{"meta":{"aiCadenceHours":6,"liveCadenceMinutes":15,"liveUpdatedAt":"2026-10-12T12:15:35.583Z","aiUpdatedAt":"2026-10-12T12:00:57.654Z","xHandles":["CISAgov","NSACyber","FBI","NCSC","MsftSecIntel","Unit42_Intel","TalosSecurity","CrowdStrike","Mandiant","ESETresearch","kaspersky","SentinelOne","rapid7","HuntressLabs","watchtowrcyber","threatintel","RecordedFuture","vxunderground","malwrhunterteam","BleepinComputer","TheRecord_Media","briankrebs","campuscodi","cyb3rops","GossiTheDog","_JohnHammond","Cyber_O51NT","ransomwaremap"],"xHandlesDarknet":["DarkWebInformer","FalconFeedsio","H4ckManac","DailyDarkWeb","DarkTracer_int","AlvieriD","BrettCallow","Cyberknow20","MonThreat","socradar","AuCyble","ransomwaremap","vxunderground"],"xHandlesUsed":["CISAgov","MsftSecIntel","Mandiant","vxunderground","DarkWebInformer","BleepinComputer","TalosSecurity","CrowdStrike","ESETresearch","kaspersky"],"mode":"live","askEnabled":false,"askSiteKey":"","dossierRefresh":false,"riskNarrative":false,"turnstileSiteKey":"","level":"High","levelScore":6.3,"servedAt":"2026-10-12T12:26:21.632Z"},"live":{"updatedAt":"2026-10-12T12:15:35.583Z","stats":{"kev24h":0,"kev7d":5,"kevTotal":1739,"cve24h":259,"cveHigh24h":46,"iocs24h":0,"families24h":0,"actorsTracked":10,"attackTrafficDelta7d":null},"series":{"days":["Oct 6","Oct 7","Oct 8","Oct 9","Oct 10","Oct 11","Oct 12"],"kevDaily":[0,0,5,0,0,0,0],"cveHighDaily":[0,0,0,0,0,0,80],"iocDaily":[0,0,0,0,0,0,0],"attackTraffic":[]},"kev":[{"cveId":"CVE-2015-5477","vendor":"ISC","product":"BIND","name":" ISC BIND Data Processing Errors Vulnerability","dateAdded":"2026-10-08","dueDate":"2026-10-11","ransomwareUse":"Known","cvss":7.5,"epss":0.994,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477"},{"cveId":"CVE-2016-3081","vendor":"Apache","product":"Struts","name":"Apache Struts Command Injection Vulnerability","dateAdded":"2026-10-08","dueDate":"2026-10-11","ransomwareUse":"Known","cvss":8.1,"epss":0.961,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081"},{"cveId":"CVE-2023-22894","vendor":"Strapi","product":"Strapi","name":"Strapi Cleartext Storage of Sensitive Information Vulnerability","dateAdded":"2026-10-08","dueDate":"2026-10-11","ransomwareUse":"Known","cvss":4.9,"epss":0.036,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894"},{"cveId":"CVE-2021-3199","vendor":"ONLYOFFICE","product":"Docs","name":"ONLYOFFICE Docs Server Path Traversal Vulnerability","dateAdded":"2026-10-08","dueDate":"2026-10-11","ransomwareUse":"Known","cvss":9.8,"epss":0.194,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199"},{"cveId":"CVE-2015-3306","vendor":"ProFTPD","product":"ProFTPD","name":"ProFTPD Improper Access Control Vulnerability","dateAdded":"2026-10-08","dueDate":"2026-10-11","ransomwareUse":"Known","cvss":10,"epss":0.995,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306"},{"cveId":"CVE-2026-88779","vendor":"Citrix","product":"NetScaler","name":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","dateAdded":"2026-10-04","dueDate":"2026-10-07","ransomwareUse":"Known","cvss":8.7,"epss":0.006,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779"},{"cveId":"CVE-2026-102490","vendor":"Zammad GmbH","product":"Zammad","name":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","dateAdded":"2026-10-02","dueDate":"2026-10-05","ransomwareUse":"Known","cvss":9.4,"epss":0.006,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102490"},{"cveId":"CVE-2026-102489","vendor":"Zammad GmbH","product":"Zammad","name":"Zammad GmbH Zammad Session Fixation Vulnerability","dateAdded":"2026-10-02","dueDate":"2026-10-05","ransomwareUse":"Known","cvss":9.4,"epss":0.013,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102489"},{"cveId":"CVE-2026-104286","vendor":"Fortinet","product":"FortiMail","name":"Fortinet FortiMail Path Traversal Vulnerability","dateAdded":"2026-10-01","dueDate":"2026-10-04","ransomwareUse":"Known","cvss":9.8,"epss":0.022,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104286"},{"cveId":"CVE-2026-76504","vendor":"Cisco","product":"Catalyst SD-WAN Manager","name":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","dateAdded":"2026-09-30","dueDate":"2026-10-03","ransomwareUse":"Known","cvss":9.8,"epss":0.018,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76504"},{"cveId":"CVE-2026-86950","vendor":"Apple","product":"Multiple Products","name":"Apple Multiple Products Out-of-Bounds Write Vulnerability","dateAdded":"2026-09-29","dueDate":"2026-10-13","ransomwareUse":"Known","cvss":8.8,"epss":0.012,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86950"},{"cveId":"CVE-2026-88772","vendor":"Citrix","product":"NetScaler","name":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","dateAdded":"2026-09-27","dueDate":"2026-09-30","ransomwareUse":"Known","cvss":9.5,"epss":0.013,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88772"},{"cveId":"CVE-2026-88771","vendor":"Citrix","product":"NetScaler","name":"Citrix NetScaler Improper Input Validation Vulnerability","dateAdded":"2026-09-27","dueDate":"2026-09-30","ransomwareUse":"Known","cvss":9.5,"epss":0.011,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88771"},{"cveId":"CVE-2026-67279","vendor":"MikroTik","product":"RouterOS","name":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","dateAdded":"2026-09-25","dueDate":"2026-09-28","ransomwareUse":"Known","cvss":6.9,"epss":0.01,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279"},{"cveId":"CVE-2026-65660","vendor":"Microsoft","product":"SharePoint","name":"Microsoft SharePoint Code Injection Vulnerability","dateAdded":"2026-09-25","dueDate":"2026-09-28","ransomwareUse":"Known","cvss":8.8,"epss":0.021,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660"},{"cveId":"CVE-2026-87902","vendor":"WordPress","product":"Core","name":"WordPress Core Remote File Inclusion Vulnerability","dateAdded":"2026-09-25","dueDate":"2026-09-28","ransomwareUse":"Known","cvss":8.1,"epss":0.4,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902"},{"cveId":"CVE-2026-5430","vendor":"WSO2","product":"Multiple Products","name":"WSO2 Multiple Products Path Traversal Vulnerability ","dateAdded":"2026-09-24","dueDate":"2026-09-27","ransomwareUse":"Known","cvss":10,"epss":0.006,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430"},{"cveId":"CVE-2026-71362","vendor":"Adobe","product":"Commerce and Magento ","name":"Adobe Commerce and Magento Incorrect Authorization Vulnerability ","dateAdded":"2026-09-24","dueDate":"2026-09-27","ransomwareUse":"Known","cvss":9.1,"epss":0.875,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362"},{"cveId":"CVE-2026-93952","vendor":"Arista","product":"VeloCloud Orchestrator","name":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","dateAdded":"2026-09-22","dueDate":"2026-09-25","ransomwareUse":"Known","cvss":9.5,"epss":0.011,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952"},{"cveId":"CVE-2026-94127","vendor":"F5","product":"BIG-IP APM","name":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","dateAdded":"2026-09-22","dueDate":"2026-09-25","ransomwareUse":"Known","cvss":9.3,"epss":0.022,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127"},{"cveId":"CVE-2026-93616","vendor":"Check Point","product":"Multiple Products","name":"Check Point Multiple Products Path Traversal Vulnerability","dateAdded":"2026-09-22","dueDate":"2026-09-25","ransomwareUse":"Known","cvss":9.8,"epss":0.197,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616"},{"cveId":"CVE-2026-85102","vendor":"Check Point","product":"Multiple Products","name":"Check Point Multiple Products Improper Certificate Validation Vulnerability","dateAdded":"2026-09-22","dueDate":"2026-09-25","ransomwareUse":"Known","cvss":9.8,"epss":0.075,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102"},{"cveId":"CVE-2026-7273","vendor":"Zyxel","product":"GS1900 Series Switches","name":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","dateAdded":"2026-09-21","dueDate":"2026-09-24","ransomwareUse":"Known","cvss":8.8,"epss":0.025,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273"},{"cveId":"CVE-2025-39964","vendor":"Linux","product":"Kernel","name":"Linux Kernel Race Condition Vulnerability","dateAdded":"2026-09-18","dueDate":"2026-09-21","ransomwareUse":"Known","cvss":7.8,"epss":0.013,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964"},{"cveId":"CVE-2026-53266","vendor":"Linux","product":"Kernel","name":"Linux Kernel Out-of-Bounds Write Vulnerability","dateAdded":"2026-09-18","dueDate":"2026-09-21","ransomwareUse":"Known","cvss":8.8,"epss":0.008,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266"}],"cves":[{"cveId":"CVE-2026-108576","published":"2026-10-11","cvss":10,"severity":"Critical","vendor":"","description":"A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely.…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108576"},{"cveId":"CVE-2026-66086","published":"2026-10-12","cvss":9.8,"severity":"Critical","vendor":"In","description":"In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66086"},{"cveId":"CVE-2026-108753","published":"2026-10-11","cvss":9.3,"severity":"Critical","vendor":"Agnaistic","description":"Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108753"},{"cveId":"CVE-2026-108860","published":"2026-10-11","cvss":9.3,"severity":"Critical","vendor":"BotSharp","description":"BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108860"},{"cveId":"CVE-2026-108804","published":"2026-10-12","cvss":9.3,"severity":"Critical","vendor":"","description":"A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108804"},{"cveId":"CVE-2026-21120","published":"2026-10-12","cvss":8.9,"severity":"High","vendor":"Use","description":"Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21120"},{"cveId":"CVE-2026-108758","published":"2026-10-11","cvss":8.8,"severity":"High","vendor":"Easy","description":"Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108758"},{"cveId":"CVE-2026-108865","published":"2026-10-11","cvss":8.8,"severity":"High","vendor":"AmoyLab Unla","description":"AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108865"},{"cveId":"CVE-2026-108963","published":"2026-10-11","cvss":8.8,"severity":"High","vendor":"","description":"databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108963"},{"cveId":"CVE-2026-108980","published":"2026-10-12","cvss":8.8,"severity":"High","vendor":"Blinko","description":"Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108980"},{"cveId":"CVE-2026-87690","published":"2026-10-12","cvss":8.8,"severity":"High","vendor":"The Metasploit","description":"The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87690"},{"cveId":"CVE-2026-108714","published":"2026-10-11","cvss":8.7,"severity":"High","vendor":"MCP Kotlin","description":"MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108714"},{"cveId":"CVE-2026-108739","published":"2026-10-11","cvss":8.7,"severity":"High","vendor":"OpenAgents Workspace","description":"OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108739"},{"cveId":"CVE-2026-108746","published":"2026-10-11","cvss":8.7,"severity":"High","vendor":"Vearch","description":"Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108746"},{"cveId":"CVE-2026-108859","published":"2026-10-11","cvss":8.7,"severity":"High","vendor":"","description":"mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108859"},{"cveId":"CVE-2026-108863","published":"2026-10-11","cvss":8.7,"severity":"High","vendor":"Katanemo Plano","description":"Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108863"},{"cveId":"CVE-2026-108905","published":"2026-10-11","cvss":8.7,"severity":"High","vendor":"","description":"pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108905"},{"cveId":"CVE-2026-108718","published":"2026-10-11","cvss":8.6,"severity":"High","vendor":"Rill","description":"Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108718"},{"cveId":"CVE-2026-21124","published":"2026-10-12","cvss":8.6,"severity":"High","vendor":"Improper","description":"Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21124"},{"cveId":"CVE-2026-21125","published":"2026-10-12","cvss":8.6,"severity":"High","vendor":"Improper","description":"Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21125"},{"cveId":"CVE-2026-108698","published":"2026-10-11","cvss":8.3,"severity":"High","vendor":"","description":"hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108698"},{"cveId":"CVE-2026-108699","published":"2026-10-11","cvss":8.3,"severity":"High","vendor":"","description":"hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108699"},{"cveId":"CVE-2026-108729","published":"2026-10-11","cvss":8.2,"severity":"High","vendor":"Corteza","description":"Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108729"},{"cveId":"CVE-2026-19669","published":"2026-10-11","cvss":7.8,"severity":"High","vendor":"The","description":"The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len],…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19669"},{"cveId":"CVE-2026-19736","published":"2026-10-11","cvss":7.8,"severity":"High","vendor":"The NXP","description":"The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which always…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19736"},{"cveId":"CVE-2026-108976","published":"2026-10-11","cvss":7.8,"severity":"High","vendor":"GNU Emacs","description":"GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108976"},{"cveId":"CVE-2026-108737","published":"2026-10-11","cvss":7.6,"severity":"High","vendor":"Traccar","description":"Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108737"},{"cveId":"CVE-2026-108759","published":"2026-10-11","cvss":7.6,"severity":"High","vendor":"","description":"mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108759"},{"cveId":"CVE-2026-19935","published":"2026-10-11","cvss":7.5,"severity":"High","vendor":"The Bluetooth","description":"The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19935"},{"cveId":"CVE-2026-108744","published":"2026-10-11","cvss":7.3,"severity":"High","vendor":"","description":"pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108744"},{"cveId":"CVE-2026-21139","published":"2026-10-12","cvss":7.3,"severity":"High","vendor":"Improper","description":"Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21139"},{"cveId":"CVE-2026-108740","published":"2026-10-11","cvss":7.2,"severity":"High","vendor":"GoatCounter","description":"GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108740"},{"cveId":"CVE-2026-108760","published":"2026-10-11","cvss":7.2,"severity":"High","vendor":"LlamaFarm","description":"LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108760"},{"cveId":"CVE-2026-108853","published":"2026-10-11","cvss":7.2,"severity":"High","vendor":"UnicomAI Wanwu","description":"UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108853"},{"cveId":"CVE-2026-108902","published":"2026-10-11","cvss":7.2,"severity":"High","vendor":"","description":"pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108902"},{"cveId":"CVE-2026-108982","published":"2026-10-12","cvss":7.2,"severity":"High","vendor":"VeraCrypt","description":"VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108982"},{"cveId":"CVE-2026-108710","published":"2026-10-11","cvss":7.1,"severity":"High","vendor":"NornicDB","description":"NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108710"},{"cveId":"CVE-2026-108728","published":"2026-10-11","cvss":7.1,"severity":"High","vendor":"Flyte","description":"Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108728"},{"cveId":"CVE-2026-108757","published":"2026-10-11","cvss":7.1,"severity":"High","vendor":"Nexting","description":"Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108757"},{"cveId":"CVE-2026-108883","published":"2026-10-11","cvss":7.1,"severity":"High","vendor":"JeecgBoot","description":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent…","kev":false,"epss":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108883"}],"malware":[],"iocs":[],"ticker":[{"ts":"2026-10-12T12:15:35.583Z","kind":"advisory","severity":"High","title":"Leak sites: 25 new ransomware victims posted in 24 hours; most active this week qilin 14, n0n 13, umbra 9","source":"ransomware.live","url":"https://www.ransomware.live/"},{"ts":"2026-10-12T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-108804 scored 9.3 — A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108804"},{"ts":"2026-10-12T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-66086 scored 9.8 — In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66086"},{"ts":"2026-10-12T12:00:00.000Z","kind":"news","severity":"Medium","title":"The Record: Ukraine strikes third Yandex data center, disrupting digital services across Russia","source":"The Record","url":"https://therecord.media/ukraine-strikes-third-yandex-data-center"},{"ts":"2026-10-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-108860 scored 9.3 — BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108860"},{"ts":"2026-10-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-108753 scored 9.3 — Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108753"},{"ts":"2026-10-11T12:00:00Z","kind":"cve","severity":"Critical","title":"NVD: CVE-2026-108576 scored 10.0 — A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping…","source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108576"},{"ts":"2026-10-10T00:17:42.000Z","kind":"news","severity":"Medium","title":"Krebs on Security: FBI Arrests Executive at Ransomware Negotiation Firm","source":"Krebs on Security","url":"https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/"},{"ts":"2026-10-09T18:45:00.000Z","kind":"news","severity":"Medium","title":"The Record: Japan confirms arrest of Russian Qilin operative, extradition to Germany","source":"The Record","url":"https://therecord.media/japan-germany-ransomware-arrest"},{"ts":"2026-10-09T18:19:17.000Z","kind":"advisory","severity":"High","title":"AWS Security Bulletins: CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF","source":"AWS Security Bulletins","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-048-aws/"},{"ts":"2026-10-09T16:06:00.000Z","kind":"news","severity":"Medium","title":"The Record: Hundreds of thousands impacted by data breach at biosensor firm iRhythm","source":"The Record","url":"https://therecord.media/irhythm-data-breach-reports"},{"ts":"2026-10-09T16:06:00.000Z","kind":"news","severity":"Medium","title":"The Record: Leader of vast money mule operation that laundered cybercriminal proceeds pleads guilty","source":"The Record","url":"https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty"},{"ts":"2026-10-09T15:41:00.000Z","kind":"news","severity":"Medium","title":"The Record: FBI touts another ShinyHunters arrest in response to data breach","source":"The Record","url":"https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation"},{"ts":"2026-10-09T11:00:52.000Z","kind":"news","severity":"Medium","title":"Rapid7: Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules","source":"Rapid7","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-a-collection-of-what-can-only-be-called-eclectic-modules"},{"ts":"2026-10-09T09:00:00Z","kind":"cve","severity":"Critical","title":"GitHub Advisory: GHSA-p393-cf76-4jmr / CVE-2026-107806 in go github.com/0xJacky/Nginx-UI — Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite","source":"GitHub Security Advisories","url":"https://github.com/advisories/GHSA-p393-cf76-4jmr"},{"ts":"2026-10-09T09:00:00Z","kind":"cve","severity":"Critical","title":"GitHub Advisory: GHSA-628f-v4f6-p37r / CVE-2026-107845 in composer contao/comments-bundle — Contao: Cross-site scripting in the comments bundle","source":"GitHub Security Advisories","url":"https://github.com/advisories/GHSA-628f-v4f6-p37r"},{"ts":"2026-10-09T09:00:00Z","kind":"cve","severity":"Critical","title":"GitHub Advisory: GHSA-x34j-47hf-4xg7 / CVE-2026-108261 in npm tinacms — TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment","source":"GitHub Security Advisories","url":"https://github.com/advisories/GHSA-x34j-47hf-4xg7"},{"ts":"2026-10-08T20:44:28.000Z","kind":"news","severity":"Medium","title":"Microsoft Security: Post-quantum authentication: Why organizations should start testing certificate ecosystems now","source":"Microsoft Security","url":"https://www.microsoft.com/en-us/security/blog/2026/10/08/post-quantum-authentication-why-organizations-should-start-testing-certificate-ecosystems-now/"},{"ts":"2026-10-08T18:49:39.000Z","kind":"advisory","severity":"High","title":"AWS Security Bulletins: Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 & CVE-2026-8597)","source":"AWS Security Bulletins","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-031-aws/"},{"ts":"2026-10-08T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2015-3306 ProFTPD ProFTPD proftpd improper access control vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306"},{"ts":"2026-10-08T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2021-3199 ONLYOFFICE Docs onlyoffice docs server path traversal vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199"},{"ts":"2026-10-08T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2023-22894 Strapi Strapi strapi cleartext storage of sensitive information vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894"},{"ts":"2026-10-08T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2016-3081 Apache Struts apache struts command injection vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081"},{"ts":"2026-10-08T12:00:00Z","kind":"kev","severity":"Critical","title":"CISA KEV: CVE-2015-5477 ISC BIND  isc bind data processing errors vulnerability added, ransomware use known","source":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477"}],"advisories":[{"title":"Ukraine strikes third Yandex data center, disrupting digital services across Russia","source":"The Record","kind":"news","published":"2026-10-12T12:00:00.000Z","url":"https://therecord.media/ukraine-strikes-third-yandex-data-center","summary":"A third Yandex data center in Russia was hit by Ukrainian drones over the weekend, forcing it to shut down and causing further disruptions to cloud services, payments, deliveries and other online services across the country."},{"title":"FBI Arrests Executive at Ransomware Negotiation Firm","source":"Krebs on Security","kind":"news","published":"2026-10-10T00:17:42.000Z","url":"https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/","summary":"Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive…"},{"title":"Japan confirms arrest of Russian Qilin operative, extradition to Germany","source":"The Record","kind":"news","published":"2026-10-09T18:45:00.000Z","url":"https://therecord.media/japan-germany-ransomware-arrest","summary":"Japan’s National Police Agency confirmed the arrest and extradition to Germany of a Russian national accused of being involved in the Qilin ransomware gang."},{"title":"CVE-2026-13762 and CVE-2026-13763 - Issue with HTTP/2 multi-frame request body inspection in AWS WAF","source":"AWS Security Bulletins","kind":"psirt","published":"2026-10-09T18:19:17.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-048-aws/","summary":""},{"title":"Leader of vast money mule operation that laundered cybercriminal proceeds pleads guilty","source":"The Record","kind":"news","published":"2026-10-09T16:06:00.000Z","url":"https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty","summary":"Oleg Korniev, a 42-year-old dual citizen of Ukraine and Russia, was a principal of Your Mule Cashout, or “YMCO,” which from 2007 until 2014 set up a sophisticated network of mules in the U.S. and Europe."},{"title":"Hundreds of thousands impacted by data breach at biosensor firm iRhythm","source":"The Record","kind":"news","published":"2026-10-09T16:06:00.000Z","url":"https://therecord.media/irhythm-data-breach-reports","summary":"A company known for wearable cardiac sensors, iRhythm, has begun notifying states of the impact of a data breach from the summer."},{"title":"FBI touts another ShinyHunters arrest in response to data breach","source":"The Record","kind":"news","published":"2026-10-09T15:41:00.000Z","url":"https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation","summary":"“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate,\" FBI Director Kash Patel said."},{"title":"Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules","source":"Rapid7","kind":"research","published":"2026-10-09T11:00:52.000Z","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-a-collection-of-what-can-only-be-called-eclectic-modules","summary":""},{"title":"Post-quantum authentication: Why organizations should start testing certificate ecosystems now","source":"Microsoft Security","kind":"partner","published":"2026-10-08T20:44:28.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/10/08/post-quantum-authentication-why-organizations-should-start-testing-certificate-ecosystems-now/","summary":"Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps advance future readiness. The post Post-quantum authentication: Why organizations should start testing…"},{"title":"Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 & CVE-2026-8597)","source":"AWS Security Bulletins","kind":"psirt","published":"2026-10-08T18:49:39.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-031-aws/","summary":""},{"title":"Making sure the checks get printed","source":"Cisco Talos","kind":"research","published":"2026-10-08T18:00:29.000Z","url":"https://blog.talosintelligence.com/making-sure-the-checks-get-printed/","summary":"Pierre's debut newsletter explores the messy, real-world side of risk management and how to keep vital systems running when a perfect patch isn't an option."},{"title":"CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code","source":"AWS Security Bulletins","kind":"psirt","published":"2026-10-08T17:43:09.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-129-aws/","summary":"Bulletin ID: 2026-129-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 10:30 PM PDT Description: AWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS…"},{"title":"Cisco NX-OS Software NX-API Remote Code Execution Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-08T14:11:23.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20NX-API%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","summary":"A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The…"},{"title":"Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data","source":"CISA","kind":"gov","published":"2026-10-08T12:00:00.000Z","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a","summary":"Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat…"},{"title":"Red Lion Controls N-Tron 700 Series","source":"CISA","kind":"gov","published":"2026-10-08T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01","summary":"View CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further,…"},{"title":"Grid Protection Alliance openPDC and openHistorian","source":"CISA","kind":"gov","published":"2026-10-08T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","summary":"View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker…"},{"title":"Satel Netco Design","source":"CISA","kind":"gov","published":"2026-10-08T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-03","summary":"View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially…"},{"title":"UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing","source":"Cisco Talos","kind":"research","published":"2026-10-08T10:01:06.000Z","url":"https://blog.talosintelligence.com/uat-11985/","summary":"Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions."},{"title":"Ignore all instructions and read this blog: The state of AI-analysis evasion in malware","source":"Cisco Talos","kind":"research","published":"2026-10-08T10:00:14.000Z","url":"https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/","summary":"“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis."},{"title":"CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage","source":"CrowdStrike","kind":"partner","published":"2026-10-08T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-anthropic-critical-infrastructure-defense-program/","summary":""},{"title":"Solving the Continuous Authorization Conundrum","source":"CrowdStrike","kind":"partner","published":"2026-10-08T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/solving-the-continuous-authorization-conundrum/","summary":""},{"title":"Cisco Meraki Security Hardening Release: October 2026","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-08T00:18:38.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally…"},{"title":"Evolution of Web3 in Cloud Supply Chain Attacks","source":"Unit 42","kind":"partner","published":"2026-10-07T22:00:16.000Z","url":"https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/","summary":"Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42 ."},{"title":"Issue with FreeRTOS-Plus-TCP - MAC Address Validation Bypass and ICMP Echo Reply Integer Underflow","source":"AWS Security Bulletins","kind":"psirt","published":"2026-10-07T20:16:45.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-021-aws/","summary":""},{"title":"Four compliance frameworks, one security team: Why fragmented university security raises regulatory risk","source":"Rapid7","kind":"research","published":"2026-10-07T19:29:23.000Z","url":"https://www.rapid7.com/blog/post/it-compliance-frameworks-for-universities-drowning-in-regulatory-risk","summary":"In Part 1 of this series, we looked at the security challenges created by fragmented, campus-by-campus environments. Higher education also faces a second pressure that makes that fragmentation harder to sustain: overlapping compliance…"},{"title":"Microsoft, Adobe, Apple, and Foxit vulnerabilities","source":"Cisco Talos","kind":"research","published":"2026-10-07T19:27:08.000Z","url":"https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/","summary":"Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in…"},{"title":"Cisco Advance Notification for Publication of October 7, 2026, Security Advisories","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:41.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-fBn58ELx?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20October%207,%202026,%20Security%20Advisories%26vs_k=1","summary":"On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly…"},{"title":"3 lessons from frontier AI vulnerability research","source":"Microsoft Security","kind":"partner","published":"2026-10-07T16:00:00.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/","summary":"Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel. The post 3 lessons from frontier AI vulnerability research appeared first on Microsoft Security Blog ."},{"title":"Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Application%20Policy%20Infrastructure%20Controller%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted…"},{"title":"Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%203000%20and%209000%20Series%20Switches%20NGOAM%20Remote%20Code%20Execution%20Vulnerabilities%26vs_k=1","summary":"Multiple vulnerabilities in the Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as Next Generation OAM (NGOAM), could allow an unauthenticated, remote attacker to execute arbitrary code with root…"},{"title":"Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%209000%20Series%20Fabric%20Switches%20in%20ACI%20Mode%20Endpoint%20Group%20Contract%20Bypass%20Vulnerability%26vs_k=1","summary":"A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts. This vulnerability is due to an…"},{"title":"Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20License%20(Smart%20Software%20Manager)%20On-Prem%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security…"},{"title":"Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cmdinj-L6VR4E7?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Application%20Policy%20Infrastructure%20Controller%20API%20Command%20Injection%20Vulnerability%26vs_k=1","summary":"A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the…"},{"title":"Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-info-priv-enAdB5vD?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Application%20Policy%20Infrastructure%20Controller%20Unauthorized%20File%20Access%20Vulnerability%26vs_k=1","summary":"A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this…"},{"title":"Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Nexus%203000%20and%209000%20Series%20Switches%20MPLS%20OAM%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","summary":"A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to…"},{"title":"Cisco Finesse Server-Side Request Forgery Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Finesse%20Server-Side%20Request%20Forgery%20Vulnerability%26vs_k=1","summary":"A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper…"},{"title":"Cisco NX-OS Software Python Sandbox Escape Vulnerability","source":"Cisco PSIRT","kind":"psirt","published":"2026-10-07T16:00:00.000Z","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20NX-OS%20Software%20Python%20Sandbox%20Escape%20Vulnerability%26vs_k=1","summary":"A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected…"},{"title":"How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)","source":"Wiz Research","kind":"partner","published":"2026-10-07T14:53:27.000Z","url":"https://www.wiz.io/blog/red-agent-financial-services-data-exposure","summary":"Traditional DSPM and classification tools scan from the inside out. Thinking like an attacker, the Red Agent found a public page exposing sensitive data in minutes."},{"title":"ShinyHunters Extorted Boeing Spin-off Prior to Arrests","source":"Krebs on Security","kind":"news","published":"2026-10-07T13:48:45.000Z","url":"https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/","summary":"A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has…"},{"title":"CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products","source":"Rapid7","kind":"research","published":"2026-10-07T12:11:26.000Z","url":"https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products","summary":"Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589 , a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data…"},{"title":"The ASOS Incident: When Attackers Use the Channels Customers Trust","source":"Rapid7","kind":"research","published":"2026-10-07T10:40:07.000Z","url":"https://www.rapid7.com/blog/post/it-asos-incident-attackers-using-channels-customers-trust","summary":"This week, ASOS customers opened their phones to find a hostile push notification delivered through the retailer’s own app. The message claimed the company’s Snowflake environment had been compromised and directed ASOS to engage with the…"},{"title":"One breach, please, and make no mistakes","source":"Cisco Talos","kind":"research","published":"2026-10-07T10:00:25.000Z","url":"https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes/","summary":"The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents."},{"title":"CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment","source":"CrowdStrike","kind":"partner","published":"2026-10-07T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-named-leader-2026-idc-marketscape-worldwide-modern-endpoint-security-for-enterprises/","summary":""},{"title":"Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance","source":"CrowdStrike","kind":"partner","published":"2026-10-07T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/","summary":""},{"title":"CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF","source":"AWS Security Bulletins","kind":"psirt","published":"2026-10-06T20:41:24.000Z","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-127-aws/","summary":"Bulletin ID: 2026-127-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/06/2026 13:30 PM PDT Description: bedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via…"},{"title":"CISO perspectives on managing vulnerability risks in the age of AI","source":"Microsoft Security","kind":"partner","published":"2026-10-06T16:00:00.000Z","url":"https://www.microsoft.com/en-us/security/blog/2026/10/06/ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai/","summary":"Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management. The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security…"},{"title":"Securing Agent-to-Agent Communication: The Next Identity Frontier","source":"Rapid7","kind":"research","published":"2026-10-06T14:11:03.000Z","url":"https://www.rapid7.com/blog/post/ai-securing-agent-to-agent-communication-next-identity-frontier","summary":"As organizations deploy autonomous AI agents, security teams face a significant shift as non-human non-human entities making decisions, invoking tools, and delegating tasks to other agents without human intervention. Security…"},{"title":"Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure","source":"Wiz Research","kind":"partner","published":"2026-10-06T13:47:28.000Z","url":"https://www.wiz.io/blog/introducing-wiz-ai-sast","summary":"Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized within your existing security program."},{"title":"Savannah lwIP SMTP client","source":"CISA","kind":"gov","published":"2026-10-06T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02","summary":"View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP…"},{"title":"Hitachi Energy RTU500","source":"CISA","kind":"gov","published":"2026-10-06T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06","summary":"View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy…"},{"title":"Hitachi Energy SOI","source":"CISA","kind":"gov","published":"2026-10-06T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04","summary":"View CSAF Summary Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks…"},{"title":"Hitachi Energy Asset Suite","source":"CISA","kind":"gov","published":"2026-10-06T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-03","summary":"View CSAF Summary Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality,…"},{"title":"Hitachi Energy REB500","source":"CISA","kind":"gov","published":"2026-10-06T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-05","summary":"View CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the…"},{"title":"Johnson Controls EasyIO FG","source":"CISA","kind":"gov","published":"2026-10-06T12:00:00.000Z","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-01","summary":"View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following versions of Johnson Controls EasyIO FG are affected: EasyIO FG firmware <=2.0b52…"},{"title":"Blinder Tunnel Campaign Targets Iraqi Infrastructure","source":"Unit 42","kind":"partner","published":"2026-10-06T10:00:33.000Z","url":"https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/","summary":"Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit…"},{"title":"Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers","source":"CrowdStrike","kind":"partner","published":"2026-10-06T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/","summary":""},{"title":"What’s New in Wiz Service Catalog: Smarter Discovery, Governance, and Service-Level Context","source":"Wiz Research","kind":"partner","published":"2026-10-05T16:00:00.000Z","url":"https://www.wiz.io/blog/wiz-service-catalog-updates","summary":"Build your Service Catalog faster, keep service context current, and give teams a clearer path from cloud risk to accountability"},{"title":"New in Falcon Cloud Security: Third-Party App Insights and AI-Enhanced Remediation","source":"CrowdStrike","kind":"partner","published":"2026-10-05T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/falcon-cloud-security-third-party-app-insights-ai-enhanced-remedation/","summary":""},{"title":"Falcon Data Security for SaaS Secures Sensitive Data in Microsoft 365","source":"CrowdStrike","kind":"partner","published":"2026-10-05T05:00:00.000Z","url":"https://www.crowdstrike.com/en-us/blog/falcon-data-security-for-saas-secures-sensitive-data/","summary":""},{"title":"CISA Adds One Known Exploited Vulnerability to Catalog","source":"CISA","kind":"gov","published":"2026-10-04T12:00:00.000Z","url":"https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog","summary":"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer…"}],"ghsa":[{"ghsaId":"GHSA-x34j-47hf-4xg7","cveId":"CVE-2026-108261","summary":"TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment","severity":"Critical","cvss":9.3,"ecosystem":"npm","pkg":"tinacms","published":"2026-10-09","url":"https://github.com/advisories/GHSA-x34j-47hf-4xg7"},{"ghsaId":"GHSA-628f-v4f6-p37r","cveId":"CVE-2026-107845","summary":"Contao: Cross-site scripting in the comments bundle","severity":"Critical","cvss":9.3,"ecosystem":"composer","pkg":"contao/comments-bundle","published":"2026-10-09","url":"https://github.com/advisories/GHSA-628f-v4f6-p37r"},{"ghsaId":"GHSA-p393-cf76-4jmr","cveId":"CVE-2026-107806","summary":"Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite","severity":"Critical","cvss":null,"ecosystem":"go","pkg":"github.com/0xJacky/Nginx-UI","published":"2026-10-09","url":"https://github.com/advisories/GHSA-p393-cf76-4jmr"},{"ghsaId":"GHSA-rj9j-8772-4h6c","cveId":"CVE-2026-68582","summary":"Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)","severity":"Critical","cvss":null,"ecosystem":"go","pkg":"code.vikunja.io/api","published":"2026-10-09","url":"https://github.com/advisories/GHSA-rj9j-8772-4h6c"},{"ghsaId":"GHSA-6v25-8wq6-xq4j","cveId":"CVE-2026-107726","summary":"Hazelcast allows arbitrary member memory access by low-privileged client","severity":"Critical","cvss":null,"ecosystem":"maven","pkg":"com.hazelcast:hazelcast","published":"2026-10-08","url":"https://github.com/advisories/GHSA-6v25-8wq6-xq4j"},{"ghsaId":"GHSA-ww5h-9m49-7xx4","cveId":"CVE-2026-107722","summary":"fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"fast-jwt","published":"2026-10-08","url":"https://github.com/advisories/GHSA-ww5h-9m49-7xx4"},{"ghsaId":"GHSA-9mp3-24cc-77mg","cveId":"CVE-2026-61445","summary":"PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls","severity":"Critical","cvss":9.9,"ecosystem":"pip","pkg":"praisonai","published":"2026-10-08","url":"https://github.com/advisories/GHSA-9mp3-24cc-77mg"},{"ghsaId":"GHSA-8r5x-fm3f-whwj","cveId":"CVE-2026-106446","summary":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"handlebars","published":"2026-10-08","url":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj"},{"ghsaId":"GHSA-p8wg-vrv2-v86f","cveId":"CVE-2026-106445","summary":"Handlebars: JavaScript Injection via Own Property Check Bypass","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"handlebars","published":"2026-10-08","url":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f"},{"ghsaId":"GHSA-2xv2-w8cq-5gxw","cveId":"CVE-2026-61447","summary":"PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets","severity":"Critical","cvss":10,"ecosystem":"pip","pkg":"praisonaiagents","published":"2026-10-08","url":"https://github.com/advisories/GHSA-2xv2-w8cq-5gxw"},{"ghsaId":"GHSA-jmqq-x5g9-9p2w","cveId":"CVE-2026-107282","summary":"AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host","severity":"Critical","cvss":null,"ecosystem":"maven","pkg":"org.asynchttpclient:async-http-client","published":"2026-10-08","url":"https://github.com/advisories/GHSA-jmqq-x5g9-9p2w"},{"ghsaId":"GHSA-w794-rj3p-xv45","cveId":"CVE-2026-105697","summary":"Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration","severity":"Critical","cvss":9.9,"ecosystem":"pip","pkg":"langflow","published":"2026-10-07","url":"https://github.com/advisories/GHSA-w794-rj3p-xv45"},{"ghsaId":"GHSA-r488-j9vj-wx3q","cveId":"CVE-2026-105857","summary":"Payload Form Builder has an RCE issue","severity":"Critical","cvss":10,"ecosystem":"npm","pkg":"@payloadcms/plugin-form-builder","published":"2026-10-07","url":"https://github.com/advisories/GHSA-r488-j9vj-wx3q"},{"ghsaId":"GHSA-f7hx-52q9-hcrf","cveId":"CVE-2026-105859","summary":"Payload: Unauthorized update to collection documents","severity":"Critical","cvss":9.8,"ecosystem":"npm","pkg":"payload","published":"2026-10-07","url":"https://github.com/advisories/GHSA-f7hx-52q9-hcrf"},{"ghsaId":"GHSA-66wr-7vmr-p5jq","cveId":"CVE-2026-105863","summary":"Payload authentication token field handling issue","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"payload","published":"2026-10-07","url":"https://github.com/advisories/GHSA-66wr-7vmr-p5jq"},{"ghsaId":"GHSA-pq68-rvw4-xp4r","cveId":"CVE-2026-93605","summary":"vm2 contains a sandbox escape vulnerability","severity":"Critical","cvss":10,"ecosystem":"npm","pkg":"vm2","published":"2026-10-07","url":"https://github.com/advisories/GHSA-pq68-rvw4-xp4r"},{"ghsaId":"GHSA-g2v8-7jhw-pp8p","cveId":"CVE-2026-106501","summary":"Backstage: Sensitive information exposure in Scaffolder","severity":"Critical","cvss":9.6,"ecosystem":"npm","pkg":"@backstage/plugin-scaffolder-backend","published":"2026-10-07","url":"https://github.com/advisories/GHSA-g2v8-7jhw-pp8p"},{"ghsaId":"GHSA-w7x8-q2gp-5cgg","cveId":"CVE-2026-73487","summary":"Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"flowise","published":"2026-10-07","url":"https://github.com/advisories/GHSA-w7x8-q2gp-5cgg"},{"ghsaId":"GHSA-9gvv-qjj3-2p6g","cveId":"CVE-2026-73483","summary":"Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"flowise","published":"2026-10-07","url":"https://github.com/advisories/GHSA-9gvv-qjj3-2p6g"},{"ghsaId":"GHSA-pq96-jpmf-w254","cveId":"CVE-2026-106102","summary":"Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()","severity":"Critical","cvss":10,"ecosystem":"npm","pkg":"quasar","published":"2026-10-07","url":"https://github.com/advisories/GHSA-pq96-jpmf-w254"},{"ghsaId":"GHSA-6xp5-7rcx-xfgx","cveId":"CVE-2026-62252","summary":"Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login","severity":"Critical","cvss":9.8,"ecosystem":"go","pkg":"github.com/sipcapture/homer-app","published":"2026-10-07","url":"https://github.com/advisories/GHSA-6xp5-7rcx-xfgx"},{"ghsaId":"GHSA-rqcc-94gv-wjm9","cveId":"CVE-2026-62253","summary":"Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)","severity":"Critical","cvss":9.8,"ecosystem":"go","pkg":"github.com/sipcapture/homer-app","published":"2026-10-07","url":"https://github.com/advisories/GHSA-rqcc-94gv-wjm9"},{"ghsaId":"GHSA-g6j7-pffp-8whg","cveId":"CVE-2026-62176","summary":"PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation","severity":"Critical","cvss":9.1,"ecosystem":"pip","pkg":"PraisonAI","published":"2026-10-07","url":"https://github.com/advisories/GHSA-g6j7-pffp-8whg"},{"ghsaId":"GHSA-vc4h-q48j-5hcx","cveId":"CVE-2026-105851","summary":"Payload: Field access control bypass on auth collections","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"payload","published":"2026-10-06","url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx"},{"ghsaId":"GHSA-qf28-8hc6-vwrp","cveId":"CVE-2026-105844","summary":"Payload: Prototype pollution in Payload Import Export plugin","severity":"Critical","cvss":null,"ecosystem":"npm","pkg":"@payloadcms/plugin-import-export","published":"2026-10-06","url":"https://github.com/advisories/GHSA-qf28-8hc6-vwrp"}],"ransomware":{"victims24h":25,"victims7d":100,"series7d":[2,16,18,30,9,20,5],"groups":[{"group":"qilin","url":"https://www.ransomware.live/group/qilin","victims24h":3,"victims7d":14,"series7d":[0,3,1,4,3,3,0],"sectors":["Other","Manufacturing","Technology"]},{"group":"n0n","url":"https://www.ransomware.live/group/n0n","victims24h":12,"victims7d":13,"series7d":[0,1,0,0,0,12,0],"sectors":["Healthcare","Technology","Professional Services"]},{"group":"umbra","url":"https://www.ransomware.live/group/umbra","victims24h":0,"victims7d":9,"series7d":[1,3,4,0,1,0,0],"sectors":["Education","Technology","Manufacturing"]},{"group":"thegentlemen","url":"https://www.ransomware.live/group/thegentlemen","victims24h":4,"victims7d":7,"series7d":[0,0,0,2,1,0,4],"sectors":["Technology","Government & Defense","Retail & E-Commerce"]},{"group":"silentransomgroup","url":"https://www.ransomware.live/group/silentransomgroup","victims24h":0,"victims7d":5,"series7d":[1,1,3,0,0,0,0],"sectors":["Professional Services"]},{"group":"eclipse","url":"https://www.ransomware.live/group/eclipse","victims24h":0,"victims7d":5,"series7d":[0,0,5,0,0,0,0],"sectors":["Manufacturing","Professional Services","Other"]},{"group":"rhysida","url":"https://www.ransomware.live/group/rhysida","victims24h":2,"victims7d":4,"series7d":[0,0,0,1,1,2,0],"sectors":["Professional Services","Other"]},{"group":"dragonforce","url":"https://www.ransomware.live/group/dragonforce","victims24h":1,"victims7d":4,"series7d":[0,2,0,0,1,1,0],"sectors":["Manufacturing","Energy & Utilities","Technology"]},{"group":"panzer","url":"https://www.ransomware.live/group/panzer","victims24h":0,"victims7d":3,"series7d":[0,1,0,2,0,0,0],"sectors":["Energy & Utilities","Technology","Education"]},{"group":"black x","url":"https://www.ransomware.live/group/black%20x","victims24h":0,"victims7d":3,"series7d":[0,0,0,3,0,0,0],"sectors":["Financial Services","Technology","Healthcare"]},{"group":"arcusmedia","url":"https://www.ransomware.live/group/arcusmedia","victims24h":0,"victims7d":3,"series7d":[0,0,0,3,0,0,0],"sectors":["Manufacturing"]},{"group":"akira","url":"https://www.ransomware.live/group/akira","victims24h":0,"victims7d":3,"series7d":[0,0,0,3,0,0,0],"sectors":["Other","Manufacturing"]},{"group":"redact","url":"https://www.ransomware.live/group/redact","victims24h":1,"victims7d":2,"series7d":[0,0,0,0,1,0,1],"sectors":["Energy & Utilities","Healthcare"]},{"group":"emperador","url":"https://www.ransomware.live/group/emperador","victims24h":1,"victims7d":2,"series7d":[0,0,0,1,0,1,0],"sectors":["Transportation","Retail & E-Commerce"]},{"group":"deadlock","url":"https://www.ransomware.live/group/deadlock","victims24h":0,"victims7d":2,"series7d":[0,0,0,2,0,0,0],"sectors":["Healthcare"]}],"sectors":[{"sector":"Technology","count":14},{"sector":"Healthcare","count":13},{"sector":"Professional Services","count":12},{"sector":"Manufacturing","count":11},{"sector":"Education","count":10},{"sector":"Other","count":8},{"sector":"Energy & Utilities","count":4},{"sector":"Transportation","count":3}],"countries":[{"country":"US","count":31},{"country":"BR","count":6},{"country":"DE","count":4},{"country":"CA","count":3},{"country":"EG","count":3},{"country":"ES","count":3},{"country":"SG","count":3},{"country":"IN","count":3},{"country":"CO","count":2},{"country":"TW","count":2},{"country":"JP","count":2},{"country":"CH","count":2},{"country":"MX","count":2},{"country":"MA","count":1},{"country":"PE","count":1},{"country":"AU","count":1},{"country":"TH","count":1},{"country":"CL","count":1},{"country":"SE","count":1},{"country":"FI","count":1},{"country":"GB","count":1},{"country":"IT","count":1},{"country":"IL","count":1},{"country":"HR","count":1},{"country":"AE","count":1},{"country":"FR","count":1},{"country":"QA","count":1},{"country":"ZA","count":1}],"recent":[{"group":"thegentlemen","sector":"Retail & E-Commerce","country":"US","discovered":"2026-10-12"},{"group":"thegentlemen","sector":"Technology","country":"US","discovered":"2026-10-12"},{"group":"thegentlemen","sector":"Technology","country":"US","discovered":"2026-10-12"},{"group":"thegentlemen","sector":"Technology","country":"US","discovered":"2026-10-12"},{"group":"redact","sector":"Energy & Utilities","country":"US","discovered":"2026-10-12"},{"group":"n0n","sector":"Healthcare","country":"US","discovered":"2026-10-11"},{"group":"n0n","sector":"Healthcare","country":"US","discovered":"2026-10-11"},{"group":"n0n","sector":"Healthcare","country":"AU","discovered":"2026-10-11"},{"group":"n0n","sector":"Professional Services","country":"US","discovered":"2026-10-11"},{"group":"n0n","sector":"Technology","country":"US","discovered":"2026-10-11"},{"group":"qilin","sector":"Energy & Utilities","country":"CO","discovered":"2026-10-11"},{"group":"dragonforce","sector":"Manufacturing","country":"PE","discovered":"2026-10-11"},{"group":"rhysida","sector":"Other","country":"US","discovered":"2026-10-11"},{"group":"qilin","sector":"Education","country":"US","discovered":"2026-10-11"},{"group":"qilin","sector":"Government & Defense","country":"MA","discovered":"2026-10-11"},{"group":"rhysida","sector":"Professional Services","country":"US","discovered":"2026-10-11"},{"group":"n0n","sector":"Not Found","country":"CA","discovered":"2026-10-11"},{"group":"n0n","sector":"Not Found","country":"—","discovered":"2026-10-11"},{"group":"n0n","sector":"Not Found","country":"—","discovered":"2026-10-11"},{"group":"n0n","sector":"Not Found","country":"—","discovered":"2026-10-11"}],"source":"ransomware.live","sourceUrl":"https://www.ransomware.live/"},"sourceStatus":{"kev":"ok","nvd":"ok","epss":"ok","threatfox":"skipped","rss:CISA":"ok","rss:NCSC UK":"ok","rss:CERT/CC":"ok","rss:Cisco PSIRT":"ok","rss:Palo Alto Networks PSIRT":"ok","rss:Fortinet PSIRT":"ok","rss:Microsoft MSRC":"ok","rss:AWS Security Bulletins":"ok","rss:Google Threat Intelligence":"ok","rss:Microsoft Security":"ok","rss:CrowdStrike":"ok","rss:Unit 42":"ok","rss:Wiz Research":"ok","rss:Cisco Talos":"ok","rss:SentinelLabs":"ok","rss:Rapid7":"ok","rss:BleepingComputer":"error","rss:The Record":"ok","rss:Krebs on Security":"ok","ghsa":"ok","ransomware":"ok","radar":"skipped"},"sourceKinds":{"CISA":"gov","NCSC UK":"gov","CERT/CC":"gov","Cisco PSIRT":"psirt","Palo Alto Networks PSIRT":"psirt","Fortinet PSIRT":"psirt","Microsoft MSRC":"psirt","AWS Security Bulletins":"psirt","Google Threat Intelligence":"partner","Microsoft Security":"partner","CrowdStrike":"partner","Unit 42":"partner","Wiz Research":"partner","Cisco Talos":"research","SentinelLabs":"research","Rapid7":"research","BleepingComputer":"news","The Record":"news","Krebs on Security":"news"},"sourceUrls":{"kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","nvd":"https://nvd.nist.gov/vuln/search","epss":"https://www.first.org/epss/","threatfox":"https://threatfox.abuse.ch/browse/","ghsa":"https://github.com/advisories?query=severity%3Acritical+type%3Areviewed","ransomware":"https://www.ransomware.live/","radar":"https://radar.cloudflare.com/security","CISA":"https://www.cisa.gov/cybersecurity-advisories/all.xml","NCSC UK":"https://www.ncsc.gov.uk/api/1/services/v1/report-rss-feed.xml","CERT/CC":"https://kb.cert.org/vuls/atomfeed/","Cisco PSIRT":"https://sec.cloudapps.cisco.com/security/center/psirtrss20/CiscoSecurityAdvisory.xml","Palo Alto Networks PSIRT":"https://security.paloaltonetworks.com/rss.xml","Fortinet PSIRT":"https://filestore.fortinet.com/fortiguard/rss/ir.xml","Microsoft MSRC":"https://msrc.microsoft.com/blog/feed","AWS Security Bulletins":"https://aws.amazon.com/security/security-bulletins/rss/feed/","Google Threat Intelligence":"https://cloud.google.com/blog/topics/threat-intelligence/rss/","Microsoft Security":"https://www.microsoft.com/en-us/security/blog/feed/","CrowdStrike":"https://www.crowdstrike.com/blog/feed/","Unit 42":"https://unit42.paloaltonetworks.com/feed/","Wiz Research":"https://www.wiz.io/feed/rss.xml","Cisco Talos":"https://blog.talosintelligence.com/rss/","SentinelLabs":"https://www.sentinelone.com/labs/feed/","Rapid7":"https://www.rapid7.com/blog/rss/","BleepingComputer":"https://www.bleepingcomputer.com/feed/","The Record":"https://therecord.media/feed","Krebs on Security":"https://krebsonsecurity.com/feed/"}},"brief":{"generatedAt":"2026-10-12T12:00:57.654Z","runId":"ai-20261012120034-902bc59e","model":"grok-4.3","window":"6h","headline":"Ransomware groups exploit months-old Palo Alto GlobalProtect auth bypass.","items":[{"id":"5cd73899bf044074100320ddaa6e5406ce320c5dc39d82bdabb35391b113a0c4","title":"Qilin, Settra exploit Palo Alto GlobalProtect CVE-2026-0257","summary":"ReliaQuest reports active exploitation of the May 2026 authentication bypass in PAN-OS GlobalProtect and Prisma Access. Attackers establish trusted VPN sessions for initial access, followed by credential theft and ransomware deployment. Qilin and Settra observed; Cobalt Strike and BloodHound also used.","severity":"Critical","type":"vulnerability","confidence":"Confirmed","cves":[],"actors":["Qilin","Settra"],"sectors":["Multiple"],"recommends":"Patch PAN-OS GlobalProtect and Prisma Access to fixed releases immediately. Monitor VPN logs for anomalous sessions from trusted infrastructure. Block or investigate post-auth activity with known offensive tools.","sources":[{"title":"Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability","url":"https://gbhackers.com/ransomware-hackers-exploit-palo-alto-networks-globalprotect/","kind":"web"},{"title":"Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups","url":"https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/","kind":"web"}]}],"industry":[{"id":"86a136b3ffa3fb93452e672c40cb1df393e2a34b28b1dbfb05cea0052a9ee452","title":"Gentlemen gang claims MoneyGram breach","summary":"The Gentlemen ransomware group claims to have breached MoneyGram and threatens data leak. No independent confirmation yet.","severity":"High","type":"breach","confidence":"Reported","cves":[],"actors":["thegentlemen"],"sectors":["Financial Services"],"recommends":"Verify claims against internal telemetry. Prepare incident response for potential data exposure.","sources":[{"title":"What Got Hacked Today? Latest Cyber Attacks & Breaches","url":"https://theperimetersite.com/hacked-today","kind":"web"}]}],"xPulse":[],"xTrends":[],"darknet":[],"usage":{"inputTokens":38891,"outputTokens":1772,"searches":2,"costUsd":0.1165,"xHandlesUsed":["CISAgov","MsftSecIntel","Mandiant","vxunderground","DarkWebInformer","BleepinComputer","TalosSecurity","CrowdStrike","ESETresearch","kaspersky"],"xDisabled":false}},"actors":[{"id":"qilin","name":"Qilin","aliases":["Agenda"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Healthcare","Manufacturing","Professional services","Professional Services","Multiple"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,8],"ttps":[{"id":"T1078","name":"Valid Accounts"},{"id":"T1555.003","name":"Credentials from Web Browsers"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["Chrome credential harvesting","Rust and Go lockers"],"summary":"Confirmed exploitation of CVE-2026-0257 for VPN initial access in multiple incidents.","confidence":"Likely","sources":[{"title":"Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability","url":"https://gbhackers.com/ransomware-hackers-exploit-palo-alto-networks-globalprotect/","kind":"web"},{"title":"Japan confirms arrest of Russian Qilin operative, extradition to Germany","url":"https://therecord.media/japan-germany-ransomware-arrest","kind":"web"},{"title":"Industry reporting","url":"https://www.bleepingcomputer.com/","kind":"web"}]},{"id":"akira","name":"Akira","aliases":["Storm-1567","Howling Scorpius"],"originReported":"Criminal, possible Conti lineage","motivation":"Financial","sectors":["Education","Manufacturing","Finance","Small and medium business"],"regions":["North America","Europe"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1133","name":"External Remote Services"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["VPN credential abuse","Megazord"],"summary":"Initial access through VPN appliances without MFA; dual-extortion with a Linux ESXi variant.","confidence":"Confirmed","sources":[{"title":"CISA AA24-109A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a","kind":"web"}]},{"id":"black-basta","name":"Black Basta","aliases":["Cardinal","Storm-0506"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Healthcare","Manufacturing","Construction"],"regions":["North America","Europe","Australia"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1566","name":"Phishing"},{"id":"T1219","name":"Remote Access Software"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["Qakbot","Quick Assist abuse","SystemBC"],"summary":"Email bombing followed by help-desk impersonation over Teams and remote-assist tooling to deploy ransomware.","confidence":"Confirmed","sources":[{"title":"CISA AA24-131A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a","kind":"web"}]},{"id":"lazarus-group","name":"Lazarus Group","aliases":["APT38","Hidden Cobra","Tradertraitor","Diamond Sleet"],"originReported":"DPRK state-sponsored (reported)","motivation":"Financial, espionage","sectors":["Cryptocurrency","Finance","Defense","Software supply chain"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1195.002","name":"Compromise Software Supply Chain"},{"id":"T1566.003","name":"Spearphishing via Service"},{"id":"T1204.002","name":"Malicious File"}],"tools":["Trojanized npm packages","Fake job lures"],"summary":"Revenue-generation operations against crypto exchanges and developers through poisoned packages and recruiter lures.","confidence":"Confirmed","sources":[{"title":"CISA TraderTraitor advisory","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a","kind":"web"}]},{"id":"apt29","name":"APT29","aliases":["Midnight Blizzard","Cozy Bear","Nobelium","The Dukes"],"originReported":"Russian SVR (reported)","motivation":"Espionage","sectors":["Government","Diplomacy","Technology","Think tanks"],"regions":["North America","Europe"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1566.002","name":"Spearphishing Link"},{"id":"T1528","name":"Steal Application Access Token"},{"id":"T1110.003","name":"Password Spraying"},{"id":"T1098.005","name":"Device Registration"}],"tools":["Cloud OAuth abuse","Residential proxies"],"summary":"Cloud-focused espionage: password spraying of legacy tenants, OAuth application abuse and device-code phishing.","confidence":"Confirmed","sources":[{"title":"NCSC and partners advisory on SVR cloud tactics","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a","kind":"web"}]},{"id":"alphv","name":"ALPHV","aliases":["Blackcat","Noberus"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Healthcare","Finance","Energy"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1486","name":"Data Encrypted for Impact"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1048","name":"Exfiltration Over Alternative Protocol"}],"tools":["ExMatter","Cobalt Strike"],"summary":"Rust-based ransomware brand associated with large healthcare disruptions; affiliates migrated to other programs after its exit scam.","confidence":"Likely","sources":[{"title":"CISA AA23-353A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a","kind":"web"}]},{"id":"lockbit","name":"LockBit","aliases":["Lockbit 3.0","Lockbit Black","Bitwise Spider"],"originReported":"Russian-speaking criminal","motivation":"Financial","sectors":["Manufacturing","Healthcare","Professional services","Education"],"regions":["Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1486","name":"Data Encrypted for Impact"},{"id":"T1567","name":"Exfiltration Over Web Service"},{"id":"T1021.001","name":"Remote Desktop Protocol"},{"id":"T1562.001","name":"Disable or Modify Tools"}],"tools":["StealBit","Mimikatz","PsExec"],"summary":"Ransomware-as-a-service affiliate program; resurfaced after law-enforcement disruption with rebuilt infrastructure.","confidence":"Confirmed","sources":[{"title":"CISA AA23-165A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a","kind":"web"}]},{"id":"salt-typhoon","name":"Salt Typhoon","aliases":["Earth Estries","Ghostemperor","Famoussparrow","UNC2286"],"originReported":"PRC state-sponsored (reported)","motivation":"Espionage","sectors":["Telecommunications","Government","Internet service providers"],"regions":["United States","Global"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1190","name":"Exploit Public-Facing Application"},{"id":"T1040","name":"Network Sniffing"},{"id":"T1133","name":"External Remote Services"}],"tools":["Custom backdoors","Network device implants"],"summary":"Long-term access to carrier networks and lawful-intercept systems via unpatched edge devices.","confidence":"Confirmed","sources":[{"title":"CISA guidance on telecom intrusions","url":"https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure","kind":"web"}]},{"id":"volt-typhoon","name":"Volt Typhoon","aliases":["Bronze Silhouette","Vanguard Panda","Voltzite","Insidious Taurus"],"originReported":"PRC state-sponsored (reported)","motivation":"Espionage, pre-positioning","sectors":["Energy","Water","Telecommunications","Transportation"],"regions":["United States","Guam"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1190","name":"Exploit Public-Facing Application"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1090.003","name":"Multi-hop Proxy"},{"id":"T1003.003","name":"NTDS Credential Dumping"}],"tools":["Living-off-the-land binaries","KV Botnet"],"summary":"Quiet persistence in critical infrastructure using built-in tools and compromised SOHO routers as proxies.","confidence":"Confirmed","sources":[{"title":"CISA AA24-038A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a","kind":"web"}]},{"id":"scattered-spider","name":"Scattered Spider","aliases":["UNC3944","Octo Tempest","0ktapus","Muddled Libra"],"originReported":"English-speaking, dispersed","motivation":"Financial","sectors":["Retail","Hospitality","Insurance","Technology","Telecommunications"],"regions":["North America","United Kingdom"],"lastSeen":"2026-10-12","activity7d":[0,0,0,0,0,0,0],"ttps":[{"id":"T1566.004","name":"Spearphishing Voice"},{"id":"T1621","name":"MFA Request Generation"},{"id":"T1078","name":"Valid Accounts"},{"id":"T1486","name":"Data Encrypted for Impact"}],"tools":["Remote monitoring tools","DragonForce","BlackCat"],"summary":"Help-desk impersonation, SIM swapping and MFA fatigue leading to SSO takeover and ransomware deployment.","confidence":"Confirmed","sources":[{"title":"CISA AA23-320A","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a","kind":"web"}]}],"trends":{"generatedAt":"2026-10-12T12:15:36.183Z","days":["2026-07-15","2026-07-16","2026-07-17","2026-07-18","2026-07-19","2026-07-20","2026-07-21","2026-07-22","2026-07-23","2026-07-24","2026-07-25","2026-07-26","2026-07-27","2026-07-28","2026-07-29","2026-07-30","2026-07-31","2026-08-01","2026-08-02","2026-08-03","2026-08-04","2026-08-05","2026-08-06","2026-08-07","2026-08-08","2026-08-09","2026-08-10","2026-08-11","2026-08-12","2026-08-13","2026-08-14","2026-08-15","2026-08-16","2026-08-17","2026-08-18","2026-08-19","2026-08-20","2026-08-21","2026-08-22","2026-08-23","2026-08-24","2026-08-25","2026-08-26","2026-08-27","2026-08-28","2026-08-29","2026-08-30","2026-08-31","2026-09-01","2026-09-02","2026-09-03","2026-09-04","2026-09-05","2026-09-06","2026-09-07","2026-09-08","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12"],"kev":[2,3,0,0,0,0,4,2,0,0,0,0,2,0,1,0,0,0,0,1,3,1,0,1,0,0,0,3,0,0,0,0,0,1,4,1,2,1,0,0,1,1,6,3,0,0,0,2,0,7,0,1,0,0,0,4,4,2,4,0,0,1,0,3,0,3,0,0,1,4,0,2,3,0,2,0,1,1,1,2,0,1,0,0,0,5,0,0,0,0],"cveHigh":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,80],"iocs":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"victims":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25],"weekly":{"kev":{"this":5,"prev":6},"cveHigh":{"this":80,"prev":0},"victims":{"this":25,"prev":0}},"vendors30d":[{"vendor":"Cisco","kev":3,"ransomware":3,"latest":"2026-09-30"},{"vendor":"Citrix","kev":3,"ransomware":3,"latest":"2026-10-04"},{"vendor":"Linux","kev":3,"ransomware":3,"latest":"2026-09-18"},{"vendor":"Check Point","kev":2,"ransomware":2,"latest":"2026-09-22"},{"vendor":"Zammad GmbH","kev":2,"ransomware":2,"latest":"2026-10-02"},{"vendor":"Acronis","kev":1,"ransomware":1,"latest":"2026-09-16"},{"vendor":"Adobe","kev":1,"ransomware":1,"latest":"2026-09-24"},{"vendor":"Apache","kev":1,"ransomware":1,"latest":"2026-10-08"},{"vendor":"Apple","kev":1,"ransomware":1,"latest":"2026-09-29"},{"vendor":"Arista","kev":1,"ransomware":1,"latest":"2026-09-22"},{"vendor":"F5","kev":1,"ransomware":1,"latest":"2026-09-22"},{"vendor":"Fortinet","kev":1,"ransomware":1,"latest":"2026-10-01"},{"vendor":"Google","kev":1,"ransomware":1,"latest":"2026-09-16"},{"vendor":"ISC","kev":1,"ransomware":1,"latest":"2026-10-08"}],"timeToKev":{"medianDays":44,"sample":11},"kevAdded90d":97},"sources":[{"host":"x.com","cited":2,"corroborated":0,"rate":0,"lastSeen":"2026-10-12T06:02:14.074Z"},{"host":"bleepingcomputer.com","cited":1,"corroborated":1,"rate":100,"lastSeen":"2026-10-12T06:02:14.074Z"},{"host":"gbhackers.com","cited":1,"corroborated":1,"rate":100,"lastSeen":"2026-10-12T12:00:59.070Z"},{"host":"infosecurity-magazine.com","cited":1,"corroborated":1,"rate":100,"lastSeen":"2026-10-12T12:00:59.070Z"},{"host":"scworld.com","cited":1,"corroborated":1,"rate":100,"lastSeen":"2026-10-12T06:02:14.074Z"},{"host":"theperimetersite.com","cited":1,"corroborated":0,"rate":0,"lastSeen":"2026-10-12T12:00:59.070Z"},{"host":"therecord.media","cited":1,"corroborated":0,"rate":0,"lastSeen":"2026-10-12T06:02:14.074Z"}]}