Tuesday, October 20, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Unknown 1 critical 128
- Apache 1 critical 63
- Apple 47
- IBM 38
- python-pillow 25
- WordPress 1 critical 21
- Red Hat 10
- MISP 8
- Microsoft 7
- WSO2 7
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Dark Reading Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
Also in SecurityWeek Bleeping Computer Dark Reading +3
-
Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors
A short-lived change to AOMEI’s software update system gave hackers a way to deliver malware through a trusted route. Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI’s update settings for only a few minutes at a time between April and July 2026. Any AOMEI Backupper computer checking for updates during an active window could receive a malicious download instead of a genuine update. The operation did not rely on a software flaw or require users to open a suspicious file. Instead, the attackers changed two configuration files on AOMEI’s servers…
Also in Malwarebytes Labs Cyber Security News Malwarebytes Labs +2
-
What Security Teams Can Do To Tame Wild Code
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them
Also in Rapid7 Blog Wiz Research Dark Reading
-
Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware
Hackers compromised the GitHub account of an OVHcloud developer and used it to distribute malicious files through the company’s official command-line tool releases. The October 19, 2026, supply chain attack targeted users downloading the OVHcloud CLI, with malware designed to collect secrets stored on their computers. A customer spotted suspicious release changes and alerted the cloud provider, which blocked the malicious files within 94 minutes. OVHcloud CEO Octave Klaba said the affected releases were v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0. He identified v0.10.0 as clean and…
Also in Bleeping Computer The Hacker News The Hacker News +2
-
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the
Also in Infosecurity Magazine CCCS Alerts & Advisories SecurityWeek
-
Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors
Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3.0.123 packages distributed during a limited October download window contained malicious code that could compromise websites when activated. The company removed the affected files and released clean version 3.0.124. The affected window ran from October 15, 2026, at 20:02 UTC to October 16 at 07:12 UTC. Rank Math described the impact as limited but did not provide an affected website count in its…
-
Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication
Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026. The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal’s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating. The most…
Also in SecurityWeek
-
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Also in The Register Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-111057 | mercurymljar | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isMercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /a… Attack
Exploitation
|
|||||||||
| CVE-2026-110887 | HivePressHivePress | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isImproper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32. Attack
Exploitation
|
|||||||||
| CVE-2026-111406 | MapSVGPT Norther Lights Production | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isUnrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1. Attack
Exploitation
|
|||||||||
| CVE-2026-112370 | Magic NX15H3C | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The expl… Attack
Exploitation
|
|||||||||
| CVE-2026-112371 | Magic NX15H3C | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be … Attack
Exploitation
|
|||||||||
| CVE-2026-90910 | Apache AnswerApache | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isMissing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction m… Attack
Exploitation
|
|||||||||
| CVE-2026-112292 | checkcleoperacle | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isCheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/… Attack
Exploitation
|
|||||||||
| CVE-2026-112296 | FlyCmssunkaifei | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isFlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /ap… Attack
Exploitation
|
|||||||||
| CVE-2026-109432 | Camunda 7Camunda | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isCamunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowin… Attack
Exploitation
|
|||||||||
| CVE-2026-111058 | mercurymljar | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isMercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arb… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.