Daily Threat Briefing — 2026-10-14
53 findings37 articles6 sections
- Critical findings
- 0
- High findings
- 0
- New since 06:03 UTC
- 0
- CISA KEV additions
- 0
- First seen in this period
- 37 Articles1,468 CVEs2,807 IOCs
First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severityNewLive update, section VulnerabilitiesSource: KEV
- Critical severityNewLive update, section VulnerabilitiesSource: KEV
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
- Critical severityNewCisco patches new Secure Email Gateway zero-day exploited in attacks (opens the source in a new tab)Live update, section VulnerabilitiesSource: RSS
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
- Critical severityNewLive update, section VulnerabilitiesSource: CVE
Executive summary · as of 06:03 UTC
The situation
The window is dominated by Microsoft's record October 2026 Patch Tuesday. It fixes 1,411 flaws, including one actively exploited and two publicly disclosed zero-days, alongside critical unauthenticated network RCEs in OpenSSH for Windows, Windows Error Reporting, Text Shaping and Outlook. CISA added two entries to KEV on 2026-10-13. The first is an Ivanti Connect Secure authentication bypass (CVE-2026-104935) that Ivanti confirms is exploited as a zero-day and that allows unauthenticated command execution. The second is a Windows Shell command-injection security feature bypass (CVE-2026-96951). Patch edge VPN gateways first, then Windows endpoints and Outlook. Adobe (ColdFusion, AEM, Commerce), SAP (maximum-severity OAuth2 SSRF), Ghostscript, Docker Hub and several container/CI platforms also shipped critical fixes. NVD published 1,468 CVEs in the window, of which 40 were reviewed here.
On the threat side, ransomware leak-site activity was heavy. HYFLOCK posted nine victims, including Ecuador's national police headquarters. Wallstreet posted eleven, mostly Swedish firms plus elder-care providers. Everest claimed KVH, Laerdal and Topcon Healthcare. Major disruptive incidents hit retail and healthcare: Ahold Delhaize stores in the US and Benelux, TFG London's Hobbs/Whistles/Phase Eight brands, and Ampath Laboratories, where ByteToBreach claims 80 million patient records were taken. A cyberattack on French supermarket refrigeration controls also caused physical spoilage. North Korean operators are reply-bait phishing Ukrainian policy experts, while DOJ raided more than 40 Texas residences tied to DPRK laptop farms.
abuse.ch logged 2,747 new indicators across 127 families. The Vidar infostealer dominated with 1,013 indicators, followed by an unattributed loader cluster, Mirai/Mozi/Aisuru IoT botnets and ClearFake fake-update injections. Publicly exploitable Wavlink and TRENDnet router bugs published this window will likely feed those IoT botnets. Other trends worth tracking: credential theft and MFA coverage gaps, third-party compromise (Unit 42's bank case, UK Housing Ombudsman), and supply-chain tampering, notably implanted Ledger wallets sold through a Southeast Asian reseller.
Live updates
16 updates since 06:03 UTC
Zero-click 'SneakPeek' flaw in Claude Code Desktop preview pane can silently steal developer SSH keys, AWS credentials and OAuth tokens
- Source: RSSVulnerabilities
Researchers disclosed 'SneakPeek', a zero-click bug in Claude Code Desktop's preview pane that lets adversaries silently exfiltrate developer secrets, including SSH private keys, AWS credentials and Claude OAuth tokens. Organisations using Claude Code Desktop should apply vendor updates when available, review developer endpoints for credential exposure, and consider rotating keys and tokens stored on affected workstations.
- Medium severitySuspected OLVX cybercrime market administrator arrested in North Macedonia (opens the source in a new tab)Source: RSSThreat Actors
North Macedonia's Interior Ministry and the FBI announced the arrest of the suspected administrator of the OLVX cybercrime market following a raid on a home in a North Macedonian village. The action may disrupt access to goods and services traded on the platform.
- Low severityBrooklyn DA takes down servers behind crypto scam targeting Russian speakers (opens the source in a new tab)Source: RSSThreat Actors
The Brooklyn District Attorney's office took down servers and domains tied to a cryptocurrency fraud scheme targeting Russian-speaking residents. The operation followed tips from community members that began three years ago.
CISA adds actively exploited PAN-OS root code-injection flaw CVE-2026-0322 to KEV, alongside Cisco SEG and AhsayCBS bugs
- Critical severityPalo Alto Networks PAN-OS code injection (CVE-2026-0322) added to CISA KEV (opens the source in a new tab)Source: KEVVulnerabilities
CVE-2026-0322, a PAN-OS code injection flaw, was newly added to CISA KEV, confirming in-the-wild exploitation. It lets an authenticated attacker with network access run arbitrary code as root on the firewall. Prioritise patching, restrict management-plane exposure and review firewall logs for anomalous admin activity; ransomware use is unknown.
- Critical severityAhsayCBS auth bypass and command injection chain (CVE-2026-105133/105134) added to CISA KEV (opens the source in a new tab)Source: KEVVulnerabilities
CISA newly added two chainable AhsayCBS flaws to KEV. CVE-2026-105133 is an authentication bypass via the 'random' parameter in the API checkSysPwd function, and CVE-2026-105134 is OS command injection in the Replication Receiver /rps/api/json/UpdateReceivers.do endpoint. Chained, they enable unauthenticated remote command execution on backup servers. Patch and restrict exposure of AhsayCBS instances.
- High severityCisco Secure Email Gateway path traversal (CVE-2026-76519) newly added to CISA KEV (opens the source in a new tab)Source: KEVVulnerabilities
Following earlier coverage of Cisco's patch for the exploited Secure Email Gateway zero-day, CISA has now added CVE-2026-76519 to KEV. The relative path traversal lets an unauthenticated remote attacker write arbitrary files on the underlying OS. Federal patch deadlines now apply, so confirm SEG appliances are updated and check for unexpected file writes.
Public exploit for CVSS 10 OS command injection in D-Link DIR-868L HNAP handler (CVE-2026-110536)
- Critical severityD-Link DIR-868L HNAP command injection with public exploit (CVE-2026-110536, CVSS 10) (opens the source in a new tab)Source: CVEVulnerabilities
Unauthenticated remote OS command injection through the SOAPACTION argument in the HNAP CGI handler (/htdocs/cgibin) of D-Link DIR-868L firmware 2.01b05, rated CVSS 10. The exploit has been disclosed publicly. Exposed devices should be isolated or replaced, and logs should be reviewed for anomalous HNAP requests.
Juniper discloses a large batch of critical Junos OS flaws, including unauthenticated J-Web root takeover bugs
- High severityJuniper Junos rpd BGP/BMP/flowspec overflows enable root code execution (opens the source in a new tab)Source: CVEVulnerabilities
Several stack-based buffer overflows in the Junos routing protocol daemon (rpd) allow root code execution on Junos OS, or rpd crashes on Evolved, via crafted BGP, BMP, flowspec or EVPN-VPWS advertisements: CVE-2026-33789 (unauthenticated BGP peer with BMP enabled), CVE-2026-33796, CVE-2026-101982, CVE-2026-101990 and CVE-2026-102178. Most require a configured peer; review BGP peering trust, BMP and flowspec usage, and patch.
- Critical severityJuniper SRX GRE and MX IKE flaws allow unauthenticated root RCE (opens the source in a new tab)Source: CVEVulnerabilities
CVE-2026-33792 lets an unauthenticated attacker execute code as root in srxpfe on SRX Series via a crafted packet on a configured GRE tunnel. CVE-2026-102182 allows unauthenticated root code execution in kmd on MX Series via IKE certificate-based packets. Related flaws: CVE-2026-102175 (sdxd heap overflow via SDX/SRC connection), CVE-2026-102031 (TACACS+ command injection to root on Evolved) and CVE-2026-101980 (Extended Echo kernel DoS). Prioritise internet-facing SRX/MX VPN and GRE endpoints.
- Critical severitye107 CMS: CVSS 10 login SQL injection and installer deserialization RCE (opens the source in a new tab)Source: CVEVulnerabilities
e107 before 2.3.7 has two critical flaws. CVE-2026-55572 (CVSS 10) is a login SQL injection in the alt_auth plugin's otherdb and e107db backends. CVE-2026-55573 (CVSS 9.8) is PHP object injection through unserialize() in install.php, which remains reachable after installation. Upgrade to 2.3.7 and remove or restrict install.php.
- High severityHestia Control Panel injection via custom document root (CVE-2026-108390) (opens the source in a new tab)Source: CVEVulnerabilities
CVE-2026-108390 (CVSS 9.9) affects Hestia Control Panel 1.9.7 through 1.10.4. update_object_value() in func/main.sh fails to escape single quotes when writing a custom document root to web.conf, letting a low-privileged authenticated user inject content. This is a likely privilege escalation path on shared hosting servers.
- High severityKEDA Vault auth flaw enables cross-tenant credential theft (CVE-2026-77524) (opens the source in a new tab)Source: CVEVulnerabilities
CVE-2026-77524 (CVSS 9.9) affects KEDA 2.20.2 and earlier. A namespace admin can point a TriggerAuthentication's hashiCorpVault.address at an attacker-controlled endpoint using Kubernetes auth, potentially leaking the KEDA operator's service account token and breaking tenant isolation. Upgrade KEDA and restrict who can create TriggerAuthentication resources.
- High severityLantronix XPress-DR device servers: unauthenticated config overwrite on UDP/30718 (opens the source in a new tab)Source: CVEVulnerabilities
CVE-2026-109439 (CVSS 9.8) affects Lantronix XPress-DR and XPress-DR-I firmware through 8.1.0.0. Attackers can remotely read and persistently overwrite device configuration via the unauthenticated UDP configuration protocol on port 30718. Block UDP/30718 at network boundaries and segment these industrial device servers.
Cisco patches another actively exploited Secure Email Gateway zero-day enabling unauthenticated root command execution
- Critical severityCisco patches new Secure Email Gateway zero-day exploited in attacks (opens the source in a new tab)Source: RSSVulnerabilities
Cisco has patched another actively exploited zero-day in its Secure Email Gateway (SEG). The flaw lets remote, unauthenticated attackers execute commands with root privileges. Prioritise patching internet-facing SEG appliances and review them for signs of compromise, since exploitation predates the fix.
- High severityLedger halts wallet sales across seven Asian markets over device tampering (opens the source in a new tab)Source: RSSThreat Actors
Update to the previously reported Ledger hardware-implant story: Ledger has asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and pull devices from shelves while it investigates tampering. The move suggests the tampered-device supply-chain issue may be broader than individual resold units. Organisations holding crypto assets on wallets bought through these channels should treat them as untrusted.
- Medium severityPoland: spyware vendor had access to data harvested by former government (opens the source in a new tab)Source: RSSPolicy
Polish Prime Minister Donald Tusk said the spyware manufacturer had access to data harvested during the previous government's surveillance operation. Tusk described the operation as one of the biggest scandals in Polish history since the fall of communism. The finding raises concerns about vendor-side access to state surveillance data.
INC Ransom leaks 1.53 TB from Brazilian lender H2 Financiamento, including client ID documents and bank statements
- High severityINC Ransom claims 1.53 TB leak from Brazilian lender H2 Financiamento (opens the source in a new tab)Source: BreachData Breaches & Leaks
INC Ransom has listed Brazilian lender H2 Financiamento (h2financiamento.com.br) and claims a full leak of 1.53 TB, roughly 3.6 million files. The group says the data includes client passports and ID cards, driver licences, CPF numbers, birth certificates, risk assessments, bank statements and tax invoices, creating a high risk of identity fraud for affected customers.
- High severityQilin claims Joliet Public Schools District 86 (Illinois) (opens the source in a new tab)Source: BreachData Breaches & Leaks
Qilin has added Joliet Public Schools District 86 (Illinois, joliet86.org) to its leak site; no data details have been published yet. In the same batch the group also listed MOA Architecture (moaarch.com).
- Source: BreachData Breaches & Leaks
Wallstreet has claimed Green Clinic, a community healthcare provider in Ruston, Louisiana, whose services include primary care, pharmacy, laboratory and imaging; the provider has published a cybersecurity notice. The group also listed US refuse-truck manufacturer E-Z Pack Trucks, which extends its activity beyond the Swedish victims reported earlier.
- Medium severityLockBit 5 lists French municipality Saint-Pierre-des-Corps among four new victims (opens the source in a new tab)Source: BreachData Breaches & Leaks
LockBit 5 posted a batch of four victims. They are the French municipality Saint-Pierre-des-Corps, Santorini hotel group Kord Hotels (Greece), Thai contact-centre operator SKY CC and Australian accounting firm Poole Group.
Critical unauthenticated Gitea Org-mode file-read flaw (CVE-2026-59774, CVSS 9.8) can expose server-side files and secrets
UK sanctions Cryptomus, a crypto payment platform tied to ransomware and Russian sanctions evasion
- Medium severityUK sanctions Cryptomus over Russian money laundering and ransomware payments (opens the source in a new tab)Source: RSSPolicy
The UK has imposed economic sanctions on Cryptomus, a cryptocurrency payment platform that experts describe as a major conduit for ransomware, narcotics, darknet-market, fraud and cybercrime-service payments that help Russia circumvent financial restrictions. Organisations should check whether ransom-negotiation and payment workflows touch sanctioned entities.
- Source: RSSData Breaches & Leaks
Japan faces a ransomware attack that has disrupted hundreds of organisations, alongside a series of separate breaches putting millions of customer records at risk. Experts flag stolen Japanese driver's licence data among the exposed information, which raises identity-fraud risk.
- Medium severityMicrosoft details Storm-2990 phishing-kit operators and Storm-3119 marketplace (opens the source in a new tab)Source: RSSThreat Actors
Microsoft published details on a Chinese-language cybercriminal ecosystem behind large-scale phishing. It tracks the phishing-kit operators as Storm-2990 and an illicit marketplace selling phishing tools and infrastructure as Storm-3119, and says the disruption involved law enforcement agencies. This adds actor tracking names and infrastructure detail to the previously reported global phishing takedown.
Chrome 155.0.8059.79 fixes multiple critical sandbox-escape flaws; TR7 ASP appliances get unauthenticated command-injection fixes
International law enforcement disrupts phishing ecosystem behind more than 1 billion malicious messages to 75,000+ organizations
- High severityGlobal takedown disrupts network behind 1 billion phishing messages (opens the source in a new tab)Source: RSSThreat Actors
Law enforcement agencies and partners disrupted a cybercriminal ecosystem behind more than one billion malicious messages that targeted over 75,000 organizations in 150 countries. SOC teams should watch for takedown-related IOC releases and for shifts in phishing volume as operators migrate infrastructure.
- Medium severityRussian travel platform Anywayanyday halts bookings after cyberattack (opens the source in a new tab)Source: RSSData Breaches & Leaks
Russian travel booking site Anywayanyday suspended ticket and hotel reservations while it responded to a cyberattack. The attacker, intrusion vector and any data exposure have not been disclosed.
- Medium severityAI-enabled Russian influence operation targets Latin America (opens the source in a new tab)Source: RSSThreat Actors
An AI-enabled Russian influence operation is targeting Latin America. It uses spoofed emails, fabricated government documents and a front local organization to reach schools in Peru and Ecuador, among other targets. Education and government entities in the region should scrutinize unsolicited official-looking correspondence.
Critical unauthenticated stored XSS in JTL-Shop consent endpoint (CVE-2026-103904, CVSS 9.3) threatens admin backends
- High severityJTL-Shop unauthenticated stored XSS via consent endpoint (CVE-2026-103904, CVSS 9.3) (opens the source in a new tab)Source: CVEVulnerabilities
JTL-Shop's public consent endpoint accepts arbitrary consent names from unauthenticated visitors without validating them against configured consent items. These values are stored in consent statistics and rendered without output encoding in the administration backend, enabling stored XSS that executes in administrator sessions. E-commerce operators running JTL-Shop should apply vendor fixes and review consent statistics for injected script content.
Extortion group n0n threatens to leak data from 38 shipping, port and logistics firms unless ransoms are paid by October 19
- Source: RSSThreat Actors
SOCRadar reports that the extortion group n0n has added 38 shipping, port and logistics organisations to its leak site and demanded multimillion-dollar ransoms by October 19. This expands earlier N0n leak-site activity into a concentrated campaign against the maritime and logistics sector. Organisations in this sector should check for exposure and monitor for data publication.
- Medium severityFake Calendly 'Meta Careers' pages harvest Facebook and Google logins despite 2FA (opens the source in a new tab)Source: RSSTools & Techniques
A phishing campaign sends fake Meta interview invitations that lead to spoofed Calendly 'Meta Careers' scheduling pages. These pages harvest Facebook and Google credentials, and the theft succeeds even when two-factor authentication is enabled. Phishing-resistant MFA and session-token monitoring are recommended.
Microsoft confirms recent Windows updates can break non-admin Remote Desktop access when Administrator protection is enabled
- Low severityRecent Windows updates may break Remote Desktop for non-admin users (opens the source in a new tab)Source: RSSVulnerabilities
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates when the "Administrator protection" feature is enabled. Teams deploying the October 2026 Patch Tuesday fixes should expect possible RDP access failures and avoid treating them as an intrusion or misconfiguration.
Aurora ransomware group claims Estrategias BigMat (Spain), leaking years of employee payroll files
- High severityAurora ransomware claims BigMat Spain, alleges theft of SEPA payroll files (opens the source in a new tab)Source: BreachData Breaches & Leaks
The Aurora ransomware group has listed Estrategias BigMat S.L.U., the Spanish master franchisee of the BigMat International building-materials distribution network. The group claims to hold 624 SEPA payroll XML files from 2022 to 2025, covering monthly salary payments for 300–500 employees across more than 15 entities. Such files typically contain names and bank account details, which raises the risk of payroll-diversion fraud and targeted phishing against affected staff.
ANY.RUN tracks fake Claude, ChatGPT and Copilot tools delivering infostealers and session hijacking to US companies
- High severityCounterfeit AI tools (Claude, ChatGPT, Copilot) spread infostealers to US businesses (opens the source in a new tab)Source: RSSMalware
ANY.RUN researchers documented campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini and other AI brands to deliver infostealers, hijack browser sessions and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were linked to the activity, with US companies a primary target. Organisations should restrict installation of unvetted AI tools, monitor for lookalike AI-branded domains and installers, and treat session-token theft as a credential compromise.
Critical CVSS 10 authentication bypass disclosed in WMS MobileServer (CVE-2026-89309)
- Critical severityWMS MobileServer authentication bypass (CVE-2026-89309, CVSS 10) (opens the source in a new tab)Source: CVEVulnerabilities
WMS MobileServer's authorization middleware requires an Authorization header only for GET and HEAD requests. Requests using any other HTTP method are processed without authentication, and a second bypass case also exists. Rated CVSS 3.1 10.0; restrict network exposure of MobileServer and review access logs for unauthenticated non-GET requests.
- Critical severityT-SQL injection allows arbitrary SQL execution (CVE-2026-89310, CVSS 9.9) (opens the source in a new tab)Source: CVEVulnerabilities
A request-body parameter is inserted into a T-SQL statement without parameterization or escaping. This lets a remote attacker execute arbitrary SQL in the context of the application's database account. Rated CVSS 3.1 9.9; the NVD description excerpt does not name the affected product.
- Critical severitySimpleForm WordPress plugin unauthenticated privilege escalation (CVE-2026-104748) (opens the source in a new tab)Source: CVEVulnerabilities
The SimpleForm WordPress plugin, up to and including version 3.10.0, exposes the unauthenticated AJAX action 'wp_ajax_nopriv_simpleform_wp_register' without any capability check on role assignment. This enables unauthenticated privilege escalation. Rated CVSS 9.8; update or disable the plugin and audit for newly created administrator accounts.
Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.
Browse the full briefing
53 findings · 6 sections- 7 critical
- 23 high
- 16 medium
- 4 low
- 3 info
- Vulnerabilities15 findingsVulnerabilities & Exploitation6 critical · 8 high · 1 medium
- Data Breaches & Leaks12 findingsData Breaches & Leaks1 critical · 8 high · 3 medium
- Malware9 findingsMalware & Indicators5 high · 4 medium
- Threat Actors6 findingsThreat Actors & Law Enforcement2 high · 3 medium · 1 low
- Tools & Techniques7 findingsTools, Techniques & Research3 medium · 1 low · 3 info
- Policy4 findingsPolicy, Regulation & Enforcement2 medium · 2 low
Vulnerabilities & Exploitation
Two KEV additions (Ivanti Connect Secure, Windows Shell) and a record Microsoft Patch Tuesday headline the window. They are followed by critical Adobe, SAP, Ghostscript, Docker Hub, container-platform and WordPress plugin flaws. NVD published 1,468 CVEs in the window; only the 40 most severe were reviewed.
- Critical severityIvanti Connect Secure zero-day CVE-2026-104935 exploited, added to CISA KEV (opens the source in a new tab)
CISA added this flaw to KEV on 2026-10-13. It is an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands on Ivanti Connect Secure gateways. Ivanti confirmed in-the-wild zero-day exploitation and urged immediate patching. Ransomware use: unknown. Steps: patch immediately, run Ivanti's integrity checker, and hunt for unexpected processes, new admin accounts and web shells on ICS appliances. Rotate any credentials and session secrets that passed through the gateway.
- Critical severityWindows Shell command injection CVE-2026-96951 added to CISA KEV (opens the source in a new tab)
Added to CISA KEV on 2026-10-13, the same day as Patch Tuesday. A command injection flaw in Windows Shell lets an unauthorized attacker bypass a security feature over a network. Ransomware use: unknown. Prioritise the October cumulative updates on internet-exposed and user endpoints. Monitor for anomalous Explorer- or shell-spawned command interpreters.
- Critical severityMicrosoft October 2026 Patch Tuesday: 1,411 flaws, 3 zero-days (opens the source in a new tab)
Microsoft's October 2026 release fixes a record 1,411 vulnerabilities, well above September's record of roughly 1,000. It includes one actively exploited and two publicly disclosed zero-days. Dark Reading highlights security feature bypasses and unauthenticated RCEs among them. Related updates: Windows 10 ESU KB5126657 and Windows 11 KB5127648/KB5126653.
- Critical severityCritical unauthenticated RCEs in OpenSSH for Windows, Windows components and Outlook (opens the source in a new tab)
Several CVSS 9.8 bugs in this release are network-exploitable without authentication: - CVE-2026-97816: use-after-free in OpenSSH for Windows. - CVE-2026-97815: heap overflow in Windows Error Reporting. - CVE-2026-97814: heap overflow in Windows Text Shaping. - CVE-2026-97805: out-of-bounds read in the Windows Partition Management Driver. - CVE-2026-97749 and CVE-2026-97016: double-free and heap overflow in Microsoft Office Outlook. Prioritise hosts exposing OpenSSH for Windows, and Outlook clients.
- Critical severityAdobe ColdFusion: multiple CVSS 10 unauthenticated RCE/SSRF flaws (opens the source in a new tab)
Adobe ColdFusion received multiple CVSS 10 fixes, none requiring user interaction: - CVE-2026-106624: code injection. - CVE-2026-106622: SSRF with scope change leading to privilege escalation. - CVE-2026-105899: unrestricted file upload leading to code execution. Low-privileged code execution is also possible via CVE-2026-106612 and CVE-2026-105903 (CVSS 9.9). ColdFusion is a historical exploitation favourite. Patch internet-facing servers urgently and hunt for unexpected .cfm/.jsp files in web roots.
- Critical severityAdobe Experience Manager and Commerce critical RCEs (opens the source in a new tab)
Adobe Experience Manager has three CVSS 10 incorrect-authorization flaws (CVE-2026-90532, CVE-2026-48383, CVE-2026-48382) enabling arbitrary code execution without user interaction. Further AEM fixes cover CVE-2026-75732, CVE-2026-105895 and the OS command injection CVE-2026-103848 (CVSS 9.9). Adobe Commerce has a CVSS 10 template-injection RCE (CVE-2026-103849). E-commerce and CMS instances should be patched promptly.
Source: CVE - High severityMsQuic RCE and ASP.NET Core / .NET security bypass advisories (opens the source in a new tab)
GitHub advisories accompany the Patch Tuesday fixes: - CVE-2026-105016 (CVSS 9.8): Microsoft QUIC (MsQuic) RCE. - CVE-2026-88092 (CVSS 9.4) and CVE-2026-70188 (CVSS 9.1): ASP.NET Core security feature bypasses. - Multiple CVSS 8.8 .NET/Visual Studio and ASP.NET Core Blazor WebAssembly RCEs, e.g. CVE-2026-96230 and CVE-2026-102870. - Several DoS bugs in System.Security.Cryptography.Xml and Pkcs. Rebuild and redeploy self-contained apps; patching the OS alone will not fix bundled runtimes.
Source: CVE - High severityGhostscript CVE-2026-39919 enables server takeover via PDF uploads (opens the source in a new tab)
CVE-2026-39919 is a critical heap buffer overflow in the Ghostscript interpreter. It enables remote code execution via crafted PDFs, exposing any server-side pipeline that processes uploaded documents: thumbnailers, converters, mail gateways and ImageMagick front-ends. Update Ghostscript and sandbox document-conversion workers.
- High severityDocker Hub flaw CVE-2026-105445 allowed user impersonation and image tampering (opens the source in a new tab)
CVE-2026-105445 in Docker Hub allowed attackers holding a personal access token to access other users' container repositories, enabling impersonation and image tampering. Docker has fixed the issue server-side. Review repository audit logs for unexpected pushes, verify image digests and signatures, and rotate PATs.
- High severitySAP patches maximum-severity OAuth2 SSRF in Cloud SDK for Python (opens the source in a new tab)
SAP's October 2026 updates fix 20 flaws. The most serious is a maximum-severity OAuth2 server-side request forgery in the SAP Cloud SDK for Python. Update the SDK dependency in applications built on it.
Source: RSS - High severityIvanti Neurons Patch for Intune and Xtraction credential-leak flaws (opens the source in a new tab)
Beyond the KEV-listed Connect Secure bug, Ivanti disclosed two more flaws: - CVE-2026-109412 (CVSS 9.9): an exposed endpoint in Ivanti Neurons Patch for Intune leaks authentication material to authenticated attackers. - CVE-2026-106042 (CVSS 9.9): Ivanti Xtraction before 2026.4 can be made to redirect requests to an attacker endpoint, exposing EPMM connector credentials. Patch both and rotate the affected credentials.
Source: CVE - High severityContainer and CI/CD platform flaws: Podman, Argo CD, NVIDIA AIStore, Dockhand (opens the source in a new tab)
Critical flaws hit container and GitOps platforms: - Podman CVE-2026-94603 (CVSS 10, versions 4.4.0 up to 5.8.8/6.1.3): images carrying a checkpoint annotation silently ignore restrictions such as --cap-drop=ALL. - NVIDIA AIStore CVE-2026-65162 (CVSS 10): host-namespace PodSpec injection. - Dockhand before 1.0.45, CVE-2026-110130 (CVSS 10): authentication bypass on /api routes ending in .js. - Argo CD CVE-2026-77459 (CVSS 9.9): PostDelete hooks bypass AppProject authorization.
- High severityCritical unauthenticated WordPress plugin flaws: file upload, RCE, SQL injection (opens the source in a new tab)
Several WordPress plugins have unauthenticated critical flaws (all CVSS 9.8): - JTL-Connector for WooCommerce ≤2.4.3, CVE-2026-87855: file upload via an empty jtlauth parameter. - AGE-GATE ≤1.0, CVE-2026-104800: RCE. - Snazzy Social Media Feed ≤2.5, CVE-2026-110002: file upload. - Printcart Store ≤2.9.1, CVE-2026-93388: file upload leading to RCE. - Abandoned Cart Pro for WooCommerce ≤10.8.0: SQL injection CVE-2026-97668 and authentication bypass CVE-2026-97657. Expect rapid mass-exploitation; update or disable these plugins.
- High severityPublicly exploitable Wavlink and TRENDnet router flaws (opens the source in a new tab)
Public exploits exist for several router flaws: - Wavlink WL-WN592AX6, CVE-2026-109110: OS command injection in the wmapd daemon. - Wavlink WL-WN530BE1-A, CVE-2026-109109: stack overflow. - Wavlink WL-WN530BE1-A, CVE-2026-109108: command injection. - TRENDnet TEW-432BRP, CVE-2026-109157: stack overflow. These are prime candidates for Mirai/Mozi-family botnet recruitment.
- Medium severityUnauthenticated RCE in Xorbits Xoscar and Samsung QA-Board (opens the source in a new tab)
Other critical (CVSS 9.8) flaws this window: - Xorbits Xoscar ≤0.11.2, CVE-2026-49950: unauthenticated cloudpickle deserialization over the actor-pool TCP channel. - Samsung Open Source QA-Board, CVE-2026-110392: OS command injection. - Omnispace Agora Project, CVE-2026-63146: code injection. Audit AI/ML and internal tooling for exposed services.
Source: CVE
Data Breaches & Leaks
No credential-dump entries with pwnCount or dataClasses were supplied. The largest event is the claimed 80M-record Ampath Laboratories theft, alongside disruptive retail incidents and a high volume of ransomware leak-site postings.
- Critical severityAmpath Laboratories (South Africa): 80 million patient records claimed stolen (opens the source in a new tab)
Threat actor ByteToBreach claims to have exfiltrated more than 80 million patient records from Ampath Laboratories, one of South Africa's largest pathology providers. The claim is not yet verified. If confirmed, it is among the largest health-data breaches in Africa; expect follow-on phishing and fraud against patients.
Source: RSS - High severityAhold Delhaize cyber incident affects US, Dutch and Belgian grocery stores (opens the source in a new tab)
Dutch multinational grocer Ahold Delhaize took precautionary measures after a cybersecurity incident. Stores in the US, Netherlands and Belgium were reportedly impacted. Neither the attack type nor any data exposure has been disclosed.
Source: RSS - High severityTFG London (Hobbs, Whistles, Phase Eight) hit by cyberattack (opens the source in a new tab)
The Foschini Group disclosed a cyberattack on TFG London that disrupted IT systems used by the Phase Eight, Hobbs and Whistles premium fashion brands, leaving some services unavailable. It continues a pattern of attacks on UK retail.
Source: RSS - High severityAttack on French supermarket refrigeration controls causes spoilage and fires (opens the source in a new tab)
An attack on supermarket temperature-control systems in France spoiled food, emptied shelves and led to reports of fires. It highlights cyber-physical risk in building-management and refrigeration OT that is often internet-exposed.
Source: RSS - High severityHYFLOCK ransomware: nine victims incl. Ecuador police headquarters (opens the source in a new tab)
HYFLOCK listed nine victims on 2026-10-13: - Ecuador's National Police General Command (policia.gob.ec) - India: petrochemical maker IGPL, Ocean Beverages - Turkey: pharmaceutical manufacturer Merkezilac - Saudi Arabia: cloud ERP provider Nodhom - Malaysia: YYC Advisors - Brazil: Cooper Tec Solutions - Bangladesh: ISP T Dot Net The spread is broad and opportunistic, with a government law-enforcement victim. No dataClasses were supplied.
Source: Breach - High severityWallstreet ransomware: Swedish firms and elder-care providers (opens the source in a new tab)
Wallstreet posted eleven victims, concentrated in Sweden. They include several Stockholm architecture practices (Ahlqvist & Almqvist, Spectrum, Brunnberg & Forshed, Byrån för Arkitektur och Urbanism), Vendus Sweden, Mantum Holding, Fab Support and Briab Group. Two elder-care providers are also listed: Danvikshem in Sweden and Lambertinum in Germany. The clustering suggests a shared supplier or a regional campaign. No dataClasses were supplied.
Source: Breach - High severityEverest claims KVH, Laerdal and Topcon Healthcare (opens the source in a new tab)
Everest listed three notable victims: satellite-connectivity firm KVH, Norwegian medical-simulation maker Laerdal, and ophthalmic-device maker Topcon Healthcare. Data availability and dataClasses are unspecified.
Source: Breach - High severityQilin claims law firm Iliff, Meredith, Wildberger & Brennan and Golden Legacy Financing (opens the source in a new tab)
Qilin listed two victims: the US law firm Iliff, Meredith, Wildberger & Brennan, P.C., and The Golden Legacy Financing. Law-firm compromises frequently expose third-party client data.
Source: Breach - High severitySarcoma leaks 1.2 TB including PST mailboxes from US victim (opens the source in a new tab)
Sarcoma posted an unnamed US victim with a claimed 1.2 TB leak, including file dumps and PST mailbox archives. Mailbox data implies high exposure of credentials and correspondence.
Source: Breach - Medium severityUK Housing Ombudsman Service: third-party incident hits case management (opens the source in a new tab)
The UK Housing Ombudsman Service is investigating a third-party IT security incident affecting its case management system. It has not yet disclosed whether data was exposed.
Source: RSS - Medium severityLiberating Research (UK) leaked sensitive medical data (opens the source in a new tab)
UpGuard found an exposed data store belonging to UK medical market-research firm Liberating Research. It contained sensitive health information, a misconfiguration exposure rather than an intrusion.
Source: RSS - Medium severityAdditional ransomware claims: DragonForce, INC Ransom, N0n, Nightspire (opens the source in a new tab)
Other leak-site postings this window: - DragonForce: Lane Equipment, a Texas commercial kitchen equipment supplier. - INC Ransom: Great Lakes Institute of Management, India. - N0n: a Brazilian packaging manufacturer. - Nightspire: two partially redacted victims. The window held 53 breach entries in total; 30 were reviewed.
Source: Breach
Malware & Indicators
abuse.ch ingested 2,747 new indicators (2,223 ThreatFox, 524 URLhaus) across 127 families. The Vidar infostealer dominates, followed by loaders, IoT botnets and ClearFake. Separately, a hardware supply-chain implant was found in Ledger wallets.
- High severityVidar infostealer surge: 1,013 indicators
Vidar led ThreatFox with 1,013 new indicators, more than a third of all new indicators. Indicator types are URLs and MD5/SHA1/SHA256 hashes, with threat types botnet_cc and payload. Samples: hxxps://lk[.]6r6r6[.]org/zo/, hxxps://lk[.]6r6r6[.]org/zo, hxxps://vr[.]6r6r6[.]org/x4v. Block the 6r6r6[.]org infrastructure and hunt for browser credential-store access by unsigned binaries.
- High severityMirai, Mozi and Aisuru IoT botnets: 330+ indicators
IoT botnet activity remains high: - Mirai: 160 ThreatFox indicators (hashes, ip:port, domains; payload, C2 and delivery). - Mozi: 98 URLhaus ELF download URLs across MIPS and ARM. - Generic ELF ua-wget droppers: 60. - Aisuru DDoS botnet: 14 C2 indicators. Samples: hxxp://180[.]188[.]142[.]1:24689/bin[.]sh, hxxp://185[.]209[.]162[.]191/mips, 147[.]182[.]144[.]201:8443. Expect newly disclosed router RCEs to be added to these botnets' exploit kits.
- High severityClearFake fake-update injections: 98 indicators
ThreatFox logged 98 ClearFake indicators (domains and URLs; threat type payload_delivery) tied to compromised websites serving fake browser-update lures. The campaign abuses jsDelivr CDN hosting. Samples: 6ah8ena1[.]kulonprogo[.]org, dg0x81sh[.]pattysole[.]com, hxxps://cdn[.]jsdelivr[.]net/gh/19234tr68/77347873-6b60-4931-b4a0/9094-3d24378096e8.
- High severityInfostealers: SalatStealer, AMOS (macOS), WARDENStealer
Several stealer families were active beyond Vidar: - SalatStealer: 70 indicators (hashes, ip:port), e.g. 168[.]222[.]202[.]171:443. - Unknown Stealer: 54 C2 domains, e.g. aafesorder[.]com. - AMOS (macOS): 30 indicators (hashes, URLs, domains), e.g. 4614bb60faf9c9edfac1fa8c90d0c9f939a495cd47bea531142221f6919cabb1. - WARDENStealer: 24 C2 domains. macOS fleets should be included in stealer hunting.
Source: abuse.ch - High severityLedger: hardware implant in resold wallets stole recovery phrases (opens the source in a new tab)
Ledger said wallets sold through a Southeast Asian reseller contained a hardware implant that stole recovery phrases and let outsiders drain funds. This is a hardware supply-chain compromise; buy devices only through official channels.
- Medium severityUnknown Loader: 290 payload-delivery indicators
ThreatFox recorded 290 indicators for an unattributed loader cluster. Indicator types are domains, SHA256 hashes, URLs and ip:port, with threat types payload_delivery and payload. Samples (SHA256): ae4469691c9bbda971428da7a1431e8dbcd4fb0163397fece37c92870aad8694, 8e9293d68f4c72bdf27daec44e64795b0e1af6334da4f78eebb07561f93b9752, d68359ba7d9321f970a7daaca8de51862bffa112c4292cbea5bd3004736c6b81.
Source: abuse.ch - Medium severityCoruna botnet C2: 97 indicators
ThreatFox recorded 97 botnet C2 indicators for Coruna, all domains and ip:port. The infrastructure is largely random-looking .icu domains. Samples: go32ip[.]74rcu0ntwgvtpzn[.]icu, aygjqdr4l2s88zi[.]icu, b031beafd8f3[.]net.
Source: abuse.ch - Medium severityRAT and post-exploitation C2: Remcos, PureRAT, Cobalt Strike, GHOSTBLADE, AsyncRAT
New C2 indicators were logged for several RATs and post-exploitation frameworks: - Remcos: 26 (e.g. namecheaps[.]duckdns[.]org). - PureRAT: 22 (e.g. 162[.]35[.]100[.]156:56001). - GHOSTBLADE: 19 (e.g. sqwas[.]shapelie[.]com). - Cobalt Strike: 18 team servers. - AsyncRAT: 15. Coinminer payload hashes (18) were also logged.
Source: abuse.ch - Medium severityPHP 'shin' webshell delivery via Cloudflare Workers
ThreatFox logged 38 domain indicators (threat type payload_delivery) for the php.shin_webshell family, largely abusing Cloudflare workers.dev subdomains. Samples: indigonan[.]workers[.]dev, fomeweli[.]workers[.]dev, google-proxy-66-102-8-169[.]google[.]com.
Source: abuse.ch
Threat Actors & Law Enforcement
Nation-state activity centres on DPRK: espionage phishing against Ukrainian experts and revenue generation through IT-worker fraud. Hacktivist DDoS against Russian infrastructure and escalating ransomware coercion are also noted. No seizure events were recorded in the window.
- High severityNorth Korean hackers phish Ukrainian experts for war intelligence (opens the source in a new tab)
DPRK operators are targeting Ukrainian experts in diplomacy, security and international policy with reply-bait phishing that opens a conversation before any malicious content is sent. The apparent goal is intelligence on the war, given Pyongyang's military cooperation with Russia. Policy and think-tank organisations should brief staff on unsolicited expert-outreach emails.
- High severityDOJ raids DPRK laptop farms in Texas; two arrested (opens the source in a new tab)
A September federal operation targeted more than 40 Texas residences hosting laptop farms for North Korean remote IT workers. Two people were arrested, and the scheme generated about $3 million for the regime. HR and IT teams should verify remote hires and watch for remote-access tooling and geolocation anomalies on corporate laptops.
Source: RSS - Medium severityUkrainian hackers claim DDoS on Russian ISP SkyNet (opens the source in a new tab)
St. Petersburg ISP SkyNet has suffered DDoS outages since October 6, affecting gaming, voice and video services. Ukrainian hackers claimed the attack.
Source: RSS - Medium severityRansomware gangs reportedly escalate to physical threats (opens the source in a new tab)
Organisations report ransomware actors escalating coercion with threats against employees' families, stalking, violence and abduction. The claims are hard to verify but warrant executive-protection and incident-response planning.
- Medium severityWest African scam compounds raided in Ghana and Nigeria (opens the source in a new tab)
A UK-hosted operation with tech-company participation led to more than two dozen arrests in Ghana and Nigeria. Over 100 suspected trafficking victims were removed from scam compounds.
Source: RSS - Low severityShinyHunters: six-year retrospective (opens the source in a new tab)
A DataBreaches.net retrospective on six years of ShinyHunters activity, compiling expert analysis and perspectives from ransomware groups.
Source: RSS
Tools, Techniques & Research
Research and tradecraft: third-party intrusion lessons, MFA gaps, AI-agent sandbox escape and AI self-replication research, plus DFIR methodology pieces.
- Medium severityUnit 42: unsophisticated bank intrusion exposes third-party risk (opens the source in a new tab)
Unit 42 dissects an unsophisticated attack on a European bank's IT infrastructure that was enabled by third-party access. The post includes detection and defensive guidance on supplier connectivity.
Source: RSS - Medium severityMFA coverage gaps on VPN, RDP and Windows logons still exploited (opens the source in a new tab)
Attackers continue to use stolen credentials against VPN, RDP and Windows logons that lack MFA even where cloud apps are protected. Audit MFA coverage on on-prem and remote-access paths.
- Medium severityVercel Sandbox flaw lets rogue AI agents exfiltrate data (opens the source in a new tab)
AIR found a network-filtering flaw in Vercel Sandbox that could let AI agents abuse certificate-validation processes to send data outside approved networks. Treat agent sandboxes as untrusted egress points.
Source: RSS - Low severityAnthropic research on AI self-replication across IoT devices (opens the source in a new tab)
Anthropic research suggests small AI models could self-replicate across consumer IoT such as Android TV boxes and smart ovens, forming distributed botnets. Researchers said such botnets would be challenging to shut down.
Source: RSS - Info severityANY.RUN: industry threat insights from 74K sandbox analyses (opens the source in a new tab)
ANY.RUN aggregates data from 74K sandbox analyses to show which threats target specific industries, along with SOC operational metrics.
Source: RSS - Info severityVehicle forensics: analysing driver behaviour from vehicle data (opens the source in a new tab)
A Forensic Focus article on using vehicle velocity logs, hard-braking and acceleration events (via iVe) to evidence changes in driver behaviour.
Source: RSS - Info severityForensic licence-plate examination and enhancement casework (opens the source in a new tab)
Guidance on the decision-making process in licence-plate enhancement casework. The core point: processing strategy should follow the material, and interpretive strength should follow the evidence.
Source: RSS
Policy, Regulation & Enforcement
Lifecycle, regulatory and enforcement items: an OS end-of-support deadline, an insider-threat arrest, a privacy fine and FTC fraud enforcement.
- Medium severityWindows 11 24H2 Home and Pro reach end of support (opens the source in a new tab)
Windows 11 24H2 Home and Pro editions no longer receive security updates. Identify remaining devices and upgrade them, especially given this month's record patch volume.
Source: RSS - Medium severityOpenAI engineer arrested over alleged covert recording device (opens the source in a new tab)
An OpenAI engineer was arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices. This is an insider-threat case relevant to physical security of sensitive meeting spaces.
Source: RSS - Low severityXandr fined $9.6M over Grindr user data in ad auctions (opens the source in a new tab)
Advertising company Xandr was fined $9.6 million for sharing Grindr users' data through ad auctions without valid consent. The data could reveal users' sexual orientation.
Source: RSS - Low severityFTC: fake sextortion-assistance firm netted $60M (opens the source in a new tab)
An FTC complaint alleges an Ohio-based company took at least $60 million from sextortion victims for help it never provided.
Source: RSS
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.