Saturday, October 17, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 3 critical 84
- Unknown 1 critical 21
- Red Hat 15
- Mattermost 13
- Microsoft 13
- Apache 12
- Oracle 3 critical 10
- IBM 9
- mz-automation 6
- TandoorRecipes 6
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor secret can create risk across many organizations when a multitenant app already has wide permissions. The affected product is ConnectWise Cloud Backup, formerly known as SkyKick Backup. Managed service providers use the platform to protect Microsoft 365 and Google Workspace data. To perform backup and recovery tasks, the Microsoft 365 app may receive access to Exchange…
Also in The Hacker News Huntress Bleeping Computer +3
-
Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to…
Also in Volexity SecurityWeek Malwarebytes Labs +1
-
How Multi-Campus Universities can Build a more Connected Security Program
Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university…
Also in Bleeping Computer Cisco Security Advisories SecurityWeek +1
-
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users’ shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command. This let a user’s request appear to work normally as the password was stolen. Unit 42’s investigation says the activity also involved web shells, custom malware, mailbox searches and attempts to erase evidence. The operation shows…
Also in Palo Alto Unit 42 The Hacker News CCCS Alerts & Advisories +1
-
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by
Also in CCCS Alerts & Advisories Infosecurity Magazine CCCS Alerts & Advisories +1
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
Also in Bleeping Computer Zero Day Initiative Zero Day Initiative +1
-
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Also in The Hacker News The Register Security Microsoft Security
-
Cisco make-me-root email bug exploited as a 0-day by unknown crims
Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.” The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system - simply by sending a malicious email. In separate Wednesday advisories, both the…
Also in Dark Reading CCCS Alerts & Advisories The Hacker News
-
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
Also in CCCS Alerts & Advisories The Register Security The Hacker News
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Also in CISA Alerts & Advisories Zero Day Initiative Zero Day Initiative
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-94169 | The GridTheme-one | Critical | 10.0 | 1.0% | — | None linked | — | EPSS 1.0%CVSS 10.0No fix linked | |
What it isImproper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1. Attack
Exploitation
|
|||||||||
| CVE-2026-95182 | Unknown | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isAn untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. Attack
Exploitation
|
|||||||||
| CVE-2026-85746 | serverOracle | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections … Attack
Exploitation
|
|||||||||
| CVE-2026-85748 | serverOracle | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isMariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacke… Attack
Exploitation
|
|||||||||
| CVE-2026-92262 | serverOracle | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-na… Attack
Exploitation
|
|||||||||
| CVE-2026-104730 | Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for PhotographersWordPress | Critical | 9.8 | 0.5% | — | None linked | — | EPSS 0.5%CVSS 9.8No fix linked | |
What it isThe Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it … Attack
Exploitation
|
|||||||||
| CVE-2026-107617 | EseeCloud AppGuangzhou Juan IoT Technology Co., Ltd. | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isAn attacker can use a hard-coded credential to log in to EseeCloud devices. Attack
Exploitation
|
|||||||||
| CVE-2026-49868 | RIOTRIOT-OS | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isRIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before… Attack
Exploitation
|
|||||||||
| CVE-2026-111626 | DamselflyWebreaper | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isWebreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/u… Attack
Exploitation
|
|||||||||
| CVE-2026-111641 | FastapiAdminfastapiadmin | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isFastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.