Friday, October 2, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 5 critical 65
- Apache 3 critical 28
- Unknown 27
- TryGhost 24
- Red Hat 3 critical 17
- n8n-io 2 critical 15
- HCL Software 14
- Microsoft 2 critical 13
- Johnson Controls 12
- JetBrains 10
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
Hackers turned a Microsoft SQL Server into a channel for running commands and moving collected files in an intrusion linked to a Viva Aerobus environment. Their own publicly accessible server then exposed attack tools and stolen material to unrelated internet users. The activity, observed between September 25 and 29, 2026, involved credential harvesting, source code collection, and preparation to access additional systems. The investigation did not establish how the attackers first entered the environment or identify a named malware family. The available records describe a toolkit rather than…
Also in Infosecurity Magazine The Record SecurityWeek +3
-
Fortinet sounds the alarm over actively exploited FortiMail zero-day
Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform. Fortinet describes the vulnerability as a combination of path traversal and improper handling of null characters in FortiMail's web interface. An unauthenticated attacker can exploit it using specially crafted HTTP or HTTPS requests to write arbitrary files to the underlying system. Writing…
Also in SecurityWeek Bleeping Computer CISA Alerts & Advisories
-
SMTP is the key: BPFDoor and AVERAT hitting the network edge
Overview Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT , deployed against Taiwanese appliances. Additionally, we provide source code details of the Rapid7 BPFDoor controller introduced in our April 2026 blog, Stealthy BPFDoor Variants are a Needle That Looks Like Hay . The chain uses two binaries. A dropper writes a shell script to the…
Also in Dark Reading The Hacker News
.png)
-
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version
Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program. "It delivers frontier performance in complex workflows across real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense," Koray Kavukcuoglu,
Also in CCCS Alerts & Advisories Dark Reading Infosecurity Magazine +1
-
ZDI-26-750: WatchGuard FireWare OS spamd statushdlr Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-18145.
Also in CCCS Alerts & Advisories CCCS Alerts & Advisories Zero Day Initiative
-
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system. "An improper
Also in CCCS Alerts & Advisories
-
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with
Also in Infosecurity Magazine CCCS Alerts & Advisories The Hacker News
-
Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a
Also in SecurityWeek
-
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime.
Also in Infosecurity Magazine
-
Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials
Exposed WordPress backups have become a valuable source of cloud and email credentials for attackers using a toolkit called TIKTOUK. Rather than relying on one technique, its components search websites for sensitive files, recover stored passwords, and collect secrets from JavaScript delivered to visitors. The operation was already active at scale when researchers first observed it. A leaked control panel contained approximately 50,000 real server-side credentials across about 37,000 domains, including hundreds of AWS keys that the attackers had validated as active. LevelBlue researchers…
Also in The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-79901 | BoKS Manager boks-serverMicrosoft | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isIn deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the … Attack
Exploitation
|
|||||||||
| CVE-2026-96658 | Red Hat Satellite 6.16 for RHEL 8Red Hat | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an atta… Attack
Exploitation
|
|||||||||
| CVE-2026-93698 | cPanelWebpros | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isInsufficient validation allows arbitrary commands to be executed via the Multilang adminbin. Attack
Exploitation
|
|||||||||
| CVE-2026-15989 | Super Forms – Drag & Drop Form BuilderWordPress | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisti… Attack
Exploitation
|
|||||||||
| CVE-2026-75957 | Ultimate Multisite – WordPress Multisite SaaS & WaaS PlatformWordPress | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checko… Attack
Exploitation
|
|||||||||
| CVE-2026-103244 | ground-stationsgoudelis | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore … Attack
Exploitation
|
|||||||||
| CVE-2026-103752 | AuthorizerPaul Ryan | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isUnauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-12627 | Fortra's Core Privileged Access Manager (BoKS)Fortra | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isFortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during… Attack
Exploitation
|
|||||||||
| CVE-2026-56154 | Apache HTTP ServerApache | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isUse After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Attack
Exploitation
|
|||||||||
| CVE-2026-57941 | Apache HTTP ServerApache | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isUse After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504 , a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding ( CWE-177 ). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user. According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the…
Also in CISA Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.