{"date_iso":"2026-10-12","date_human":"Monday, October 12, 2026","generated_utc":"2026-10-12 18:10 UTC","read_minutes":4,"patch_tuesday":false,"top_stories":[{"title":"Bring Your Own Agent: Your Employees' Assistants Are Already Logged In","link":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html","reason":"Amazon","category":"News","sources":["Malwarebytes Labs","The Hacker News","The Register Security"],"coverage":3,"cve_ids":[],"summary":"The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror\u2026","source":"The Hacker News","date_rel":"6h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyfIDT5M3MmWcxPZrWKZ_8EOy_WZY9iQHv9CQrAKcSZ7_EAadHyWzg9Aa5zQizJiwjNNLp6TDGShed4uvK0iq0d5TQHOV4wqah_jnbuJK-gFuObDCjO_bhwobK9PlO-CmK92s9PueGqpPI_puFGDAS_t4evoyjokLRlaXbql9cGN3d7POdsiXyUYvicVs/s1600/bring.jpg","description":"The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year","related":[{"title":"A week in security (October 5 \u2013 October 11)","link":"https://www.malwarebytes.com/blog/news/2026/10/a-week-in-security-october-5-october-11","source":"Malwarebytes Labs","date_rel":"11h ago"},{"title":"AWS AgentCore security undone by prompt requesting credentials","link":"https://www.theregister.com/security/2026/10/09/aws-agentcore-security-undone-by-prompt-requesting-credentials/5302436","source":"The Register Security","date_rel":"9 Oct"}]},{"title":"Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident","link":"https://cybersecuritynews.com/ahold-delhaize-cyberattack/","reason":"Delhaize Systems Offline","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":[],"summary":"Ahold Delhaize has taken some systems offline after identifying a security issue within its network, the food retail group said on October 12, 2026. The company, based in Zaandam, the Netherlands, said its teams were\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Ahold-Delhaize-Cyberattack.webp","description":"Ahold Delhaize has taken some systems offline after identifying a security issue within its network, the food retail group said on October 12, 2026. The company, based in Zaandam, the Netherlands, said its teams were assessing the issue and taking steps to limit its impact. Physical stores remain open and continue serving customers. In its official statement , Ahold Delhaize described the shutdowns as protective measures. \u201cProtecting our infrastructure in the best interest of our customers, associates and partners is a top priority,\u201d the company said, apologizing for inconvenience caused to\u2026","related":[{"title":"Retail giant Ahold Delhaize takes systems offline after cyberattack","link":"https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/","source":"Bleeping Computer","date_rel":"4h ago"}]},{"title":"Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions","link":"https://cybersecuritynews.com/critical-google-devsite-flaw/","reason":"Google","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":[],"summary":"A critical vulnerability in Google\u2019s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Critical-Google-DevSite-Flaw-Let-Attackers-Execute-Code-Through-Forged-Flask-Sessions-1.webp","description":"A critical vulnerability in Google\u2019s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer websites, according to researcher Simon Koeck. The issue affected the OAuth flow used by Google developer documentation sites, including developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. Google reportedly fixed the flaw on October 7, 2026, after receiving the report in August and awarding the researcher $90,000 through\u2026","related":[{"title":"Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time","link":"https://cybersecuritynews.com/google-aitm-phishing-kit/","source":"Cyber Security News","date_rel":"4h ago"},{"title":"Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks","link":"https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/","source":"Bleeping Computer","date_rel":"9 Oct"}]},{"title":"Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers","link":"https://cybersecuritynews.com/gitlab-vulnerability-code-execution/","reason":"Gitlab","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":["CVE-2026-97229"],"summary":"GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in. Tracked as CVE-2026-97229, the flaw carries the\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/GitLab-Vulnerability-Code-Execution.webp","description":"GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in. Tracked as CVE-2026-97229, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company released patches on October 12, 2026. The vulnerability involves an integer overflow in GitLab\u2019s CI/CD regular expression compiler. GitLab says insufficient regular expression validation could allow an unauthenticated attacker to trigger code execution through a specially\u2026","related":[{"title":"GitLab warns of max severity code execution vulnerability","link":"https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/","source":"Bleeping Computer","date_rel":"5h ago"}]},{"title":"WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows","link":"https://cybersecuritynews.com/whatsapp-attachment-deploys-malware/","reason":"Windows","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":[],"summary":"A malicious WhatsApp attachment is being used to deploy a Windows remote access trojan that can reach SYSTEM-level access, giving its operators deep control over infected machines. The campaign begins with a ZIP archive\u2026","source":"Cyber Security News","date_rel":"4h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/WhatsApp-Attachment-Deploys-Malware-That-Gains-SYSTEM-Access-on-Windows.webp","description":"A malicious WhatsApp attachment is being used to deploy a Windows remote access trojan that can reach SYSTEM-level access, giving its operators deep control over infected machines. The campaign begins with a ZIP archive carrying a financial-document lure and an executable named Statement.exe . Once the recipient opens the file, the malware starts a long, hidden chain that moves from a user-level process into a Windows service running with LocalSystem rights. The final payload, named VulcanRAT207.A, gives remote operators the ability to collect system data, run commands, manage files, capture\u2026","related":[{"title":"Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption","link":"https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/","source":"Bleeping Computer","date_rel":"4h ago"}]},{"title":"Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE","link":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html","reason":"CVE-2026-85097","category":"News","sources":["SecurityWeek","The Hacker News"],"coverage":2,"cve_ids":["CVE-2026-85097"],"summary":"A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS\u2026","source":"The Hacker News","date_rel":"9h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrKeT1xQm0N8zjNRqWwsoqMm3kESRMqYnUJ9Wy6x9dEKlRVgZYDVqKqhu_2ZT7ZcCNd_RegNu2LtnUUQgL8R2OlK5LTyu9vKaCBRGTVrp05hGdB5wQrxFNi_eHnGxx-8yFR7maKT3tD_WBMVVBSeTyuku392tKdoOHIgvnj1tKQYU_Yq9anT5OKxUun4GW/s1600/wp-php.jpg","description":"A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The","related":[{"title":"Bricksforge WordPress Plugin Vulnerability Exploited in the Wild","link":"https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/","source":"SecurityWeek","date_rel":"4h ago"}]},{"title":"Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners","link":"https://cybersecuritynews.com/hackers-exploit-critical-ahsaycbs-flaws/","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":[],"summary":"Hackers are exploiting two flaws in AhsayCBS backup servers to run commands, plant webshells, and install XMRig cryptocurrency miners disguised as Microsoft Edge. Huntress first observed exploitation on October 7, 2026\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Exploit-Critical-AhsayCBS-Flaws-to-Deploy-Webshells-and-XMRig-Miners.webp","description":"Hackers are exploiting two flaws in AhsayCBS backup servers to run commands, plant webshells, and install XMRig cryptocurrency miners disguised as Microsoft Edge. Huntress first observed exploitation on October 7, 2026, at 23:20:15 UTC. By October 8, its researchers had seen five organizations targeted, with attackers checking systems and setting up tools to maintain access. The campaign targets Ahsay Cloud Backup Server, a management platform used by managed service providers and system integrators. Administrators use it to manage backup users, policies, and operations. According to\u2026","related":[{"title":"Microsoft: Windows 11 23H2 reaches end of support in 30 days","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-11-23h2-reaches-end-of-support-in-30-days/","source":"Bleeping Computer","date_rel":"6h ago"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-108576","vendor":"TOZED","product":"X300","severity":"CRITICAL","score":10.0,"description":"A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be \u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242","https://vuldb.com/cve/CVE-2026-108576","https://vuldb.com/submit/956290"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108576"},{"id":"CVE-2026-108804","vendor":"TRENDnet","product":"TEW-751DR","severity":"CRITICAL","score":10.0,"description":"A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service result\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/dacj4n/TRENDNetExploits","https://github.com/dacj4n/TRENDNetExploits/tree/main/exploit","https://vuldb.com/cve/CVE-2026-108804"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108804"},{"id":"CVE-2026-66086","vendor":"Unisoc (Shanghai) Technologies Co., Ltd.","product":"Modem","severity":"CRITICAL","score":9.8,"description":"In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privil\u2026","cwe":"CWE-121","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.unisoc.com/en/support/product-security-bulletin/2109454821805424641"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-66086"},{"id":"CVE-2026-108753","vendor":"agnaistic","product":"agnai","severity":"CRITICAL","score":9.4,"description":"Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT wi\u2026","cwe":"CWE-798","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://github.com/agnaistic/agnai","https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/README.md#L75-L82","https://github.com/agnaistic/agnai/blob/6c3de258cb33999c3f292c71aa031d2352681186/self-host.docker-compose.yml#L18-L26"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108753"},{"id":"CVE-2026-93582","vendor":"OTRS GmbH (former OTRS AG)","product":"OTRS","severity":"CRITICAL","score":9.4,"description":"The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable.\u00a0In CGI and mod_perl based deployments, HTTP request head\u2026","cwe":"CWE-290","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://otrs.com/release-notes/otrs-security-advisory-2026-18/"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-93582"},{"id":"CVE-2026-108860","vendor":"SciSharp","product":"BotSharp","severity":"CRITICAL","score":9.1,"description":"BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the commi\u2026","cwe":"CWE-321","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://github.com/SciSharp/BotSharp","https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/Infrastructure/BotSharp.OpenAPI/BotSharpOpenApiExtensions.cs#L46-L57","https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/WebStarter/appsettings.json#L16-L20"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108860"},{"id":"CVE-2026-78357","vendor":"OTRS GmbH (former OTRS AG)","product":"OTRS","severity":"CRITICAL","score":9.1,"description":"Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed.\u00a0As a result, an existing JWT may remain valid until its regular expiration time, \u2026","cwe":"CWE-613","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://otrs.com/release-notes/otrs-security-advisory-2026-14/"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-78357"},{"id":"CVE-2026-108746","vendor":"Vearch","product":"vearch","severity":"HIGH","score":8.8,"description":"Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and\u2026","cwe":"CWE-863","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/vearch/vearch","https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313","https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108746"},{"id":"CVE-2026-108963","vendor":"David-Crty","product":"databasement","severity":"HIGH","score":8.8,"description":"databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to\u2026","cwe":"CWE-88","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22","https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3","https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108963"},{"id":"CVE-2026-108980","vendor":"Blinko","product":"Blinko","severity":"HIGH","score":8.8,"description":"Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is\u2026","cwe":"CWE-24","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/app/src/pages/signin.tsx#L238-L243","https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerTrpc/plugin.ts#L273","https://github.com/kashishtopi/blinko-plugin-path-traversal-rce"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-108980"}],"vendor_spikes":[{"vendor":"Samsung Mobile","count":24,"critical_count":0},{"vendor":"jeecgboot","count":23,"critical_count":0},{"vendor":"zephyrproject","count":11,"critical_count":0},{"vendor":"erzhongxmu","count":9,"critical_count":0},{"vendor":"OTRS GmbH (former OTRS AG)","count":9,"critical_count":2},{"vendor":"zhayujie","count":5,"critical_count":0},{"vendor":"ZKTeco","count":5,"critical_count":0},{"vendor":"Apple","count":4,"critical_count":0},{"vendor":"Microsoft","count":4,"critical_count":0},{"vendor":"UnicomAI","count":4,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":7,"new_cve_count":225,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-97229":{"anchor":"#dev-4","rank":4,"coverage":2},"CVE-2026-85097":{"anchor":"#dev-6","rank":6,"coverage":2}}}