Friday, October 16, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 5 critical 74
- Microsoft 1 critical 45
- QNAP 35
- HP 23
- Eclipse Foundation 21
- Netgate 20
- Unknown 19
- Progress 14
- FreeBSD 13
- espocrm 1 critical 12
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
Also in Bleeping Computer SecurityWeek Bleeping Computer +3
-
How Multi-Campus Universities can Build a more Connected Security Program
Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university…
Also in Cisco Security Advisories SecurityWeek Huntress +3
-
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
Also in The Hacker News CCCS Alerts & Advisories Bleeping Computer +1
-
AI worms could spread across your smart devices, Anthropic warns
Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand Android TV boxes. They warn that small models could soon spread across vulnerable internet-of-things (IoT) devices, including smart ovens and TV boxes, stating: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV…
Also in Infosecurity Magazine CCCS Alerts & Advisories Malwarebytes Labs
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Also in Zero Day Initiative Zero Day Initiative CCCS Alerts & Advisories
-
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could
Also in SecurityWeek CCCS Alerts & Advisories
-
Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
A cybercrime campaign has compromised at least 143 devices in 34 countries by exploiting flaws in D-Link, Ubiquiti and SAP products. The attackers installed Pawns.app proxy software on victim devices, turning their internet connections into residential proxy nodes. That lets the operator route internet traffic through the victims’ real IP addresses, which can make the activity harder to trace and may help it blend in with ordinary user traffic. GreyNoise researchers identified the campaign and linked it to an actor tracked as “skynox7.” The group used known vulnerabilities in network storage…
-
Google Automatically Adds Your Phone Number to Every Google Account on Your Android Phone
Google automatically verifies phone numbers on Android devices and adds them to every Google account signed in on the Phone. The setting is enabled by default, raising privacy concerns for users who keep personal, work, and secondary accounts separate. Google’s documentation confirms that the behavior covers both existing accounts and accounts added later. The feature, called Phone number verification, also covers new phone numbers added to a device. Adding another Google account can link it to numbers already on the Phone, while adding a new number can attach it to accounts already signed…
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
Also in Zero Day Initiative Zero Day Initiative CCCS Alerts & Advisories
-
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory. There are limited indicators of compromise available at…
Also in The Hacker News CyberScoop CCCS Alerts & Advisories +2
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-110957 | WL-WN530BE2-AWavlink | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os com… Attack
Exploitation
|
|||||||||
| CVE-2026-110958 | WN530HG4BWavlink | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The explo… Attack
Exploitation
|
|||||||||
| CVE-2026-57155 | coreopnsense | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isOPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country… Attack
Exploitation
|
|||||||||
| CVE-2026-110812 | Amazon Neptune EngineAWS | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isDeserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credent… Attack
Exploitation
|
|||||||||
| CVE-2026-105037 | station-middlewareEnergizeLab | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isEnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and s… Attack
Exploitation
|
|||||||||
| CVE-2026-109145 | User Rights Access ManagerWordPress | Critical | 9.8 | 0.1% | — | None linked | — | EPSS 0.1%CVSS 9.8No fix linked | |
What it isThe User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allow… Attack
Exploitation
|
|||||||||
| CVE-2026-109694 | Fluent CRMWP ManageNinja LLC | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isIncorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. Attack
Exploitation
|
|||||||||
| CVE-2026-109686 | Link Whisper FreeLink Whisper INC | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. Attack
Exploitation
|
|||||||||
| CVE-2026-109892 | Frontend Admin by DynamiAppsShabti Kaplan | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isIncorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13. Attack
Exploitation
|
|||||||||
| CVE-2026-84731 | Acropolis Operating System (AOS)Nutanix | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isAn unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfigura… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.