Sunday, October 18, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
Also in Bleeping Computer Cyber Security News The Hacker News +3
-
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users’ shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command. This let a user’s request appear to work normally as the password was stolen. Unit 42’s investigation says the activity also involved web shells, custom malware, mailbox searches and attempts to erase evidence. The operation shows…
Also in Palo Alto Unit 42 The Hacker News CCCS Alerts & Advisories +1
-
Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to…
Also in Volexity SecurityWeek Malwarebytes Labs
-
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Also in The Hacker News The Register Security Microsoft Security
-
How Multi-Campus Universities can Build a more Connected Security Program
Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university…
Also in Bleeping Computer Cisco Security Advisories SecurityWeek
-
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by
Also in CCCS Alerts & Advisories Infosecurity Magazine CCCS Alerts & Advisories
-
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
Also in CCCS Alerts & Advisories
-
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. CISA urges organizations with affected self-hosted…
Also in CCCS Alerts & Advisories SecurityWeek
-
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could
Also in SecurityWeek CCCS Alerts & Advisories
-
Proofpoint lines up $6.3 billion deal for Varonis’ data security
Cybersecurity giant Proofpoint says it will acquire Miami-based data visibility and security company Varonis in an all-cash transaction worth $6.3 billion.
Also in SecurityWeek CyberScoop
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-111911 | phpMyFAQthorsten | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isphpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submi… Attack
Exploitation
|
|||||||||
| CVE-2026-111884 | phpMyFAQthorsten | High | 8.3 | — | — | None linked | — | CVSS 8.3No fix linked | |
What it isphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF t… Attack
Exploitation
|
|||||||||
| CVE-2026-111908 | phpMyFAQthorsten | High | 8.3 | — | — | None linked | — | CVSS 8.3No fix linked | |
What it isphpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access t… Attack
Exploitation
|
|||||||||
| CVE-2026-111882 | phpMyFAQthorsten | High | 8.1 | — | — | None linked | — | CVSS 8.1No fix linked | |
What it isphpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. … Attack
Exploitation
|
|||||||||
| CVE-2026-111909 | phpMyFAQthorsten | High | 8.1 | — | — | None linked | — | CVSS 8.1No fix linked | |
What it isphpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /a… Attack
Exploitation
|
|||||||||
| CVE-2026-111927 | coderCitrix | High | 7.7 | — | — | None linked | — | CVSS 7.7No fix linked | |
What it isCoder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is… Attack
Exploitation
|
|||||||||
| CVE-2026-111881 | FreeRDPFreeRDP | High | 7.6 | — | — | None linked | — | CVSS 7.6No fix linked | |
What it isFreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp… Attack
Exploitation
|
|||||||||
| CVE-2026-110889 | Gantry 5 FrameworkGantry | High | 7.5 | — | — | None linked | — | CVSS 7.5No fix linked | |
What it isGeneration of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4. Attack
Exploitation
|
|||||||||
| CVE-2026-111898 | phpMyFAQthorsten | High | 7.5 | — | — | None linked | — | CVSS 7.5No fix linked | |
What it isphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a collidin… Attack
Exploitation
|
|||||||||
| CVE-2026-111901 | phpMyFAQthorsten | High | 7.5 | — | — | None linked | — | CVSS 7.5No fix linked | |
What it isphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records i… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.