have published a paper detailing a fresh Spectre-v2 attack that reuses branch predictor state instead of injecting new instructions. The technique leverages the JIT compiler cBPF inside the Linux kernel to train the branch target predictor, enabling speculative execution that leaks sensitive data such as hashed root passwords. Practical demonstrations extracted credentials from the su process in an average of three to five minutes on AMD, Intel, and ARM processors. Partial success was shown with SpiderMonkey in Firefox and GraalVM, although realistic end-to-end attacks were not achieved with those engines. The work also covers additional topics including forensic detection of attacks against 1C servers, a record Debian Linux kernel patch set, zero-day fixes in TeamViewer and Apple Core Graphics, and critical flaws in Dell Container Storage Modules.
Critical CVE-2026-21589 Affects Eight Atlassian Products with CVSS 9.3 Score
Atlassian has disclosed a critical vulnerability tracked as CVE-2026-21589 that impacts eight of its products. The flaw allows unauthenticated access to specific files located in the web application's root directory when an attacker already knows the file name and path. Products affected include Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian rates the issue Critical with a CVSSv4.0 base score of 9.3 and warns that Data Center editions face elevated risk due to potential exposure of sensitive files. The company released patches for all affected products and urges immediate updates, while also providing mitigation steps and indicators of compromise for organizations unable to patch right away.
Fortinet Releases FortiMail Updates to Patch Zero-Day CVE-2026-104286
Fortinet has begun distributing updates for its FortiMail email security product to address the zero-day vulnerability CVE-2026-104286. The flaw allows unauthenticated attackers to write arbitrary files to the system by sending specially crafted HTTP requests. The company first published a security advisory on October 1, 2026, confirming active exploitation and providing Indicators of Compromise while preparing fixes. On October 5, 2026, Fortinet updated the advisory and released patched versions including FortiMail 8.0.2, 7.6.7, and 7.4.9. Organizations still running the 7.2 branch are advised to migrate to the 7.4 branch or later to obtain protection. The advisory reference is FG-IR-26-175.
Critical CVE-2026-61500 in Rejetto HFS Allows Admin Session Forgery Leading to Remote Code Execution
A critical vulnerability tracked as CVE-2026-61500 is being actively exploited in Rejetto HTTP File Server (HFS), enabling unauthenticated attackers to forge administrator sessions and achieve remote code execution. The flaw impacts versions 3.0.0 through 3.2.0 and was addressed in release 3.2.1, making immediate updates essential for any internet-exposed instances. The root cause lies in the use of JavaScript Math.random() to generate the session cookie signing key instead of a cryptographically secure random number generator. Attackers can reconstruct the internal state of this weak PRNG from login responses, allowing them to create valid admin cookies. Once authenticated as an administrator, the attacker can abuse the server_code functionality to execute arbitrary JavaScript on the server. Exploitation activity was first observed on October 1, 2026, targeting U.S. systems and attributed to an unidentified actor based in China, following the public release of a Python proof-of-concept in late September.
Dell Patches Six Critical Flaws in Container Storage Modules for Kubernetes
Dell has fixed six vulnerabilities in its Container Storage Modules that integrate storage systems with Kubernetes clusters. Two of the issues received the maximum CVSS score of 10.0, allowing remote unauthenticated attackers to obtain full administrative credentials for registered storage backends. Additional flaws enable privilege escalation to root on cluster nodes, exposure of hardcoded credentials, and leakage of Kubernetes secrets across the entire cluster. All versions prior to 1.17.0 are affected, with the fixes delivered in version 1.18.0. No workarounds exist, and Dell recommends rotating JWT signing keys after applying the update because the previous keys must be considered compromised.
Critical Sandbox Bypass Flaw in GitLab AI Gateway Enables Remote Command Execution
GitLab has released patches for a critical vulnerability in its GitLab AI Gateway component that allows authenticated users to bypass sandbox restrictions and execute arbitrary commands. The flaw, tracked as CVE-2026-90970, resides in the custom flow prompt template processing of the Duo Agent Platform and carries a CVSS v3.1 base score of 9.9. Self-hosted deployments are affected, while GitLabโs own hosted AI Gateway service has already been updated. The company urges immediate upgrades to versions 19.4.1, 19.3.2, or 19.2.4. The vulnerability can be triggered under specific conditions by users with access to the Duo Agent Platform through crafted flow configurations.
WebPros Releases Critical Patches for Three Vulnerabilities in cPanel & WHM
WebPros International has published security updates addressing three critical vulnerabilities in its cPanel & WHM hosting management platform. All three issues received the highest severity rating of Critical. The flaws include CVE-2026-93698, an input validation weakness in the Multilang adminbin component that could allow root-level operating system command execution. Two additional stored cross-site scripting vulnerabilities were also fixed, one of which is CVE-2026-93697 affecting the Mass Modify Accounts interface in WHM. Successful exploitation of the XSS flaws could let low-privileged accounts hijack administrator sessions. The updates were made available on September 29, 2026, and carry CVSS v3.0 base scores reaching 9.9.
Top Cybersecurity Stories: SharePoint Exploits Warned by US Authorities, Citrix and WordPress Flaws Lead Weekly Rankings
Security NEXT has published its weekly ranking of the most viewed articles from September 27 to October 3, 2026, highlighting critical vulnerability disclosures and confirmed exploitation cases. US authorities issued warnings about active exploitation of five vulnerabilities affecting SharePoint and WordPress. Citrix NetScaler received multiple vulnerability advisories with two flaws already confirmed as exploited in the wild. Apple released iOS 26.7.1 to address vulnerabilities potentially used in targeted attacks against specific individuals. Other notable incidents include a personal data breach at Times Car car-sharing service and a ransomware attack impacting Keio Electric Railway operations.
Google Releases Chrome Update Fixing 11 Vulnerabilities Including Critical WebGL Flaw
Google has issued an update for its Chrome browser that addresses 11 security vulnerabilities across Windows, macOS, and Linux platforms. The release includes Chrome 154.0.8037.98 and 154.0.8037.97 for Windows and macOS, along with version 154.0.8037.97 for Linux. One vulnerability, CVE-2026-103628, received a Critical rating due to an out-of-bounds memory write in WebGL that was originally reported in August. Nine additional issues rated High severity affect components such as FileSystem, Compositing, Skia, FedCM, SVG, MediaStream, and WebRTC, including a buffer overflow tracked as CVE-2026-103631. The update also resolves a type confusion flaw in the V8 scripting engine and one Medium-severity issue. Google plans a gradual rollout over the coming days and weeks.
Browser Built on Mistakes: How Real-World Attacks Shaped Modern Browser Defenses
Browser security features such as process isolation, sandboxing, and restrictions on code execution were not designed in isolation but evolved directly in response to concrete attacks over more than a decade. Early threats like malicious Flash advertisements in 2015 demonstrated how a single compromised banner could compromise an entire system, prompting the industry to phase out plugins entirely. Later discoveries, including the Spectre vulnerability, forced browsers to implement stricter site isolation and timing-attack mitigations that remain in place today. Session hijacking and malicious browser extensions further drove the adoption of stronger cookie protections and permission models. BI.ZONE analysts trace this history through specific incidents to show why current architectures prioritize separation of sites into distinct processes. The resulting design reduces the blast radius of any single exploit and continues to adapt as new attack classes emerge.
cKEV Index Launches to Prioritize Vulnerabilities as AI Accelerates Exploit Development
CyberOK has introduced the open cKEV Index, a catalog of high-priority vulnerabilities ranked by the Urgent Patch Score (UPS) methodology. The index incorporates timelines of events such as exploit publication, proof-of-concept releases, and confirmed attacks to help organizations prioritize patching under resource constraints. It addresses the growing gap between rapid AI-assisted vulnerability discovery and slower remediation processes at both vendors and customers. Examples from Anthropic reports highlight how threat actors used AI agents for reconnaissance, code analysis, and exploit development against Android apps and web applications. Microsoft and Oracle have publicly linked increased vulnerability findings and larger patch releases to AI tooling. The UPS framework defines progressive phases from Radar to Emergency/IR, allowing teams to act on strong signals without waiting for full confirmation. An open version of the catalog is now available with detailed event histories for Urgent Patch and Emergency stages.
Apache HTTP Server 2.4.69 Patches 20 Vulnerabilities Including CVSS 9.8 Issues
The Apache HTTP Server development team released version 2.4.69 on October 1, 2026, addressing a total of 20 vulnerabilities. While the Apache Security Team assessed most issues as moderate or low in impact, several vulnerabilities received CVSS base scores as high as 9.8. The update includes fixes for stack-based buffer overflows, use-after-free conditions, and out-of-bounds writes affecting multiple modules. No vulnerabilities were rated Critical or Important by the developers, with five classified as Moderate and fifteen as Low. Specific fixes cover the mod_vhost_alias, mod_http2, mod_dav, and mod_dav_fs modules, along with Windows-specific path handling problems.
BrokenPipe PoC Exploits Steam Client Service for Silent SYSTEM Privilege Escalation on Windows
A new proof-of-concept named BrokenPipe demonstrates how a standard Windows user can escalate privileges to NT AUTHORITY\SYSTEM through the Steam Client Service without requiring administrator credentials or triggering a UAC prompt. The vulnerability stems from insufficient signature validation in VDF installation scripts processed by steamservice.exe, allowing an attacker to control the execution path of a malicious script. The issue affects Steam version 10.96.30.42 on both Windows 10 and Windows 11, though no public CVE has been assigned yet. Valve was notified of the flaw in March, several months prior to public disclosure. The attack is strictly local and requires initial code execution under a standard user account, making it relevant for shared or corporate environments. Security teams are advised to inventory Steam installations, apply application allowlisting, and monitor for anomalous SYSTEM-level processes linked to the service while awaiting an official patch.
WatchGuard Fireware OS Affected by 15 Vulnerabilities Including Critical CVE-2026-86131
WatchGuard Technologies disclosed 15 vulnerabilities in Fireware OS, the operating system powering its UTM appliances. The advisories were published between September 29 and 30, 2026, covering issues that range from remote code execution and authorization bypass to file disclosure and denial of service. Impact varies by deployment, yet none of the flaws had been observed in active exploitation at disclosure time. The most severe finding, CVE-2026-86131 in BOVPN Over TLS, received a CVSS v4.0 base score of 9.2 and Critical rating. This code-injection flaw in client configuration handling allows an attacker who controls the VPN server to execute arbitrary commands with root privileges on the connecting Firebox device. The remaining vulnerabilities affect multiple components and are tracked under separate CVE identifiers listed in the official advisories.
Rust Researcher Builds AI Pipeline to Test 900 Vulnerability Hypotheses Across Crates and Linux Kernel
Sergey Gordeychik developed the rust-in-peace research harness that combines multiple LLM agents, traditional SAST tools, and dynamic verification to hunt for memory-safety, logic, and API misuse issues in Rust code. The system generates independent hypotheses, attempts to refute them with separate agents, then validates survivors through fuzzing, protocol tests, or container execution. Starting from the Damn Vulnerable Rust Application, the pipeline was expanded to popular crates including x509-parser, h2, and lopdf, ultimately producing a Linux kernel patch. Experiments showed that three parallel analysis passes yielded 20 confirmed findings after triage, with nine appearing in all passes. The work also highlighted how models can produce convincing but false positives when context such as dependency checks or call order is missing. Gordeychik presented the approach at ZeroNights under the title Rust in Peace: How to Raise Your Own Pet Mythos.
Critical Zero-Day Vulnerability in FortiMail Allows Unauthenticated File Writes
Fortinet disclosed a critical zero-day vulnerability in its FortiMail email security product that is already being exploited in attacks. The flaw, tracked as CVE-2026-104286, affects the graphical user interface component and stems from improper sanitization of path traversal and NULL byte sequences. Attackers can craft malicious HTTP requests to write arbitrary files to the system without authentication. The vulnerability received a CVSS v3.1 base score of 9.8, classifying it as Critical. Fortinet discovered the issue internally but has also received reports of active exploitation. Planned patches include FortiMail 8.0.2, 7.6.7, and 7.4.9, while users on the 7.2 branch are advised to migrate to 7.4 or later.
Six Months After tun0 Leak: Which Android VPN Clients Fixed Server Address Exposure and Which Ignored It
A detailed investigation reveals that Android VPN clients suffer from two distinct server address leaks when split tunneling is enabled. The first leak, tied to an unprotected local SOCKS proxy on 127.0.0.1, was quickly mitigated by most Xray and sing-box based clients through random ports and passwords. The second, more persistent leak allows excluded applications to bind sockets directly to the tun0 interface and discover the VPN server IP without root or special permissions. Only TeapodStream and OlConnect implemented owner-UID checks using ConnectivityManager.getConnectionOwnerUid, yet both initially mishandled the INVALID_UID response returned for excluded apps. AmneziaVPN has unmerged pull requests that correctly reject unknown owners, while sing-box offers a manual package_name_regex rule. v2rayNG closed the report as not planned, and major clients including WireGuard for Android, Mullvad, Proton VPN and others have issued no statements.
Part 2: How Third-Party Developers Closed the tun0 Leak in AmneziaVPN on Android
Third-party contributors to AmneziaVPN have detailed their fix for a VPN tunnel bypass affecting excluded applications on Android. The vulnerability allows any app, even those disallowed from the VPN, to bind sockets directly to the tun0 interface using SO_BINDTODEVICE and thereby discover the VPN server address. The team implemented a packet filter inside the client that queries Android via ConnectivityManager.getConnectionOwnerUid to determine packet ownership and drops traffic from unknown UIDs. The solution was integrated into both the Xray and AmneziaWG traffic paths, with the AmneziaWG hook placed inside amneziawg-go after packet parsing. Testing with leak_probe.py showed zero successful bypass attempts out of six methods when the filter was active, compared to six out of six without it. The developers submitted three pull requests and released a side-loaded test build, while noting remaining limitations such as raw sockets and tethering scenarios.
Cisco Confirms Active Exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager
Cisco has confirmed that the critical vulnerability CVE-2026-76504 in Catalyst SD-WAN Manager has been exploited in attacks throughout September. The flaw carries a CVSS score of 9.8 and allows attackers to gain full administrator access without any credentials by bypassing API authentication through malformed URI encoding. The issue affects the login session handling mechanism, enabling forged requests to grant netadmin privileges by default. Similar URI manipulation techniques were observed earlier this month in Oracle PeopleSoft attacks. Patches are available across multiple release trains including 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, while older installations must migrate to supported versions. Cisco recommends restricting access to trusted hosts and placing the Manager behind firewalls until updates are applied. The vulnerability was discovered during routine support operations and verified by Cisco's Product Security Incident Response Team.
Zero-Days in PaperCut MF Chained to Compromise Active Directory in Education Sector
Analysts at eSentire investigated an attack that chained two zero-days in PaperCut MF, tracked as CVE-2026-81578 and CVE-2026-82078, to move from an internet-exposed print server to a domain controller in an education sector client in under two days. Attackers gained initial access through the card or badge query field, delivering malicious Java code that allowed unauthenticated configuration changes and arbitrary bytecode execution on version 24.0.2. The first stage loader reassembled payload fragments in memory, launched the next stage, and deleted its own files while remaining compatible with multiple Tomcat versions. A web shell followed, accepting commands via a custom HTTP header, reading configurations, and erasing log traces while positioning itself early in the request processing chain. The command-and-control implant was AdaptixC2, hidden inside a modified Microsoft Copilot binary downloaded from Alibaba Cloud infrastructure. Privilege escalation was achieved without passwords by locating a domain-privileged service account, stealing its access token, and relaunching the implant under those rights. On the domain controller the payload arrived via administrative share and was executed by modifying the Windows PlugPlay service, after which the legitimate path was restored to minimize traces. The operators extracted credentials from memory and registry, enabled Restricted Admin mode, used an NTLM hash for RDP access, and copied the full Active Directory database containing passwords for all domain accounts.
Apache WSS4J Library Addresses Seven Vulnerabilities Including Authentication Bypass Flaws
The Apache WSS4J library, used to apply WS-Security to SOAP messages in Java environments, has received updates fixing seven vulnerabilities. The development team disclosed multiple security advisories on September 30, 2026, covering the issues. Three vulnerabilities received an Important severity rating: CVE-2026-88920, CVE-2026-89238, and CVE-2026-95616. CVE-2026-88920 allows authentication bypass in the DOM security processor by injecting attacker-controlled keys into crafted unsigned sender-vouches SAML assertions. CVE-2026-89238 stems from improper handling of encryption headers, enabling attackers to force plaintext elements to be treated as decrypted headers and bypass security policies. The remaining four vulnerabilities were also resolved in the same coordinated update release.
US Authorities Warn of Active Exploitation of Apple CoreGraphics and Cisco SD-WAN Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two newly identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-86950 affects Apple iOS, iPadOS, and macOS through a flaw in the CoreGraphics framework that allows out-of-bounds memory writes and potential arbitrary code execution. CVE-2026-76504 impacts Cisco Catalyst SD-WAN Manager, enabling unauthenticated attackers to gain administrative access due to improper URI encoding handling in the API. Federal agencies must remediate both issues within three days of their respective catalog additions. CISA also requires organizations to check for signs of compromise in addition to applying patches. The alerts highlight ongoing risks to widely deployed Apple operating systems and enterprise SD-WAN infrastructure.
Cisco Patches Critical Zero-Day Authentication Bypass in Catalyst SD-WAN Manager
Cisco Systems has released security updates to address a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager that allows attackers to bypass authentication and gain remote administrator access. The flaw, tracked as CVE-2026-76504, stems from improper URI encoding handling in HTTP requests targeting specific APIs. With a CVSS v3.1 base score of 9.8, the issue is rated Critical and has already been exploited in real-world attacks confirmed by Cisco in September 2026. The company published its security advisory on September 30, 2026, and strongly recommends immediate updates to the fixed releases. Organizations are also advised to restrict API access to trusted sources while applying the patches.
Hackers Exploit Two Critical Citrix NetScaler Zero-Days to Deploy Web Shells and Enable Lateral Movement
Two critical zero-day vulnerabilities in Citrix NetScaler, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited in the wild to achieve unauthenticated remote code execution. Attackers deploy password-protected PHP web shells such as WHIPSHOT and use the Python-based SLAPSHOT tunneling tool for lateral movement inside targeted networks. The flaws affect NetScaler ADC and NetScaler Gateway appliances with default configurations, and one requires DTLS enabled on VPN vServers. Citrix has released patches for versions 13.1-64.23 and 14.1-73.37, while CISA added the issues to its KEV catalog with a September 30, 2026 remediation deadline for U.S. federal agencies. Organizations are advised to hunt for indicators including modified httpd.conf entries, anomalous setuid permissions on /bin/sh, and suspicious files in /var/netscaler/logon/LogonPoint/custom before applying updates.
Critical Vulnerability CVE-2026-12342 Allows Remote Code Execution in SailPoint IdentityIQ
SailPoint has disclosed a critical vulnerability in its identity management product IdentityIQ that stems from insufficient input validation in the web service API. The flaw, identified as CVE-2026-12342, permits an attacker on an adjacent network to execute arbitrary code on the IdentityIQ server without requiring authentication. The vulnerability received a CVSSv3.1 base score of 9.6 and is rated Critical. SailPoint published a security advisory on September 28, 2026, and has released patches for all supported affected versions. The company also plans to include the fix in future patch levels. The issue affects the processing of content sent to the web service API, where improper validation allows malicious input to trigger code execution.
WatchGuard Patches Critical API Flaws in Access Points Allowing Unauthenticated Command Execution
WatchGuard has released firmware version 3.4.8 to address three vulnerabilities affecting its access points, two of which are rated critical. The most severe issues, CVE-2026-86102 and CVE-2026-101891, both scored 9.3 on the CVSS scale and reside in the internal API management service. These flaws permit unauthenticated attackers with network access to execute arbitrary shell commands or bypass access controls without requiring any credentials or valid sessions. A third vulnerability, CVE-2026-87969 with a CVSS score of 8.6, involves command injection through the command-line diagnostic interface but requires authenticated administrator privileges. All firmware versions from 1.0 through 3.4.7 are impacted. The vulnerabilities were disclosed on September 28 with no evidence of active exploitation or public proof-of-concept code available at the time. A compromised access point could serve as an internal foothold for further network attacks due to its visibility into corporate traffic.
Spectre Variant Returns: Branch Target Reuse Attack Extracts Root Password Hash from Linux Memory
Researchers from VUSec and Scuola Superiore SantโAnna have disclosed Branch Target Reuse, a new Spectre v2 variant that exploits stale branch predictor entries in modern CPUs. The attack targets JIT compilers that generate and reuse executable code at runtime, allowing speculative execution of instructions from previously freed memory regions. On Intel systems with existing mitigations enabled, the researchers demonstrated extraction of the root password hash from the Linux kernel in minutes. Practical proof-of-concept exploits were developed against the Linux kernel, while PoCs were also prepared for Firefox and tested on GraalVM. The issue affects Intel, AMD, and Arm processors, although exploitation success depends on the specific JIT environment and predictor state. Defenses have already been merged into the Linux kernel and GraalVM, while Mozilla continues work on site isolation. The findings highlight that Spectre-class issues remain relevant as long as processors rely on aggressive speculative execution.
EASM Uncovers Forgotten Perimeter Assets Including 11-Year-Old Servers Invisible to Standard Scanners
EASM solutions continuously discover external attack surfaces by starting from public data such as company names, domains, WHOIS records, Certificate Transparency logs, and internet-wide scanners like Shodan and Censys. Unlike traditional vulnerability scanners that only check assets from a predefined list, EASM maps unknown shadow IT including forgotten test servers, abandoned marketing subdomains, exposed APIs, and cloud buckets left open to the internet. The technology follows the same reconnaissance path used by attackers and has become essential for mature vulnerability management programs after years of being considered exotic. Major vendors including Palo Alto Networks Cortex Xpanse, CyCognito, Qualys, Rapid7, and Tenable now lead the market, while Russian providers such as Positive Technologies PT EASM, BI.ZONE EASM, and CyberOK PenOps have grown rapidly since 2022. Without an established process for prioritization and remediation, EASM implementations risk generating overwhelming alert volumes rather than reducing risk. The approach is now viewed as a core component of Continuous Threat Exposure Management (CTEM) frameworks.
Mozilla Releases Firefox 157 with 76 Security Fixes, Shifts to Individual CVE Reporting
Mozilla Foundation has released Firefox 157, addressing 76 vulnerabilities rated at various severity levels. The update also includes patches for the extended support releases Firefox ESR 153.4, ESR 140.17, and ESR 115.42. A key change in this release involves Mozilla's new approach to publishing security advisories, moving from grouping multiple memory safety issues under single CVEs to reporting them individually. Among the high-severity issues fixed are sandbox escape flaws, privilege escalation bugs, use-after-free errors, uninitialized memory problems, and JIT compiler mistakes affecting components such as DOM, Graphics, WebGPU, WebAssembly, and Networking. The ESR versions received 62, 43, and 31 fixes respectively, with 34 rated high in the latest branch. All listed CVEs range from CVE-2026-100756 through CVE-2026-100831.
Recon in Bug Bounty: Spotting Anomalies Instead of Chasing Known Vulnerability Patterns
The article explains that effective reconnaissance in Bug Bounty programs goes far beyond automated subdomain enumeration with tools like subfinder or httpx. It emphasizes building a mental model of the target application by analyzing policy documents, infrastructure changes via Censys and Shodan, and identifying behavioral anomalies rather than matching textbook vulnerability patterns. A detailed case study describes how a hidden legacy endpoint on ibm.com was discovered during passive and active reconnaissance, leading to the identification of a time-based Blind SQL Injection vulnerability confirmed with sqlmap. The author stresses that recon is a continuous process involving hypothesis testing, understanding service trust boundaries, and evaluating real security impact for triage teams. Practical advice includes reviewing HackerOne reports for context, maintaining motivation through interesting targets, and revisiting programs as infrastructure evolves. The piece also covers how JavaScript analysis and direct endpoint interaction help map authorization flows and weak links between microservices.
Google Releases Chrome Security Update Fixing 32 Vulnerabilities Including One Critical Flaw
Google has issued a security update for its Chrome browser that addresses a total of 32 vulnerabilities across Windows, macOS, and Linux platforms. One vulnerability is rated Critical, while 25 are rated High, one Medium, and five Low. The Critical issue, tracked as CVE-2026-102331, is a buffer overflow in the ANGLE graphics component that was reported externally on August 24. High-severity fixes cover multiple type confusion and buffer overflow problems in the V8 JavaScript engine, use-after-free flaws in Bluetooth, Views, Passwords, FullScreen, and PictureInPicture, plus uninitialized resource handling in GPU and WebGPU. Additional High issues include out-of-bounds writes in GPU, out-of-bounds reads in WebGL, cross-site scripting in WebUI, UI display problems in Omnibox, and permission management weaknesses in Mojo. The update ships as Chrome 154.0.8037.93 and 154.0.8037.92 for Windows and macOS and 154.0.8037.92 for Linux, with gradual rollout over the coming days and weeks.
Automated Scans Exploit CVE-2026-39364 in Exposed Vite Dev Servers to Steal AWS and Azure Secrets
A large-scale automated campaign is actively scanning the internet for publicly exposed Vite development servers to exfiltrate sensitive files and cloud credentials. Attackers leverage CVE-2026-39364 to bypass server.fs.deny restrictions and read arbitrary files using crafted query parameters such as ?raw combined with ?import. The campaign has generated thousands of requests over several weeks, with telemetry from honeypots recording 807 sessions and roughly 32,000 events in a single month. Targets include .env files, terraform.tfstate, and other infrastructure-as-code artifacts that often contain AWS access keys and Microsoft Azure tokens. The vulnerable versions are Vite 7.1.0 through versions prior to 7.3.2 and Vite 8.x prior to 8.0.5. Part of the scanning traffic originates from Google Cloud IP ranges 34.x and 35.x. Organizations are urged to update immediately, restrict the dev server to localhost, and rotate any exposed cloud credentials.
cKEV Index Launches to Prioritize Vulnerabilities Using Urgent Patch Score Methodology
CyberOK has introduced the open cKEV Index, a catalog of high-priority vulnerabilities based on the Urgent Patch Score (UPS) framework that tracks signals such as exploit publication and confirmed attacks. The index addresses the growing gap between accelerated vulnerability discovery powered by AI and the slower pace of patching, testing, and deployment in real environments. It incorporates timelines from sources including Anthropic reports on AI-assisted campaigns GTG-50014 and GTG-50029, the rust-in-peace framework, Microsoft Exchange Server Subscription Edition delays, and Oracleโs record 1,434 CVE fixes. UPS defines progressive phases from Radar to Emergency/IR, allowing teams to link specific events like PoC releases or CISA KEV additions to concrete actions under resource constraints. Research using 2025 CISA KEV data shows that early signals enable 35โ53% of patches to be completed before official exploitation confirmation. The public version displays only Urgent Patch and Emergency stages with event histories, while full data and API access are available to CyberOK customers.