Skip to content
BLACKMESA.CA Brief

Thursday, October 22, 2026 · generated · about 6 min read

Morning Brief

Patch today vendors with the most new CVEs today

Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.

Top developments ranked by cross-source trending

  1. Image: Rapid7 Blog

    CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

    Research Rapid7 Blog21h ago17 sources

    Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk…

    Also in Cisco Security Advisories SANS Internet Storm Center CCCS Alerts & Advisories +3

    CVE-2026-109618 ↗CVE-2026-109619 ↗View on Security Feed

  2. Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

    News The Register Security1h ago9 sources

    China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says. The Windows giant revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments. In some cases, they went from picking a target to gaining privileged cloud access in less than three hours. The findings shed more light on the ConnectWise security incident, which saw the IT management vendor pull the plug on its Cloud Backup…

    Also in Infosecurity Magazine The Hacker News CyberScoop +3

    View on Security Feed

  3. Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

    News The Register Security41m ago7 sources

    Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week. According to Cloudflare CEO Matthew Prince, the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That…

    Also in Infosecurity Magazine The Hacker News Wired Security +3

    View on Security Feed

  4. OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

    News The Hacker News2h ago5 sources

    A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September

    Also in Microsoft Security Microsoft Security Microsoft Security +3

    CVE-2026-61359 ↗CVE-2026-69902 ↗CVE-2026-83709 ↗View on Security Feed

  5. What Security Teams Can Do To Tame Wild Code

    News The Hacker News20 Oct5 sources

    A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them

    Also in Dark Reading Cisco Security Advisories Rapid7 Blog +2

    View on Security Feed

  6. Oracle October 2026 Critical Patch Update Addresses 1209 CVEs

    Research Tenable Blog20 Oct3 sources

    Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates. Key Takeaways The October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295 security updates 112 issues (8.6% of all patches) were assigned a critical severity rating Oracle Fusion Middleware received the highest number of patches at 206, accounting for 15.9% of all patches Background On October 20, Oracle released its Critical Patch Update (CPU) for October 2026 , the final quarterly update of the year. This CPU contains fixes for 1209 unique CVEs in…

    Also in SecurityWeek CCCS Alerts & Advisories

    View on Security Feed

  7. Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

    News The Hacker News17h ago3 sources

    GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an

    Also in CCCS Alerts & Advisories Bleeping Computer

    View on Security Feed

  8. Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands

    News The Hacker News23h ago4 sources

    Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of

    Also in Bleeping Computer SecurityWeek CCCS Alerts & Advisories +1

    View on Security Feed

  9. IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

    News The Register Security2h ago3 sources

    Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our tale comes courtesy of red team and pen testing specialist Dahvid Schloss, who currently serves as COO of Suzu Labs, a cybersecurity company that boasts “we break your systems before adversaries do.” Over a…

    Also in SecurityWeek CCCS Alerts & Advisories

    View on Security Feed

  10. New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks

    News Cyber Security News1h ago2 sources

    A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim’s genuine banking app and install a modified copy in its place. The replacement keeps the bank app’s name and version, but contains extra code designed to interfere with security checks. Instead of relying only on fake login screens displayed over a real app, Hirudo’s operators try to make the banking app itself return answers that hide the malware’s presence. The campaign combines app replacement with credential theft and remote control of infected phones. Its…

    Also in Malwarebytes Labs

    View on Security Feed

Vulnerability watch what to look at, most urgent first

Details CVEProductSeverity CVSSEPSS KEVFixIn the news
Highest scoring today 10new CVEs, highest CVSS first
CVE-2026-101809 WorkflowOracle Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-81212 DataStage on Cloud Pak for DataIBM Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-87337 Oracle Access ManagerOracle Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-91216 Oracle SOA SuiteOracle Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-91221 Oracle SOA SuiteOracle Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-91231 Oracle SOA SuiteOracle Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-91299 JD Edwards EnterpriseOne OrchestratorOracle Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-113744 AC19Tenda Critical 10.0 — — None linked — CVSS 10.0No fix linked
CVE-2026-105312 StreamsHub Console for Apache Kafka®Red Hat Critical 9.9 — — None linked — CVSS 9.9No fix linked
CVE-2026-113389 Vigor2960DrayTek Critical 9.9 — — None linked — CVSS 9.9No fix linked

Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed

Worth reading quieter, still worth your time

  1. From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage

    Research Wiz Research20 Oct3 sources

    How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage

    Also in Malwarebytes Labs Infosecurity Magazine

    View on Security Feed

Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.

Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.

Browse past briefs Patch Tuesday specials RSS feed