Update the Backuply WordPress plugin to 1.5.9 to fix CVE-2026-93953, a high-severity SQL injection vulnerability impacting 600,000 sites.

#WordPress #Backuply #SQLInjection #Wordfence #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/backuply-wordpress-plugin-sql-injection-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL: CVE-2026-103768 in ELEX WordPress HelpDesk (<=3.3.7) lets unauthenticated users upload dangerous files via initMailPart, risking remote code execution. Update or mitigate now. https://radar.offseq.com/threat/cve-2026-103768-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-elextensions-elex-wordpress-7d30032c4c181bd8 #OffSeq #WordPress #Infosec #RCE

CRITICAL: CVE-2026-103768 in ELEX WordPress HelpDesk (<=3.3.7) lets unauthenticated users upload dangerous files via initMailPart, risking remote code execution. Update or mitigate now. https://radar.offseq.com/threat/cve-2026-103768-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-elextensions-elex-wordpress-7d30032c4c181bd8 #OffSeq #WordPress #Infosec #RCE

Geopolitically, an international operation disrupted a cybercrime network behind over a billion phishing messages targeting 75,000 organizations. In cybersecurity, Microsoft's October 2026 Patch Tuesday addressed a record 1,415 vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-96951) and critical RCE flaws. Technology news includes Samsung's Future Wireless Summit, focusing on 6G and AI-native innovations.

#Cybersecurity #TechNews #AnonNews_irc

CW: Riasztás — Ivanti Connect Secure (CVE-2026-104935) és Microsoft Windows Shell (CVE-2026-96951) aktívan kihasznált, magas kockázatú sérülékenységek. Ivanti: érintett 25.1.3.0/25.1.3.1 és 22.8R2.5 előtti verziók; 25.1.1.2+ javasolt. Microsoft: MotW megkerülés, e-mail/üzenet útján terjesztett támadások. Frissíts, ellenőrizd naplókat és EDR-forensic vizsgálatokat. #Ivanti #CVE-2026-104935 #CVE-2026-96951 #Windows #infosec https://linuxmint.hu/hir/2026/10/riasztas-az-ivanti-connect-secure-es-a-microsoft-windows-shell-serulekenysegeirol

CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web
#CVE_2026_96951 #MicrosoftOperatingSystems
https://socprime.com/blog/cve-2026-96951-analysis/

CW: sebezhetőség(ek) — Microsoft októberi Patch Tuesday: 1 413 javítás, ebből 1 102 Windows-hoz. Aktívan kihasznált: CVE-2026-96951 (Windows Shell, CVSS 8.8) — bekerült a CISA KEV listájára, szövetségi határidő: 2026-10-16. Figyelem még: CVE-2026-108398 (.NET, WDAC kerülés). Részletek: https://linuxmint.hu/hir/2026/10/rekordot-dontott-a-microsoft-1-413-sebezhetoseget-foltoztak-koztuk-egy-aktivan
#Windows #CVE #infosec #cybersecurity

⚠️ CRITICAL: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Microsoft patched 1,411 vulnerabilities in October 2026, including three zero-days: CVE-2026-96951 (Windows Shell, actively exploited) and CVE-2026-108398 (.NET Framework, publicly disclosed). CVE-2026-108398 allows attackers to bypass Windows Defender Application Control and execute unauthorized a…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Microsoft released patches for 1,413 vulnerabilities in October 2026, including CVE-2026-96951, a critical Windows zero-day that bypasses Mark of the Web security controls. This flaw is actively exploited in the wild and tracked by CISA. Windows systems are the primary target across 1,102 of the pa…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Microsoft Patches 1,411 Vulnerabilities in October 2026 Update Including Actively Exploited Zero-Day

Microsoft's October 2026 Patch Tuesday fixed a record 1,411 vulnerabilities, including 70 critical ones (mostly remote code execution) and three zero-days. The actively exploited zero-day is CVE-2026-96951, a Windows Shell Mark of the Web bypass. A .NET Framework WDAC bypass and a MessagePack-CSharp denial-of-service flaw were publicly disclosed. This month is the final security update for Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016.

**Patch the Windows OS first because it has an actively exploited flaw. Next, update .NET Framework on endpoints and servers that depend on Windows Defender Application Control. If you are developing ASP.NET apps, prioritize rebuilding and redeploying anything that ships MessagePack-CSharp, including ASP.NET Core SignalR apps, on version 2.5.303 or 3.1.9. Then work through the 70 critical flaws, starting with the 57 remote code execution bugs on internet-facing and domain-joined systems. Use the Microsoft's new risk cohorts to batch related fixes. Finally, check your fleet for support status: Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 received their last update this month, Windows 11 23H2 Enterprise and Education get their final one on November 10, and Windows Server 2012 and 2012 R2 need manual remediation for the AD FS hardening tied to CVE-2026-56155.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-s-record-october-patch-tuesday-fixes-1400-flaws-including-zero-day-under-z-s-e-q-y/gD2P6Ple2L

🚨 NEW on CISA KEV — exploited in the wild

🛡 Microsoft Windows
Microsoft Windows Command Injection Vulnerability
CVE: CVE-2026-96951 · patch by 2026-10-16

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-96951
#cybersecurity #KEV #CVE #infosec

Review the latest Juniper security bulletin to patch critical Junos OS vulnerabilities, including RCE flaws CVE-2026-102182 and CVE-2026-101954.

#JuniperNetworks #JunosOS #JunosOSEvolved #Cybersecurity #Vulnerability #NetworkSecurity #InfoSec

https://securityonline.info/juniper-patches-critical-junos-os-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Unit 42 says attackers gained access to a managed telecom services provider in September 2024 by exploiting FortiManager’s FortiJump flaw (CVE-2024-47575).

They obtained a file with data on more than 500 managed FortiGate firewalls, including configurations, network maps, credentials, certificates and private keys.

The attackers later used a separate flaw, CVE-2025-61624, to install PEERSTITCH, which changes how For…

https://en.hacks.gr/paraviasi-se-parocho-tilepikoinonion-exethese-stoicheia-gia-500-systimata-asfaleias/

#FortiManager #FortiGate #PEERSTITCH #CVE2025_61624

A Chrome security update fixes 10 flaws, including critical use after free bug CVE-2026-110922. Update to Chrome 155.0.8059.84 now.

#Chrome #GoogleChrome #CVE2026110922 #CVE2026110913 #CVE2026110919 #UseAfterFree #BrowserSecurity #CyberSecurity

https://securityonline.info/chrome-security-update-155-0-8059-84/?utm_source=mastodon&utm_medium=jetpack_social

A Chrome security update fixes 10 flaws, including critical use after free bug CVE-2026-110922. Update to Chrome 155.0.8059.84 now.

#Chrome #GoogleChrome #CVE2026110922 #CVE2026110913 #CVE2026110919 #UseAfterFree #BrowserSecurity #CyberSecurity

https://securityonline.info/chrome-security-update-155-0-8059-84/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-110922: CRITICAL use-after-free in Chrome Prerender enables remote code execution via crafted HTML. Patch to 155.0.8059.84+ immediately. Details: https://radar.offseq.com/threat/cve-2026-110922-use-after-free-in-google-chrome-712d16481754e9e4 #OffSeq #Chrome #Vuln #Infosec

🟠 CVE-2026-109468 - High (7.5)

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-109468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75941 - High (8)

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75941 - High (8)

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111356 (CRITICAL, CVSS 9.1) in magicblack MacCMS <=2026.1000.4056 allows unauthenticated brute-forcing of password recovery codes, risking account takeover. Rate limiting is advised until a patch is confirmed. https://radar.offseq.com/threat/cve-2026-111356-improper-restriction-of-excessive-authentication-attempts-in-magicblack-maccms-7a578a56fecd347f #OffSeq #CVE2026111356 #infosec #bruteforce

CVE-2026-111322 (CRITICAL): coleam00 Archon 0.2.13 – 0.11.1 lacks auth on /api/*, risking remote command execution by unauthenticated users. Restrict API access & monitor; patch status unknown. https://radar.offseq.com/threat/cve-2026-111322-missing-authentication-for-critical-function-in-coleam00-archon-2baeaa2e1000cf2d #OffSeq #Vulnerability #CVE2026111322

CVE-2026-111322 (CRITICAL): coleam00 Archon 0.2.13 – 0.11.1 lacks auth on /api/*, risking remote command execution by unauthenticated users. Restrict API access & monitor; patch status unknown. https://radar.offseq.com/threat/cve-2026-111322-missing-authentication-for-critical-function-in-coleam00-archon-2baeaa2e1000cf2d #OffSeq #Vulnerability #CVE2026111322

🔴 CVE-2026-111322 - Critical (9.8)

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI codin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111322/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111329 - Critical (9.8)

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111352 - High (8.8)

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-111312 (CRITICAL): OpenHealthForAll OpenHealth ≤0.2.0 lets unauthenticated users access, change, or delete any medical record via /api/health-data/[id]. Restrict endpoint access until patched. https://radar.offseq.com/threat/cve-2026-111312-missing-authentication-for-critical-function-in-openhealthforall-openhealth-459af705f709eb85 #OffSeq #CVE2026111312 #infosec #healthtech

CVE-2026-111312 (CRITICAL): OpenHealthForAll OpenHealth ≤0.2.0 lets unauthenticated users access, change, or delete any medical record via /api/health-data/[id]. Restrict endpoint access until patched. https://radar.offseq.com/threat/cve-2026-111312-missing-authentication-for-critical-function-in-openhealthforall-openhealth-459af705f709eb85 #OffSeq #CVE2026111312 #infosec #healthtech

🟠 CVE-2026-111312 - High (7.7)

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111282 - High (8.2)

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with file...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-111282 - High (8.2)

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with file...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111281 - Critical (9.8)

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /gofor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-111281 - Critical (9.8)

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /gofor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Oh... That's bad

https://app.opencve.io/cve/CVE-2026-99999

RT: @pwn_ai Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors.

CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:

Oh... That's bad

https://app.opencve.io/cve/CVE-2026-99999

"PwnEscape" is the KVM escape for which rumors made the rounds a few days ago. Getting CVE-2026-99999 assigned is 👨🏻‍🍳💋.

https://pwn.ai/blog/pwnescape

Kernel patch for this part (because it sounds like there's multiple):
https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822

🟠 CVE-2026-111279 - High (7.5)

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-111279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:1015] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21589 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21589)
- Name: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Atlassian
- Product: Multiple Products
- Notes: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261015 #cisa20261015 #cve_2026_21589 #cve202621589

CVE ID: CVE-2026-21589
Vendor: Atlassian
Product: Multiple Products
Date Added: 2026-10-15
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21589

🟠 CVE-2026-108446 - High (8.8)

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-108446/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-108445 - High (8.8)

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-108445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

BeyondTrust Zero-Day Exploited in Targeted Attacks Since August

A critical zero-day vulnerability, CVE-2026-102764, has been exploited in targeted attacks since late August, putting BeyondTrust Remote Support users at risk of file operations and even full root control by unprivileged remote attackers. The flaw affects Remote Support builds 26.2.3 and earlier, but thankfully, patches are…

https://osintsights.com/beyondtrust-zero-day-exploited-in-targeted-attacks-since-august?utm_source=mastodon&utm_medium=social

#Beyondtrust #ZeroDay #Cve2026102764 #AuthenticationBypass #RemoteCodeExecution

RE: https://infosec.exchange/@BleepingComputer/117449130155748204

BeyondTrust patched a Remote Support zero-day (CVE-2026-102764) exploited since August.

Mandiant attributes the attacks to Armory Castle (formerly UNC5221), a China-nexus espionage group that has also targeted Citrix NetScaler and Ivanti Connect Secure appliances.

BeyondTrust has 20,000+ customers, including 75% of the Fortune 100.

RE: https://infosec.exchange/@BleepingComputer/117449130155748204

BeyondTrust patched a Remote Support zero-day (CVE-2026-102764) exploited since August.

Mandiant attributes the attacks to Armory Castle (formerly UNC5221), a China-nexus espionage group that has also targeted Citrix NetScaler and Ivanti Connect Secure appliances.

BeyondTrust has 20,000+ customers, including 75% of the Fortune 100.

🟠 CVE-2026-61611 - High (7.5)

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61611/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63442 - High (8.1)

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63442/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-89107 lands a 9.9, injecting arbitrary ABAP code into S/4HANA, while CVE-2026-89108 sneaks an unauthorized admin account onto your Java app server via Manufacturing Integration and Intelligence. The defender is down in three corners simultaneously — that's just bad ring awareness.

Apply SAP's October 2026 Security Patch Day updates to NetWeaver, S/4HANA, and related products immediately.

Reward: You've unlocked the Folding Chair of Humility — spectators only get one. (2/3)

A TanStack Start vulnerability, CVE-2026-102989 (CVSS 9.3), allows unauthenticated reflected XSS via crafted links. Upgrade to the patched packages.

#TanStack #TanStackStart #CVE2026102989 #ReflectedXSS #React #JavaScript #WebSecurity #CyberSecurity

https://securityonline.info/tanstack-start-cve-2026-102989-xss/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-97394 - High (7.5)

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-ur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Vghost: Beyond the Privilege Boundary
#CVE_2026_74580
https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580

Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector https://www.openwall.com/lists/oss-security/2026/10/14/2

Technical details and PoC exploit code for CVE-2026-74580 (Vghost), an 8.8-severity Linux vhost vulnerability allowing root LPE and VM escape, are out.

#CVE202674580 #Vghost #LinuxKernel #PrivilegeEscalation #VMEscape #Cybersecurity #InfoSec

https://securityonline.info/vghost-cve-2026-74580-linux-vhost-poc-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
https://isc.sans.edu/podcastdetail/10140

Palo Alto Networks patched the PAN-OS CVE-2026-0322 zero-day vulnerability exploited in limited attacks to achieve root code execution on firewalls.

#PaloAltoNetworks #PANOS #CVE20260322 #ZeroDay #Cybersecurity

https://meterpreter.org/pan-os-cve-2026-0322-zero-day/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access
#CVE_2026_0322
https://socprime.com/blog/cve-2026-0322-analysis/

🏆 New Achievement! Root Access For Fun And Profit (Yours Is The Fun, Theirs Is The Profit)!

Item Drop: CVE-2026-0322 has been added to your inventory — cursed, naturally. Palo Alto Networks just disclosed a flaw in PAN-OS that lets an authenticated attacker run arbitrary code with root privileges on your firewall's management interface. No special configuration required. (1/3)

And a Palo Alto Networks zero-day too

https://security.paloaltonetworks.com/CVE-2026-0322

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in...

🔗️ [Bleepingcomputer] https://link.is.it/SUCUwg

I forgot to mention that Palo Alto listed these IOC for CVE-2026-0322 exploitation:

• 66.42.72.14
• 208.83.239.114
• 149.248.47.234

Fanged for your pleasure. No open source information on them Vultr IPs outside of today's disclosure.

#threatintel #paloaltonetworks #zeroday #IOC #KEV

PAN-OS zero-day CVE-2026-0322 exploited to gain root

https://fawkes.rocks/2026/10/15/pan-os-zero-day-cve-2026-0322-exploited-to-gain-root/

🚨 [CISA-2026:1014] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-0322 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0322)
- Name: Palo Alto Networks PAN-OS Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Palo Alto Networks
- Product: PAN-OS
- Notes: https://security.paloaltonetworks.com/CVE-2026-0322 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0322

⚠️ CVE-2026-105133 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105133)
- Name: Ahsay AhsayCBS Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105133

⚠️ CVE-2026-105134 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105134)
- Name: Ahsay AhsayCBS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105134

⚠️ CVE-2026-76519 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76519)
- Name: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Email Gateway
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76519

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261014 #cisa20261014 #cve_2026_0322 #cve_2026_105133 #cve_2026_105134 #cve_2026_76519 #cve20260322 #cve2026105133 #cve2026105134 #cve202676519

If your Palo Alto management interface is internet-exposed, you might notice even more traffic on it today. But if that was your security posture, maybe you're fine with that.

Anyway this is exploited in the wild. Authenticated, so creds required.

https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903

#ThreatIntel #ThreatIntelligence #IFIN

@winterknight1337 https://security.paloaltonetworks.com/CVE-2026-0322

Palo Alto Networks zero-day: CVE-2026-0322 (CVSS4: 8.6 high)PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface https://security.paloaltonetworks.com/CVE-2026-0322

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

#paloaltonetworks #zeroday #KEV #CISA #eitw

CVE ID: CVE-2026-0322
Vendor: Palo Alto Networks
Product: PAN-OS
Date Added: 2026-10-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0322

Attackers are actively exploiting CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE vulnerability in the management interface. Apply patches right now.

#CVE20260322 #PaloAltoNetworks #PANOS #RCE #FirewallSecurity #Cybersecurity #InfoSec

https://securityonline.info/palo-alto-pan-os-rce-cve-2026-0322-exploited/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-0322 is an EITW post-auth RCE in PAN-OS management interface.

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

https://security.paloaltonetworks.com/CVE-2026-0322

🔴 CVE-2026-84731 - Critical (9.8)

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Upgrade your DB cluster to fix CVE-2026-110812, a critical 9.9 CVSS Amazon Neptune vulnerability in Apache TinkerPop Gremlin.

#AWS #AmazonNeptune #ApacheTinkerPop #CloudSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/aws-patches-critical-amazon-neptune-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-92982 - High (8.5)

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85634 - High (8.8)

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85634/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Deserialization of Untrusted Data in Link Whisper Free (<0.9.8) leads to object injection (CVE-2026-109686, CRITICAL, CVSS 9.8). Update now to protect your sites! https://radar.offseq.com/threat/cve-2026-109686-deserialization-of-untrusted-data-in-link-whisper-inc-link-whisper-free-8c1e9d53b6a1f923 #OffSeq #Vuln #InfoSec #WordPress

Patch two high-severity SonicWall NSM On-Prem vulnerabilities (CVE-2026-96540, CVE-2026-100232) allowing admin privilege escalation and OS command RCE.

#SonicWall #CVE202696540 #CVE2026100232 #NetworkSecurity #RCE #Cybersecurity #InfoSec

https://securityonline.info/sonicwall-nsm-on-prem-vulnerabilities-snwlid-2026-0018/?utm_source=mastodon&utm_medium=jetpack_social

Patch two high-severity SonicWall NSM On-Prem vulnerabilities (CVE-2026-96540, CVE-2026-100232) allowing admin privilege escalation and OS command RCE.

#SonicWall #CVE202696540 #CVE2026100232 #NetworkSecurity #RCE #Cybersecurity #InfoSec

https://securityonline.info/sonicwall-nsm-on-prem-vulnerabilities-snwlid-2026-0018/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-110867: CRITICAL vuln in renovatebot renovate (<44.60.1). Attackers can bypass allowlists via presets, setting restricted env vars & risking privilege escalation on self-hosted. Patch with 44.60.1+. https://radar.offseq.com/threat/cve-2026-110867-incorrect-authorization-in-renovatebot-renovate-241a3325f973ab24 #OffSeq #CVE2026110867 #Renovatebot #Infosec

🟠 CVE-2026-55103 - High (8.6)

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55103/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-92097 - Critical (9.1)

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81534 - High (8.8)

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, whic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-108587 in 10Web Booster <=2.34.10 enables unauthenticated file upload (RCE via leaked REST nonce). Restrict wp-content/uploads & monitor uploads. Patch status pending. https://radar.offseq.com/threat/cve-2026-108587-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-10web-10web-booster-website-6312bf250c702c31 #OffSeq #WordPress #Vuln #RCE

Review the Progress security bulletin fixing 12 MOVEit Transfer vulnerabilities, including high-severity flaws CVE-2026-87093 and CVE-2026-89067.

#MOVEitTransfer #ProgressSoftware #MFT #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/progress-patches-moveit-transfer-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

Fluent CRM <3.2.6 hit by CRITICAL CVE-2026-109694: incorrect privilege assignment enables unauth’d privilege escalation (CVSS 9.8) 🚨. Patch status TBC — restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-109694-incorrect-privilege-assignment-in-wp-manageninja-llc-fluent-crm-b55f33b4a658d6f8 #OffSeq #WordPress #Vuln #PrivilegeEscalation

🟠 CVE-2026-92150 - High (7.5)

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handler uses F...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92150/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105133 CVE-2026-105134 AhsayCBS Authentication Bypass and Command Injection: Technical Response & SOC Investigation Brief https://thecybermind.co/z2es

AhsayCBS authentication bypass and command injection require a coordinated response. This combined technical brief covers updated remediation, reported exploitation, investigation priorities, and detection-validation boundaries—while keeping backup recovery assurance in focus....

🚨 [CISA-2026:1014] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-0322 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0322)
- Name: Palo Alto Networks PAN-OS Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Palo Alto Networks
- Product: PAN-OS
- Notes: https://security.paloaltonetworks.com/CVE-2026-0322 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0322

⚠️ CVE-2026-105133 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105133)
- Name: Ahsay AhsayCBS Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105133

⚠️ CVE-2026-105134 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105134)
- Name: Ahsay AhsayCBS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105134

⚠️ CVE-2026-76519 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76519)
- Name: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Email Gateway
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76519

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261014 #cisa20261014 #cve_2026_0322 #cve_2026_105133 #cve_2026_105134 #cve_2026_76519 #cve20260322 #cve2026105133 #cve2026105134 #cve202676519

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-105133 and CVE-2026-105134- AhsayCBS Security Brief: Protect the Systems Your Recovery Depends On

Executive briefing on AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134, covering incomplete patch re-verification, command injection risks, and recovery readiness....

https://thecybermind.co/mcs0

CVE ID: CVE-2026-105134
Vendor: Ahsay
Product: AhsayCBS
Date Added: 2026-10-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105134

AhsayCBS Deep-Dive: Auth Bypass to RCE https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/

The curl 8.23.0 release fixes critical vulnerability CVE-2026-92392, an HTTP/2 use-after-free flaw surfaced by Anthropic that permits remote code execution.

#curl #CVE202692392 #Cybersecurity #Anthropic #Vulnerability

https://meterpreter.org/curl-8-23-0-cve-2026-92392-rce/?utm_source=mastodon&utm_medium=jetpack_social

The cURL CVE-2026-92392 vulnerability enables remote code execution during HTTP/2 uploads. Update to cURL 8.23.0 or disable HTTP/2 to protect systems.

#cURL #CVE202692392 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/curl-cve-2026-92392-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-92392/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-92392/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

A UAF turned RCE

In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.

https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/

F5 patched three NGINX vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) rated 9.2 Critical in F5 NGINX Plus and Open Source. Upgrade today.

#NGINX #F5Networks #CVE202697205 #CVE202693479 #CVE202615176 #Cybersecurity #InfoSec

https://securityonline.info/f5-patches-three-critical-nginx-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-79821 - High (8.2)

A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Review the Mitsubishi Electric security advisory fixing critical ICONICS Suite vulnerabilities, including CVE-2026-16438 and CVE-2026-16436.

#MitsubishiElectric #ICONICS #GENESIS64 #ICS #OTSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/mitsubishi-electric-iconics-suite-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Review the Mitsubishi Electric security advisory fixing critical ICONICS Suite vulnerabilities, including CVE-2026-16438 and CVE-2026-16436.

#MitsubishiElectric #ICONICS #GENESIS64 #ICS #OTSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/mitsubishi-electric-iconics-suite-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-16438 (CRITICAL, CVSS 9.4): Incorrect privilege assignment in Mitsubishi GENESIS64 & related products. Admin users can launch DCOM objects, risking DoS & data loss. Restrict admin access & monitor usage. https://radar.offseq.com/threat/cve-2026-16438-cwe-266-incorrect-privilege-assignment-in-mitsubishi-electric-corporation-genesis64-980e045a57b35746 #OffSeq #ICS #Vulnerability

Znuny ≤7.3.6 vulnerable to CRITICAL auth bypass (CVE-2026-93483). Attackers can forge the 'Remote-User' HTTP header to access any account, incl. admins. Avoid HTTPBasicAuth and check vendor guidance. https://radar.offseq.com/threat/in-znuny-through-736-an-attacker-can-bypass-specific-standard-login-procedures-and-gain-unauthorized-0c8a601d6b37802f #OffSeq #Znuny #CVE202693483 #infosec

Adobe releases October 2026 patches for multiple products

Adobe's October 2026 security updates fix critical, high and medium vulnerabilities across eleven product families. The most severe (several rated CVSS 10.0) in ColdFusion, Adobe Commerce/Magento and Experience Manager. Adobe reports no known exploits in the wild but urges urgent updating. Commerce/Magento customers must also apply the separate September 7 hotfix for CVE-2026-75650.

**If you run Adobe products, review the advisory. Prioritize ColdFusion, Adobe Commerce or Magento Open Source, or Adobe Experience Manager, update them first. Each received fixes for critical flaws with a CVSS score of 10.0. In Commerce, CVE-2026-103849 is the same weakness type as last month's actively exploited CVE-2026-75650, so also confirm that the September hotfix for CVE-2026-75650 is installed, since Adobe requires it in addition to this update. Update the Content Credentials SDK components (Rust SDK, C2PA Tool, and JS SDK), which contain network-reachable flaws that could lead to security feature bypass and application denial-of-service. Then update Photoshop, FrameMaker, Dimension, Substance 3D Stager, Substance 3D Designer, Substance 3D Sampler, and Bridge. If you can't update right away, restrict network access to ColdFusion, Commerce, and Experience Manager servers, and avoid opening untrusted files in Photoshop, FrameMaker, Dimension, Substance 3D Stager, Substance 3D Designer, Substance 3D Sampler, and Bridge until patches are applied.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/adobe-releases-october-2026-patches-for-multiple-products-n-n-r-1-8/gD2P6Ple2L

New advisory for a high-severity vulnerability.

Fortinet: CVE-2026-84393: Improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure https://app.opencve.io/cve/CVE-2026-84393 #Fortinet #infosec #vulnerability

CVE-2026-110858 | GitPython 3.1.30 – 3.2.0: CRITICAL RCE via improper argument neutralization in Remote.pull(). Attackers can run arbitrary OS commands over SSH/local. Limit use & watch for patches. https://radar.offseq.com/threat/cve-2026-110858-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-eb08373a6f0fb8af #OffSeq #GitPython #RCE #infosec

CVE-2026-105133 CVE-2026-105134 AhsayCBS Authentication Bypass and Command Injection: Technical Response & SOC Investigation Brief https://thecybermind.co/z2es

AhsayCBS authentication bypass and command injection require a coordinated response. This combined technical brief covers updated remediation, reported exploitation, investigation priorities, and detection-validation boundaries—while keeping backup recovery assurance in focus....

🚨 [CISA-2026:1014] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-0322 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0322)
- Name: Palo Alto Networks PAN-OS Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Palo Alto Networks
- Product: PAN-OS
- Notes: https://security.paloaltonetworks.com/CVE-2026-0322 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0322

⚠️ CVE-2026-105133 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105133)
- Name: Ahsay AhsayCBS Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105133

⚠️ CVE-2026-105134 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105134)
- Name: Ahsay AhsayCBS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105134

⚠️ CVE-2026-76519 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76519)
- Name: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Email Gateway
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76519

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261014 #cisa20261014 #cve_2026_0322 #cve_2026_105133 #cve_2026_105134 #cve_2026_76519 #cve20260322 #cve2026105133 #cve2026105134 #cve202676519

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-105133 and CVE-2026-105134- AhsayCBS Security Brief: Protect the Systems Your Recovery Depends On

Executive briefing on AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134, covering incomplete patch re-verification, command injection risks, and recovery readiness....

https://thecybermind.co/mcs0

CVE ID: CVE-2026-105133
Vendor: Ahsay
Product: AhsayCBS
Date Added: 2026-10-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105133

AhsayCBS Deep-Dive: Auth Bypass to RCE https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/

D-Link DIR-868L v2.01b05 has a CRITICAL OS command injection (CVE-2026-110536, CVSS 10). Remote, unauthenticated exploit possible — public code released. No patch yet. Restrict access & check vendor guidance. https://radar.offseq.com/threat/a-vulnerability-was-determined-in-d-link-dir-868l-201b05-cve-2026-110536-3b13ecc45e7b5b0a #OffSeq #CVE2026110536 #infosec #routersecurity

CVE-2026-110770: Databasus 3.7.0 – 3.61.0 has a CRITICAL auth bypass flaw — unauthenticated attackers can brute-force password reset codes via /api/v1/users/reset-password. Patch unconfirmed — apply external mitigations. https://radar.offseq.com/threat/databasus-370-through-3610-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-6e4063880853e9f3 #OffSeq #CVE2026110770 #infosec

SANS Stormcast Friday, October 16th, 2026: Panchan Crypto Mining Worm; Exploited 0-Days in Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto PAN-OS (CVE-2026-0322) and Ivanti Connect Secure
https://isc.sans.edu/podcastdetail/10140

New advisory.

Arctic Wolf: CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required https://arcticwolf.com/resources/blog/cve-2026-76461-active-exploitation-of-cisco-secure-email-gateway-critical-zero-day-vulnerability-immediate-mitigation-required/

There were other vulnerabilities that Cisco addressed yesterday

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76519: Cisco Secure Email Gateway Arbitrary File Write Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp #infosec #Cisco #vulnerability

Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/

Attackers are exploiting CVE-2026-76519 (CVSS 9.8), a critical Cisco Secure Email Gateway vulnerability allowing root RCE via attachments. Patch right now.

#CVE202676519 #Cisco #EmailSecurity #AsyncOS #RCE #ZeroDay #Cybersecurity

https://securityonline.info/cisco-secure-email-gateway-cve-2026-76519-exploited/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:1014] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1014)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-0322 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0322)
- Name: Palo Alto Networks PAN-OS Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Palo Alto Networks
- Product: PAN-OS
- Notes: https://security.paloaltonetworks.com/CVE-2026-0322 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0322

⚠️ CVE-2026-105133 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105133)
- Name: Ahsay AhsayCBS Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105133

⚠️ CVE-2026-105134 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-105134)
- Name: Ahsay AhsayCBS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Ahsay
- Product: AhsayCBS
- Notes: https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-105134

⚠️ CVE-2026-76519 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76519)
- Name: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Email Gateway
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76519

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261014 #cisa20261014 #cve_2026_0322 #cve_2026_105133 #cve_2026_105134 #cve_2026_76519 #cve20260322 #cve2026105133 #cve2026105134 #cve202676519

Cisco zero-day: CVE-2026-76519 (CVSS3.1: 9.8 critical) Cisco Secure Email Gateway Arbitrary File Write Vulnerability

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

#Cisco #zeroday #CVE #KEV #CISA

CVE ID: CVE-2026-76519
Vendor: Cisco
Product: Secure Email Gateway
Date Added: 2026-10-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76519

Cisco confirmed CVE-2026-76519, a critical path traversal in Secure Email Gateway AMP enabling unauthenticated root command execution via email attachments. It is actively exploited, so exposed appliances should be treated as potentially compromised. #CiscoSeg #ThreatIntel #Cve202676519

https://cyberworldops.eu/en/cisco-seg-flaw-cve-2026-76519-enables-unauthenticated-root-command

Cisco Secure Email Gateway zero-day CVE-2026-76519 patched

https://fawkes.rocks/2026/10/14/cisco-secure-email-gateway-zero-day-cve-2026-76519-patched/

“Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.”

https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Nextcloud의 선택적 앱인 Collabora Online Built-in CODE Server(richdocumentscode)에서 인증 없이 OS 명령을 실행할 수 있는 치명적 취약점 CVE-2026-110447이 실제 공격에 악용되고 있다. 공격자는 proxy.php 요청으로 명령 주입을 유발해 PHP 웹셸을 심고, 비밀번호 데이터베이스·패스워드 관리자 파일·암호화폐 지갑 등을 탐색한 것으로 보고됐다. 영향 범위는 26.4.303 이전 버전의 내장 CODE...

https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/

“Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.”

https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app...

🔗️ [Bleepingcomputer] https://link.is.it/rZ38Rw

Falha crítica no Collabora para Nextcloud está a ser ativamente explorada por piratas informáticos. A vulnerabilidade foi identificada como CVE-2026-110447.

🔗 https://tugatech.com.pt/t92783-falha-critica-no-collabora-para-nextcloud-esta-a-ser-ativamente-explorada

#alerta #falha #oficial #problema #servidor 

Nextcloud : des serveurs piratés via une faille critique de l’application Collabora Built-in CODE https://www.it-connect.fr/nextcloud-collabora-built-in-code-faille-webshell-cve-2026-110447/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Attackers are actively exploiting CVE-2026-110447 (CVSS 9.2), a critical Nextcloud Collabora Online RCE flaw in richdocumentscode, to deploy PHP webshells.

#CVE2026110447 #Nextcloud #CollaboraOnline #RCE #Webshell #Cybersecurity #InfoSec #354

https://securityonline.info/nextcloud-collabora-online-cve-2026-110447-exploited/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-110447 (CRITICAL, CVSS 9.2) allows RCE via OS command injection in Collabora Online Built-in CODE Server <26.4.303 (richdocumentscode, Nextcloud). Exploited in the wild since Sept 2026. Patch required. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6028 #OffSeq #Infosec #Nextcloud #CVE2026110447

🟠 CVE-2026-106627 - High (7.5)

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Review the latest Juniper security bulletin to patch critical Junos OS vulnerabilities, including RCE flaws CVE-2026-102182 and CVE-2026-101954.

#JuniperNetworks #JunosOS #JunosOSEvolved #Cybersecurity #Vulnerability #NetworkSecurity #InfoSec

https://securityonline.info/juniper-patches-critical-junos-os-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

Review the Progress security bulletin fixing 12 MOVEit Transfer vulnerabilities, including high-severity flaws CVE-2026-87093 and CVE-2026-89067.

#MOVEitTransfer #ProgressSoftware #MFT #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/progress-patches-moveit-transfer-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

I heard some of you nerds like to MOVEit MOVEit. Have fun. No indication of exploitation in the advisory but I haven't read through the CVEs yet.

https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026

CWE-288: Authentication bypass using an alternate path or channel (CVE-2026-89067), CVSS 8.8

CWE-732: Incorrect Permission Assignment for Critical Resource (CVE-2026-87093), CVSS 8.8

CWE-304: Missing critical step in authentication (CVE-2026-89068), CVSS 8.1

CWE-79: Improper neutralization of input during web page generation ('cross-site scripting') (CVE-2026-89069), CVSS 8.0

CWE-176: Improper handling of unicode encoding (CVE-2026-89074), CVSS 7.5

CWE-294: Authentication bypass by capture-replay (CVE-2026-89070), CVSS 7.5

CWE-303: Incorrect implementation of authentication algorithm (CVE-2026-89077), CVSS 7.5

CWE-613: Insufficient Session Expiration (CVE-2026-89073), CVSS 7.5

CWE-863: Incorrect Authorization (CVE-2026-89072), CVSS 7.5

CWE-90: Improper neutralization of special elements used in an LDAP query ('LDAP injection') (CVE-2026-89071), CVSS 7.5

CWE-922: Insecure Storage of Sensitive Information (CVE-2026-89075), CVSS 7.3

CWE-89: Improper neutralization of special elements used in an SQL command ('SQL injection') (CVE-2026-89076), CVSS 7.2

🔴 CVE-2026-110392 - Critical (9.8)

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110392/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-110165 — CRITICAL use-after-free in Chrome Core for Android <155.0.8059.79. Allows remote code execution outside sandbox via crafted HTML. Patch ASAP: update to 155.0.8059.79+. Details: https://radar.offseq.com/threat/cve-2026-110165-use-after-free-in-google-chrome-a8d190779682275f #OffSeq #Chrome #Android #Infosec

F5 patched three NGINX vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) rated 9.2 Critical in F5 NGINX Plus and Open Source. Upgrade today.

#NGINX #F5Networks #CVE202697205 #CVE202693479 #CVE202615176 #Cybersecurity #InfoSec

https://securityonline.info/f5-patches-three-critical-nginx-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

F5 patched three NGINX vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) rated 9.2 Critical in F5 NGINX Plus and Open Source. Upgrade today.

#NGINX #F5Networks #CVE202697205 #CVE202693479 #CVE202615176 #Cybersecurity #InfoSec

https://securityonline.info/f5-patches-three-critical-nginx-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

TR7 ASP (TR7 Cyber Defense Inc.) is vulnerable to unauthenticated OS command injection (CVE-2026-16740, CVSS 9.8, CRITICAL). Remote attackers can fully compromise affected versions. Restrict access & monitor for abuse. https://radar.offseq.com/threat/cve-2026-16740-cwe-306-missing-authentication-for-critical-function-in-tr7-cyber-defense-inc-tr7-asp-604c8853c8296eb5 #OffSeq #Vuln #TR7 #CVE202616740

New.

Rapid7: CVE-2026-108065: Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce/ @Rapid7Official #infosec #SQL #vulnerability

Apply the NLnet Labs NSD patch for 4 flaws, including CVE-2026-101341. Each NSD stack overwrite vulnerability risks remote command execution.

#NSD #NLnetLabs #DNS #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/nsd-stack-overwrite-vulnerability-patched/?utm_source=mastodon&utm_medium=jetpack_social

🚨 PoC published for a critical unauthenticated Splunk Enterprise remote code execution vulnerability; CVE-2026-76268

PoC: https://github.com/murrez/CVE-2026-76268

The flaw affects the Patroni REST API used by the PostgreSQL sidecar on Splunk Enterprise search head cluster members. Critical configuration operations can be accessed without authentication, allowing an attacker with network access to the Patroni service to modify PostgreSQL configuration and execute operating system commands.

CVSS: 9.8 Critical
Affected: Splunk Enterprise 10.2.0 - 10.2.6 and 10.4.0 - 10.4.2
Fixed: Splunk Enterprise 10.2.7 and 10.4.3

The PoC includes vulnerability checking, Patroni port discovery, multi-target scanning, out-of-band verification, and an exploit mode demonstrating the RCE chain.

Attackers are exploiting CVE-2026-103671 in the wild, an EC-CUBE AmazonPay Plugin vulnerability that redirects shoppers to steal account credentials.

#CVE2026103671 #ECCUBE #AmazonPay #EcommerceSecurity #JPCERT #Cybersecurity #InfoSec

https://securityonline.info/ec-cube-amazonpay-plugin-cve-2026-103671-exploited/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-14851 (CRITICAL, CVSS 9.2): Copart billing service leaks PII & financial data via unauthenticated PDF invoice endpoints. Some URLs are indexed by search engines. Restrict access & block public indexing now. https://radar.offseq.com/threat/cve-2026-14851-cwe-200-exposure-of-sensitive-information-to-an-unauthorized-actor-in-copart-coparts-ef462fbc1a47157a #OffSeq #CVE #infosec #databreach

🟠 CVE-2026-110284 - High (7.5)

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-110284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-109901 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-109901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104909 - High (8.1)

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-104748: CRITICAL privilege escalation in SimpleForm WordPress plugin (<=3.10.0). Unauth users can gain admin via exposed AJAX and weak nonce. Disable/limit access until patched. Full details: https://radar.offseq.com/threat/cve-2026-104748-cwe-269-improper-privilege-management-in-wpazleen-simpleform-form-maker-to-chat-apps-e30303ee252058a1 #OffSeq #WordPress #PrivilegeEscalation #CVE2026104748

CVE-2026-89310: CRITICAL SQL injection in JTL-WMS (<2.0.7, <2.1.3, <2.2.1) 🛑 Remote code execution possible via unsanitized request body. No patch yet. Implement input validation & monitor vendor info: https://radar.offseq.com/threat/cve-2026-89310-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-4dc7d194ff0633df #OffSeq #SQLInjection #Vuln #Infosec

CVE-2026-104800: CRITICAL RCE flaw in streetforce1 AGE-GATE WordPress plugin (≤1.0). Unauthenticated attackers can run arbitrary code via unsafe admin.php endpoint. Remove or restrict plugin use ASAP. https://radar.offseq.com/threat/cve-2026-104800-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-streetforce1-age-gate-02cdeee893e722b9 #OffSeq #WordPress #Vuln #RCE

CVE-2026-87855: CRITICAL RCE in ntbyk JTL-Connector for WooCommerce (<=2.4.3). Unauthenticated file upload due to weak auth & validation. Restrict/disable plugin while awaiting patch. https://radar.offseq.com/threat/cve-2026-87855-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-ntbyk-jtl-connector-for-8335c9f626fb9c36 #OffSeq #WordPress #Security #CVE202687855

A SiteGuard Server Edition vulnerability, CVE-2026-106931, is exploited in the wild and grants root or SYSTEM access. Update to Ver8.00 Update 5 now.

#SiteGuard #CVE2026106931 #ExploitedInTheWild #WAF #CommandInjection #JPCERT #PatchNow #CyberSecurity

https://securityonline.info/siteguard-cve-2026-106931-exploited/?utm_source=mastodon&utm_medium=jetpack_social

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

🟠 CVE-2026-104749 - High (7.5)

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists bec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17092 - High (8.1)

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93388 - Critical (9.8)

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX actio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82715 - High (7.9)

Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.

This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-95634 - High (8.6)

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95634/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-95633 - High (7.5)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorize...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77206 - High (7.5)

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-95632 - High (7.5)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorize...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95632/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105902 - High (7.5)

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105902/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94453 - High (7.5)

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the cl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77207 - High (7.5)

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

PoC and technical details for CVE-2026-103572, an 8.8-severity Visual Studio Copilot RCE and SSMS flaw, are now public. Patch your IDE immediately.

#CVE2026103572 #VisualStudio #Copilot #RCE #MicrosoftSecurity #SSMS #Cybersecurity

https://securityonline.info/cve-2026-103572-visual-studio-copilot-rce-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

Patch four IBM WebSphere Liberty vulnerabilities, including critical 9.1-rated CVE-2026-93895 and CVE-2026-93909 authentication and access bypass flaws.

#IBM #WebSphereLiberty #CVE202693895 #CVE202693909 #Cybersecurity #InfoSec #EnterpriseSecurity

https://securityonline.info/critical-ibm-websphere-liberty-vulnerabilities-patched/?utm_source=mastodon&utm_medium=jetpack_social

Patch four IBM WebSphere Liberty vulnerabilities, including critical 9.1-rated CVE-2026-93895 and CVE-2026-93909 authentication and access bypass flaws.

#IBM #WebSphereLiberty #CVE202693895 #CVE202693909 #Cybersecurity #InfoSec #EnterpriseSecurity

https://securityonline.info/critical-ibm-websphere-liberty-vulnerabilities-patched/?utm_source=mastodon&utm_medium=jetpack_social

Patch CVE-2026-110005 (CVSS 9.9), a critical Komodo Periphery vulnerability allowing authenticated users to run arbitrary OS commands as root on the host.

#Komodo #CVE2026110005 #DockerSecurity #CommandInjection #CERTCC #Cybersecurity #LinuxSecurity

https://securityonline.info/komodo-periphery-command-injection-cve-2026-110005/?utm_source=mastodon&utm_medium=jetpack_social

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

🚨 PoC published for a Windows privilege escalation vulnerability involving the Windows Health and Optimized Experiences service; CVE-2026-85884

PoC: https://github.com/Beardhammer/CVE-2026-85884

The issue allows low-privileged code with access to the Windows diagnostics workflow to trigger a trusted ETW event containing an attacker-controlled Lua module path. The LocalSystem whesvc service can then execute that module through WinDiag without properly validating the producer or restricting the module location.

Affected: Windows 11 x64 builds including 26200.8457 and 29617.1000
Impact: Local privilege escalation to SYSTEM

The PoC demonstrates the full chain from a standard non-administrator PowerShell session to execution as NT AUTHORITY\SYSTEM.

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

CW: sebezhetőség(ek) — Microsoft októberi Patch Tuesday: 1 413 javítás, ebből 1 102 Windows-hoz. Aktívan kihasznált: CVE-2026-96951 (Windows Shell, CVSS 8.8) — bekerült a CISA KEV listájára, szövetségi határidő: 2026-10-16. Figyelem még: CVE-2026-108398 (.NET, WDAC kerülés). Részletek: https://linuxmint.hu/hir/2026/10/rekordot-dontott-a-microsoft-1-413-sebezhetoseget-foltoztak-koztuk-egy-aktivan
#Windows #CVE #infosec #cybersecurity

⚠️ CRITICAL: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Microsoft patched 1,411 vulnerabilities in October 2026, including three zero-days: CVE-2026-96951 (Windows Shell, actively exploited) and CVE-2026-108398 (.NET Framework, publicly disclosed). CVE-2026-108398 allows attackers to bypass Windows Defender Application Control and execute unauthorized a…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

An unpatched Shopware vulnerability, CVE-2026-104937, lets stored XSS steal admin tokens and lead to RCE in Shopware 6.7. Restrict media uploads now.

#Shopware #CVE2026104937 #StoredXSS #Ecommerce #CERTCC #RCE #Unpatched #CyberSecurity

https://securityonline.info/shopware-vulnerability-cve-2026-104937/?utm_source=mastodon&utm_medium=jetpack_social

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

Fortinet has several new advisories today, one of them relates to a critical vulnerability.

Fortinet: CRITICAL: CVE-2026-106173: improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets https://app.opencve.io/cve/CVE-2026-106173 #Fortinet #infosec #vulnerability

@cR0w Not a perfect 10, but you've been quieter recently, so I thought I'd gift you this.

Docker Hub Security Advisory: CVE-2026-105445 | Docker #devopsish https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

GhostPat : cette faille critique Docker Hub permettait d’usurper n’importe quel utilisateur https://www.it-connect.fr/docker-hub-faille-ghostpat-cve-2026-105445/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Docker

SANS Stormcast Thursday, October 15th, 2026: Orphaned VBA Macros in AutoCAD DWG Files; Ledger Wallet Hardware Implants; Docker Hub Token Bug (CVE-2026-105445); curl HTTP/2 RCE
https://isc.sans.edu/podcastdetail/10138

Docker Hub Fixes Critical Token Flaw Enabling User Impersonation

Docker Hub resolved a critical vulnerability (CVE-2026-105445) that allowed attackers to impersonate users and tamper with container images by exploiting a flaw in the account conversion process.

**Check your email for a notification from Docker to see if your account was part of the affected group. Even if you were not notified, rotate your personal access tokens regularly and limit their permissions to only what is necessary.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/docker-hub-fixes-critical-token-flaw-enabling-user-impersonation-1-2-w-t-a/gD2P6Ple2L

Hypervisor escape patches for XenServer 8.4 and XenServer 9

CVE-2026-79610
CVE-2026-102700
CVE-2026-102701

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697170&articleTitle=XenServer_Security_Update_for_CVE_2026_79610_CVE_2026_79610_CVE_2026_102700_and_CVE_2026_102701

Hypervisor escape patches for XenServer 8.4 and XenServer 9

CVE-2026-79610
CVE-2026-102700
CVE-2026-102701

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697170&articleTitle=XenServer_Security_Update_for_CVE_2026_79610_CVE_2026_79610_CVE_2026_102700_and_CVE_2026_102701

CVE-2026-104935 — an authentication bypass bundled with remote code execution — was only partially discovered and patched months prior, leaving just enough gap for root-level access on a fully patched box. Volexity spotted the exploitation while responding to a customer incident.

The species, it seems, does not survive being fully patched. Patch Ivanti Connect Secure for CVE-2026-104935 immediately and hunt for UTA0576 indicators of compromise across your environment. (2/3)

🚨 Rapid Response: Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)

Ivanti confirms active exploitation of a high-severity (CVSS 8.6) authentication bypass vulnerability in Ivanti Connect Secure that allows unauthenticated attackers to execute arbitrary commands. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 13.

Censys currently observes 7,604 Internet-exposed hosts and 269,319 web properties running Ivanti Connect Secure, excluding honeypots. These are total product exposures, not confirmed vulnerable systems.

Full Censys ARC advisory, including affected versions, available patches, and remediation guidance: https://censys.com/advisory/cve-2026-104935/

#CensysARC #Ivanti #Cybersecurity #VulnerabilityManagement #InfoSec

CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching

CW: Riasztás — Ivanti Connect Secure (CVE-2026-104935) és Microsoft Windows Shell (CVE-2026-96951) aktívan kihasznált, magas kockázatú sérülékenységek. Ivanti: érintett 25.1.3.0/25.1.3.1 és 22.8R2.5 előtti verziók; 25.1.1.2+ javasolt. Microsoft: MotW megkerülés, e-mail/üzenet útján terjesztett támadások. Frissíts, ellenőrizd naplókat és EDR-forensic vizsgálatokat. #Ivanti #CVE-2026-104935 #CVE-2026-96951 #Windows #infosec https://linuxmint.hu/hir/2026/10/riasztas-az-ivanti-connect-secure-es-a-microsoft-windows-shell-serulekenysegeirol

**Latest Global Updates (October 14-15, 2026)**

Cybersecurity: CISA urged immediate updates for Ivanti Connect Secure due to an actively exploited zero-day (CVE-2026-104935) found on Oct 14, 2026, enabling remote command execution. A global operation also disrupted a massive cybercriminal phishing network.

Technology: Samsung hosted its Future Wireless Summit on Oct 15, 2026, focusing on advancements in 6G and AI.

Geopolitics: FBI Director Kash Patel is reportedly in Russia (Oct 14-15, 2026) for high-level discussions on Ukraine and bilateral relations.

#AnonNews_irc #Cybersecurity #News

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-104935 – Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Executive briefing on CVE-2026-104935 impacting Ivanti Connect Secure, featuring active exploitation telemetry, backdoor removal strategies, and endpoint hardening protocols....

https://thecybermind.co/veou

⚠️Alerte CERT-FR⚠️

La vulnérabilité CVE-2026-CVE-2026-104935 permet à un attaquant non authentifié l'exécution de code arbitraire à distance dans Ivanti Connect Secure. Elle est activement exploitée.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/

(CISA TS-MAN) The Cyber Mind TSUITE Brief: CVE-2026-104935 – Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CVE-2026-104935 calls for version-specific review of Ivanti Connect Secure deployments. This technical brief covers vulnerability impact, remediation decisions, and investigation priorities while clearly identifying the limits of unvalidated detection content....

https://thecybermind.co/kjcm

Ivanti Connect Secure Zero-Day Chain Exploited for Root Access

Ivanti patched a zero-day chain (CVE-2026-104935) in its Connect Secure VPN that allowed attackers to gain root access and steal Active Directory credentials.

**If you use Ivanti Connect Secure VPN, this is urgent. Update right away to a fixed version (25.1.1.2, 25.1.3.0, 25.1.3.1 or 22.8R2.5) and run Ivanti's Integrity Checker Tool. Don't rely on a clean result alone, because the attackers hide in memory and erase their tracks. If your VPN was exposed, assume your network is compromised: get a full forensic review, and reset every domain, admin and LAPS password and BitLocker recovery key that could have passed through it.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/ivanti-connect-secure-zero-day-chain-exploited-for-root-access-l-a-l-7-8/gD2P6Ple2L

Discover how a critical Ivanti Connect Secure vulnerability (CVE-2026-104935) is chained in zero-day attacks to gain root access and steal network secrets.

#Ivanti #ConnectSecure #Cybersecurity #ZeroDay #InfoSec

https://securityexpress.info/ivanti-connect-secure-vulnerability-cve-2026-104935/?utm_source=mastodon&utm_medium=jetpack_social

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.

https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure

#CISA #KEV #Ivanti #zeroday

Nvidia AIStore CVSS 10.0: Container Escape and Host Takeover

NVIDIA AIStore v5.0 미만의 ETL API에서 사용자 제공 Kubernetes PodSpec을 역직렬화한 뒤 보안 필드를 제거하지 않고 Kubernetes API로 전달하는 CVE-2026-65162가 공개됐다. 인증 없이 `privileged: true`와 `hostPID: true`를 포함한 PodSpec을 제출하면, AIS ServiceAccount 권한으로 특권 컨테이너가 생성되고 `nsenter`를 통해 스토리지 노드 호스트의 root RCE 및 클러스터 장악으로 이어질 수 있다. 근본 원인은 운영 요건만 검사하는 검증 로직과, 인프라 실행 명세를 애...

https://mauri0x00.pages.dev/posts/shadowforge-aistore/

NVIDIA AIStore vulnerabilities, including a CVSS 10.0 flaw enabling remote code execution, lead 18 fixes across NVIDIA AI tools. Upgrade to AIStore 5.0.

#NVIDIA #AIStore #CVE202665162 #CVE202665173 #CVE202665172 #AISecurity #MegatronLM #CyberSecurity

https://securityonline.info/nvidia-aistore-vulnerabilities-cve-2026-65162/?utm_source=mastodon&utm_medium=jetpack_social

Patch your GitLabs https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee

🚨 PoC published for a critical GitLab CI/CD remote code execution vulnerability; CVE-2026-97229

PoC: https://github.com/jburgess-r7/CVE-2026-97229-PoC

The flaw is caused by an integer overflow in GitLab's regular expression compiler. A crafted CI/CD configuration combined with a specially formed repository path can corrupt Onigmo regex bytecode and ultimately execute operating system commands as the GitLab git user.

CVSS: 10.0 Critical
Affected: GitLab 19.2 < 19.2.8, 19.3 < 19.3.5, and 19.4 < 19.4.2
Fixed: GitLab 19.2.8, 19.3.5, and 19.4.2

The PoC was validated against GitLab CE 19.4.1 on Linux amd64 and demonstrates command execution through the public CI lint endpoint after the required malicious project setup.

GitLab corrige une faille critique qui permet d’exécuter du code sans authentification (CVE-2026-97229) https://www.it-connect.fr/gitlab-cve-2026-97229-faille-critique-regex-ci-cd/ #ActuCybersécurité #Cybersécurité

GitLab CI lint integer-overflow RCE PoC https://github.com/jburgess-r7/CVE-2026-97229-PoC

Technical details and PoC exploit code for CVE-2026-97229, a CVSS 10.0 GitLab RCE vulnerability exposing 25,766 hosts, are now public. Patch to 19.4.2 now.

#CVE202697229 #GitLab #RCE #DevSecOps #Cybersecurity #InfoSec #Vulnerability

https://securityonline.info/gitlab-rce-cve-2026-97229-poc-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

Vorfall-Lagebild: GitLab: kritische Lücke CVE-2026-97229

Erstmeldung zu „GitLab: kritische Lücke CVE-2026-97229“: was bekannt ist, was offen ist und was wahrscheinlich passiert ist.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/vorfall-lagebild-gitlab-kritische-luecke-cve-2026-97229.html

A GitLab critical vulnerability, CVE-2026-97229, allows unauthenticated code execution. Update to 19.2.8, 19.3.5, or 19.4.2 now.

#GitLab #CVE202697229 #RCE #CICD #DevSecOps #Vulnerability #PatchNow #GitLabDuo