Wednesday, October 21, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Oracle 64 critical 1080
- Google 29 critical 359
- WordPress 58
- apostrophecms 31
- totolink 30 critical 30
- Eclipse Foundation 1 critical 29
- triggerdotdev 28
- Advantech 24
- Unknown 1 critical 23
- curl 23
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Microsoft Offers $40,000 for Complete Azure Vulnerability Reports, Just $4,000 for Incomplete Ones
Microsoft has introduced a new report-assessment system across its bug bounty programs , making the evidence security researchers submit a key factor in their rewards. Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when assessed as Complete, compared with $4,000 when marked Not Complete. The change applies to reports submitted from October 20, 2026, at 8 AM Pacific Time. Earlier submissions remain subject to the previous report quality requirements. Microsoft says the update aims to reduce requests for missing details…
Also in Bleeping Computer Bleeping Computer Cyber Security News +3
-
PHP2Shell Vulnerability Gets a Public PoC Exploit for Security Testing
A public proof-of-concept repository shares verification tools and a lab setup to test two critical PHP vulnerabilities known as php2shell. The flaws, tracked by researchers as CVE-2026-109618 and CVE-2026-109619, are reported to affect PHP’s session.upload_progress feature and could lead to remote code execution under certain conditions. The release adds technical detail to a fast-moving security issue. PHP’s security team announced that an emergency release would address two critical vulnerabilities, each rated 9.2 under CVSS v4.0, and urged users to prepare to upgrade. Its notice scheduled…
Also in SANS Internet Storm Center Tenable Blog SecurityWeek +1
-
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
Also in The Hacker News Malwarebytes Labs Malwarebytes Labs +2
-
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Also in Microsoft Security Microsoft Security Microsoft Security +3
CVE-2026-70074 ↗CVE-2026-83839 ↗CVE-2026-96913 ↗View on Security Feed
-
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)
Also in CCCS Alerts & Advisories Infosecurity Magazine The Hacker News
-
What Security Teams Can Do To Tame Wild Code
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them
Also in Rapid7 Blog Wiz Research Dark Reading
-
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
-
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,
Also in Bleeping Computer The Hacker News Hak5 +1
-
DeepSeek deep-sixed at all US federal civilian agencies
The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations. The order [PDF] is broad, as it requires agencies to ditch "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." Complying will be tricky as it is not clear which third-party products and services have been developed using DeepSeek's wares. Nor is it clear whether "developed using" means providing ongoing access to…
Also in Bleeping Computer CyberScoop
-
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote
Also in Bleeping Computer The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-101809 | WorkflowOracle | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isVulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netw… Attack
Exploitation
|
|||||||||
| CVE-2026-81212 | DataStage on Cloud Pak for DataIBM | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isIBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poi… Attack
Exploitation
|
|||||||||
| CVE-2026-87337 | Oracle Access ManagerOracle | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated… Attack
Exploitation
|
|||||||||
| CVE-2026-91216 | Oracle SOA SuiteOracle | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with… Attack
Exploitation
|
|||||||||
| CVE-2026-91221 | Oracle SOA SuiteOracle | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with… Attack
Exploitation
|
|||||||||
| CVE-2026-91231 | Oracle SOA SuiteOracle | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with net… Attack
Exploitation
|
|||||||||
| CVE-2026-91299 | JD Edwards EnterpriseOne OrchestratorOracle | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isVulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthent… Attack
Exploitation
|
|||||||||
| CVE-2026-113744 | AC19Tenda | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argumen… Attack
Exploitation
|
|||||||||
| CVE-2026-105312 | StreamsHub Console for Apache Kafka®Red Hat | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding t… Attack
Exploitation
|
|||||||||
| CVE-2026-113389 | Vigor2960DrayTek | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectionty… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.