{"date_iso":"2026-10-22","date_human":"Thursday, October 22, 2026","generated_utc":"2026-10-22 12:57 UTC","read_minutes":6,"patch_tuesday":false,"top_stories":[{"title":"CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP","link":"https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php","reason":"CVE-2026-109618","category":"Research","sources":["Bleeping Computer","CCCS Alerts & Advisories","CISA Alerts & Advisories","Cisco Security Advisories","CyberScoop","Elastic Security Labs","Fortinet PSIRT","Huntress","Kaspersky Securelist","NCSC UK","Palo Alto Unit 42","Rapid7 Blog","Recorded Future Intelligence","SANS Internet Storm Center","SecurityWeek","Sophos Threat Research","Tenable Blog"],"coverage":17,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a\u2026","source":"Rapid7 Blog","date_rel":"21h ago","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt65a432ba319f4043/6846abddaf18306debe6cf4d/ETR.webp","description":"Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk\u2026","related":[{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"11h ago"},{"title":"Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)","link":"https://isc.sans.edu/diary/rss/33440","source":"SANS Internet Storm Center","date_rel":"15h ago"},{"title":"AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619","link":"https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619","source":"CCCS Alerts & Advisories","date_rel":"19h ago"},{"title":"PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors","link":"https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/","source":"SecurityWeek","date_rel":"20h ago"},{"title":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619","link":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","source":"Palo Alto Unit 42","date_rel":"20h ago"},{"title":"Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)","link":"https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/","source":"Kaspersky Securelist","date_rel":"21h ago"}]},{"title":"Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants","link":"https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cisco Talos","CyberScoop","Dark Reading","Huntress","Infosecurity Magazine","Tenable Blog","The Hacker News","The Register Security"],"coverage":9,"cve_ids":[],"summary":"China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says. The Windows giant revealed this week that the attackers\u2026","source":"The Register Security","date_rel":"1h ago","thumbnail":"https://image.theregister.com/?imageId=5304691&width=800","description":"China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says. The Windows giant revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments. In some cases, they went from picking a target to gaining privileged cloud access in less than three hours. The findings shed more light on the ConnectWise security incident, which saw the IT management vendor pull the plug on its Cloud Backup\u2026","related":[{"title":"Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants","link":"https://www.infosecurity-magazine.com/news/microsoft-chinese-ai-connectwise/","source":"Infosecurity Magazine","date_rel":"1h ago"},{"title":"China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack","link":"https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html","source":"The Hacker News","date_rel":"8h ago"},{"title":"Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group","link":"https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/","source":"CyberScoop","date_rel":"14h ago"},{"title":"Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security","link":"https://www.darkreading.com/cloud-security/marvell-microsoft-oracle-standardize-data-center-hardware-security","source":"Dark Reading","date_rel":"16h ago"},{"title":"Microsoft PowerToys adds CursorHide, Button Lock mouse tools","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-powertoys-adds-cursorhide-button-lock-mouse-tools/","source":"Bleeping Computer","date_rel":"21 Oct"},{"title":"Microsoft says October updates didn\u2019t actually fix VPN issues","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-didnt-actually-fix-vpn-issues-caused-by-windows-updates/","source":"Bleeping Computer","date_rel":"21 Oct"}]},{"title":"Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure","link":"https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749","reason":"Amazon","category":"News","sources":["Dark Reading","Huntress","Infosecurity Magazine","Malwarebytes Labs","The Hacker News","The Register Security","Wired Security"],"coverage":7,"cve_ids":[],"summary":"Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly\u2026","source":"The Register Security","date_rel":"41m ago","thumbnail":"https://image.theregister.com/?imageId=5255785&width=800","description":"Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities, with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare says it has recorded a staggering increase in attacks targeting the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, since details began circulating earlier this week. According to Cloudflare CEO Matthew Prince, the company spotted thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly announced. That\u2026","related":[{"title":"PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure","link":"https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","link":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","source":"The Hacker News","date_rel":"6h ago"},{"title":"Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","link":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","source":"Wired Security","date_rel":"10h ago"},{"title":"Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware","link":"https://www.huntress.com/blog/amazon-clickfix-finger","source":"Huntress","date_rel":"23h ago"},{"title":"Decades-Old Windows Utility Powers Modern ClickFix Attack","link":"https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack","source":"Dark Reading","date_rel":"23h ago"},{"title":"Fake Amazon Music x YouTube deal lures creators into a Google login trap","link":"https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-amazon-music-x-youtube-deal-lures-creators-into-a-google-login-trap","source":"Malwarebytes Labs","date_rel":"21 Oct"}]},{"title":"OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL","link":"https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html","reason":"Windows","category":"News","sources":["CISA Alerts & Advisories","CISA ICS Advisories","Huntress","Microsoft Security","The Hacker News"],"coverage":5,"cve_ids":["CVE-2026-61359","CVE-2026-69902","CVE-2026-83709"],"summary":"A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol)\u2026","source":"The Hacker News","date_rel":"2h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUmn80CiQx35trhXNaAwJka_Z3T-PKQrz__dlAW1GDDVwfrk2WHit1W6GZBaaAT-a9SrmqqauUhw0raYLEOS3Vv-LNxdu0a2bmJebJWVj5mBadfgxN1N1yVREXflCcV7cPmShswRE8PC0qspFY82MDEKe8MJImYVqJCBYLwTLpCHM1IzjDX7KsOAYs7tc/s1600/opencode-mcp.jpg","description":"A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September","related":[{"title":"CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61359","source":"Microsoft Security","date_rel":"22h ago"},{"title":"CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83709","source":"Microsoft Security","date_rel":"22h ago"},{"title":"CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69902","source":"Microsoft Security","date_rel":"22h ago"},{"title":"Attack Reduction in Huntress Managed ESPM: Disrupting ClickFix","link":"https://www.huntress.com/blog/espm-attack-reduction-clickfix","source":"Huntress","date_rel":"23h ago"},{"title":"HMS Networks PEAK-System PCAN Windows drivers","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01","source":"CISA ICS Advisories","date_rel":"20 Oct"},{"title":"HMS Networks PEAK-System PCAN Windows drivers","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01","source":"CISA Alerts & Advisories","date_rel":"20 Oct"}]},{"title":"What Security Teams Can Do To Tame Wild Code","link":"https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html","reason":"Teams","category":"News","sources":["Cisco Security Advisories","Dark Reading","Rapid7 Blog","The Hacker News","Wiz Research"],"coverage":5,"cve_ids":[],"summary":"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon\u2026","source":"The Hacker News","date_rel":"20 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7Q3156iY5WJRnphGSZ5PuIiMopF0sG7ku3FR-WROda9fE4jCSIOQpClG1HOBRCvbuqDyLHgsC0N3UFjowgnXzZN4T1mDpkQbTz2gX7z4NRZsfoEpimVlZ7hevcXmeTfpOt1iFrHqvLXubegNIRz15gjlQNHIBBYzQVAmy8MNAGiZs6OXIEuWNntLwTlI/s1600/tines-main.jpg","description":"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team\u2019s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them","related":[{"title":"'PHP2Shell' Bugs Signal Red Alert for Security Industry","link":"https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry","source":"Dark Reading","date_rel":"17h ago"},{"title":"Cisco Unified Communications Products Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"20h ago"},{"title":"Your Next Insider Threat Won\u2019t be Human: Securing AI Agents From the Outside in","link":"https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents","source":"Rapid7 Blog","date_rel":"19 Oct"},{"title":"Supply Chain Zero Days: Closing the Gap Between Publication and Detection","link":"https://www.wiz.io/blog/detect-supply-chain-zero-days-at-publication","source":"Wiz Research","date_rel":"19 Oct"},{"title":"The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience","link":"https://www.darkreading.com/vulnerabilities-threats/cybersecurity-lexicon-vulnerability-discovery-resilience","source":"Dark Reading","date_rel":"19 Oct"}]},{"title":"Oracle October 2026 Critical Patch Update Addresses 1209 CVEs","link":"https://www.tenable.com/blog/oracle-october-2026-critical-patch-update-addresses-1209-cves","reason":"Oracle","category":"Research","sources":["CCCS Alerts & Advisories","SecurityWeek","Tenable Blog"],"coverage":3,"cve_ids":[],"summary":"Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates. Key Takeaways The October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295\u2026","source":"Tenable Blog","date_rel":"20 Oct","thumbnail":"","description":"Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates. Key Takeaways The October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295 security updates 112 issues (8.6% of all patches) were assigned a critical severity rating Oracle Fusion Middleware received the highest number of patches at 206, accounting for 15.9% of all patches Background On October 20, Oracle released its Critical Patch Update (CPU) for October 2026 , the final quarterly update of the year. This CPU contains fixes for 1209 unique CVEs in\u2026","related":[{"title":"Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU","link":"https://www.securityweek.com/oracle-patches-over-1200-vulnerabilities-with-october-2026-cpu/","source":"SecurityWeek","date_rel":"5h ago"},{"title":"Oracle Corporation security advisory (AV26-1071)","link":"https://cyber.gc.ca/en/alerts-advisories/oracle-corporation-security-advisory-av26-1071","source":"CCCS Alerts & Advisories","date_rel":"18h ago"}]},{"title":"Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases","link":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","reason":"Gitlab","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix\u2026","source":"The Hacker News","date_rel":"17h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEig4Pkd5r0GeWGSaCoHaEsZVVoh5Y6xBkFvMTGYKvD5oONYnczQGAUqpjD6eCiA6sxiiel6Zs0kPiBEWOZJ21URkE59iJm-LDUFPYwPEf8o8d8lnyiMOR53H7IeXGKn3tTG9pusA-HKwYo0n04WQ1m8kg8dxIWEtxFGMDiBzrV-zzqAH2R2OVT2E1ViX_U/s1600/git-rce.jpg","description":"GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an","related":[{"title":"GitLab security advisory (AV26-1074)","link":"https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1074","source":"CCCS Alerts & Advisories","date_rel":"29m ago"},{"title":"GitLab warns of new max severity code execution vulnerability","link":"https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/","source":"Bleeping Computer","date_rel":"1h ago"}]},{"title":"Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands","link":"https://thehackernews.com/2026/10/google-chrome-adds-clickfix-warnings-to.html","reason":"Chrome","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which\u2026","source":"The Hacker News","date_rel":"23h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkkBWQk1mVx_ybLuq6r6miCGLiZJUyA_-tPpzi5cyWpcmN_WX43NqfOoH-Tc5VaAh1rVA78waqQ9hx4j-jNwq1GX9bbZjezpx1Q28YcxlBPqnxMbbHd15spg63hSVS0sidhyR9wTg6Aq7ijZJdNIfdY_jev1_K4KJR-6yIoCLlD6cbkGwVY3SUke5IuXS5/s1600/chrome-clickfix-warning.jpg","description":"Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of","related":[{"title":"Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks","link":"https://www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks/","source":"Bleeping Computer","date_rel":"14h ago"},{"title":"Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections","link":"https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/","source":"SecurityWeek","date_rel":"19h ago"},{"title":"Google Chrome security advisory (AV26-1069)","link":"https://cyber.gc.ca/en/alerts-advisories/google-chrome-security-advisory-av26-1069","source":"CCCS Alerts & Advisories","date_rel":"23h ago"},{"title":"Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software","link":"https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html","source":"The Hacker News","date_rel":"20 Oct"}]},{"title":"IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall","link":"https://www.theregister.com/security/2026/10/22/it-department-and-auditors-at-major-pharmacy-chain-got-into-a-rip-roaring-fight-about-using-password-on-cisco-firewall/5304592","reason":"Cisco","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek","The Register Security"],"coverage":3,"cve_ids":[],"summary":"Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week\u2019s sad story involves a major American pharmacy chain that couldn\u2019t fill a\u2026","source":"The Register Security","date_rel":"2h ago","thumbnail":"https://image.theregister.com/?imageId=5304595&width=800","description":"Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week\u2019s sad story involves a major American pharmacy chain that couldn\u2019t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our tale comes courtesy of red team and pen testing specialist Dahvid Schloss, who currently serves as COO of Suzu Labs, a cybersecurity company that boasts \u201cwe break your systems before adversaries do.\u201d Over a\u2026","related":[{"title":"Cisco Patches 34 Vulnerabilities Across Multiple Products","link":"https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/","source":"SecurityWeek","date_rel":"2h ago"},{"title":"Cisco security advisory (AV26-1073)","link":"https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1073","source":"CCCS Alerts & Advisories","date_rel":"17h ago"}]},{"title":"New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks","link":"https://cybersecuritynews.com/new-android-malware-2/","reason":"Android","category":"News","sources":["Cyber Security News","Malwarebytes Labs"],"coverage":2,"cve_ids":[],"summary":"A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim\u2019s genuine banking app and install a modified copy in its place. The replacement keeps the\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/New-Android-Malware-Replaces-Legitimate-Banking-Apps-With-Malicious-Copies-to-Bypass-Security-Checks.webp","description":"A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim\u2019s genuine banking app and install a modified copy in its place. The replacement keeps the bank app\u2019s name and version, but contains extra code designed to interfere with security checks. Instead of relying only on fake login screens displayed over a real app, Hirudo\u2019s operators try to make the banking app itself return answers that hide the malware\u2019s presence. The campaign combines app replacement with credential theft and remote control of infected phones. Its\u2026","related":[{"title":"Google may add your number to all your accounts: How to stop it","link":"https://www.malwarebytes.com/blog/mobile/2026/10/google-may-add-your-number-to-all-your-accounts-how-to-stop-it","source":"Malwarebytes Labs","date_rel":"20 Oct"}]}],"worth_reading":[{"title":"From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage","link":"https://www.wiz.io/blog/from-phishing-to-llmjacking","reason":"Google","category":"Research","sources":["Infosecurity Magazine","Malwarebytes Labs","Wiz Research"],"coverage":3,"cve_ids":[],"summary":"How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage","source":"Wiz Research","date_rel":"20 Oct","thumbnail":"https://www.datocms-assets.com/75231/1792511853-4-1.png","description":"","related":[{"title":"AOMEI Backupper update servers hijacked to push malware: Check your PC","link":"https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc","source":"Malwarebytes Labs","date_rel":"19 Oct"},{"title":"OpenCode Breach Could Affect OpenAI, Anthropic and Google","link":"https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/","source":"Infosecurity Magazine","date_rel":"19 Oct"}]}],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-101809","vendor":"Oracle","product":"Workflow","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netw\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-101809"},{"id":"CVE-2026-81212","vendor":"IBM","product":"DataStage on Cloud Pak for Data","severity":"CRITICAL","score":10.0,"description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poi\u2026","cwe":"CWE-285","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7289603"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-81212"},{"id":"CVE-2026-87337","vendor":"Oracle","product":"Oracle Access Manager","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-87337"},{"id":"CVE-2026-91216","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91216"},{"id":"CVE-2026-91221","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91221"},{"id":"CVE-2026-91231","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with net\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91231"},{"id":"CVE-2026-91299","vendor":"Oracle","product":"JD Edwards EnterpriseOne Orchestrator","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthent\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91299"},{"id":"CVE-2026-113744","vendor":"Tenda","product":"AC19","severity":"CRITICAL","score":10.0,"description":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argumen\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/henrythekingofuk/TendaCVE","https://vuldb.com/cve/CVE-2026-113744","https://vuldb.com/submit/1018542"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-113744"},{"id":"CVE-2026-105312","vendor":"Red Hat","product":"StreamsHub Console for Apache Kafka\u00ae","severity":"CRITICAL","score":9.9,"description":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding t\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://access.redhat.com/security/cve/CVE-2026-105312","https://bugzilla.redhat.com/show_bug.cgi?id=2510863"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-105312"},{"id":"CVE-2026-113389","vendor":"DrayTek","product":"Vigor2960","severity":"CRITICAL","score":9.9,"description":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectionty\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection","https://vuldb.com/cve/CVE-2026-113389","https://vuldb.com/submit/992223"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-113389"}],"vendor_spikes":[{"vendor":"Oracle","count":1080,"critical_count":64},{"vendor":"Google","count":359,"critical_count":29},{"vendor":"WordPress","count":58,"critical_count":0},{"vendor":"apostrophecms","count":31,"critical_count":0},{"vendor":"totolink","count":30,"critical_count":30},{"vendor":"Eclipse Foundation","count":29,"critical_count":1},{"vendor":"triggerdotdev","count":28,"critical_count":0},{"vendor":"Advantech","count":24,"critical_count":0},{"vendor":"Unknown","count":23,"critical_count":1},{"vendor":"curl","count":23,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":20,"new_cve_count":1997,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-109618":{"anchor":"#dev-1","rank":1,"coverage":17},"CVE-2026-109619":{"anchor":"#dev-1","rank":1,"coverage":17},"CVE-2026-61359":{"anchor":"#dev-4","rank":4,"coverage":5},"CVE-2026-69902":{"anchor":"#dev-4","rank":4,"coverage":5},"CVE-2026-83709":{"anchor":"#dev-4","rank":4,"coverage":5}}}