{"date_iso":"2026-10-24","date_human":"Saturday, October 24, 2026","generated_utc":"2026-10-24 12:54 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products","link":"https://cybersecuritynews.com/palo-alto-confirms-php-rce-vulnerabilities/","reason":"CVE-2026-109618","category":"News","sources":["CCCS Alerts & Advisories","Cisco Security Advisories","Cyber Security News","CyberScoop","Kaspersky Securelist","Palo Alto Unit 42","Rapid7 Blog","SANS Internet Storm Center"],"coverage":8,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Palo-Alto-Confirms-PHP-RCE-Vulnerabilities.webp","description":"Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell . PHP RCE Vulnerabilities Both flaws involve PHP\u2019s\u2026","related":[{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"14h ago"},{"title":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)","link":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","source":"Palo Alto Unit 42","date_rel":"17h ago"},{"title":"AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619","source":"CCCS Alerts & Advisories","date_rel":"20h ago"},{"title":"Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)","link":"https://isc.sans.edu/diary/rss/33440","source":"SANS Internet Storm Center","date_rel":"21 Oct"},{"title":"CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP","link":"https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php","source":"Rapid7 Blog","date_rel":"21 Oct"},{"title":"Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)","link":"https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/","source":"Kaspersky Securelist","date_rel":"21 Oct"}]},{"title":"AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack","link":"https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack","reason":"Microsoft","category":"News","sources":["Bleeping Computer","CyberScoop","Dark Reading","Huntress","Infosecurity Magazine","The Hacker News","The Register Security"],"coverage":7,"cve_ids":[],"summary":"Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may compound \u2014 not contain \u2014 the risk.","source":"Dark Reading","date_rel":"23 Oct","thumbnail":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt521637665481bcc9/65dfe9cfea879b040a14fbb9/policerobot-Agencja_Fotograficzna_Caro-alamy.jpg?width=720&quality=80&disable=upscale","description":"","related":[{"title":"Microsoft Teams to get AI-powered, context-aware phishing detection","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/","source":"Bleeping Computer","date_rel":"17h ago"},{"title":"Microsoft: Windows Server 2016 reaches end of support in January","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/","source":"Bleeping Computer","date_rel":"19h ago"},{"title":"Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise","link":"https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/","source":"Infosecurity Magazine","date_rel":"23 Oct"},{"title":"Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack","link":"https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack","source":"Dark Reading","date_rel":"22 Oct"},{"title":"M365 Token Spray and Replay Campaign Compromises Business Email Accounts","link":"https://www.huntress.com/blog/token-replay-spray","source":"Huntress","date_rel":"22 Oct"},{"title":"Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants","link":"https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687","source":"The Register Security","date_rel":"22 Oct"}]},{"title":"Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","link":"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html","reason":"Github","category":"News","sources":["Bleeping Computer","Cyber Security News","Dark Reading","SecurityWeek","The Hacker News"],"coverage":5,"cve_ids":[],"summary":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipiDo2Yur6TXZHLped9EQgORAH65rC4APGTaq_EZzlDnspAaULTQCKblBC0FeIah7nOCKTiQa2Oi8cyx-bbxHj042Km9oYAf2s78XmStFxzPBTSQ_oqv4ZcWGEkUP1wo5JfJ1UDrWQpAtz8ZHd9i3ZbGWWe8s6CMeUU_nObp5tCEywMWGovqFh9NA1H8Sv/s1600/lite.jpg","description":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. \"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of","related":[{"title":"Anthropic\u2019s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers","link":"https://cybersecuritynews.com/claude-mythos-5-inject-malicious-code/","source":"Cyber Security News","date_rel":"5h ago"},{"title":"LiteLLM Compromised in Fresh Supply Chain Attack","link":"https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/","source":"SecurityWeek","date_rel":"23 Oct"},{"title":"Machine speed attacks require machine speed detection and response","link":"https://www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/","source":"Bleeping Computer","date_rel":"22 Oct"},{"title":"LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release","link":"https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors","link":"https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-compromise-glassworm-threat-actors","source":"Dark Reading","date_rel":"21 Oct"}]},{"title":"Hackers got a four-day head start on epic PHP2Shell vulnerability","link":"https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/","reason":"Amazon","category":"Media","sources":["Ars Technica Security","Bleeping Computer","Dark Reading","Huntress","Infosecurity Magazine","The Hacker News","The Register Security","Wired Security"],"coverage":8,"cve_ids":[],"summary":"Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being \u201cbroadly exploited\u201d as governments and companies rush to secure their systems\u2026","source":"Ars Technica Security","date_rel":"22 Oct","thumbnail":"https://cdn.arstechnica.net/wp-content/uploads/2022/03/internet-routing-500x500.jpeg","description":"Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being \u201cbroadly exploited\u201d as governments and companies rush to secure their systems. The world\u2019s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were \u201cnow being broadly exploited in the wild.\u201d Read full article Comments","related":[{"title":"Amazon says PHP2Shell exploitation began 4 days before patches","link":"https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/","source":"Bleeping Computer","date_rel":"22 Oct"},{"title":"Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure","link":"https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749","source":"The Register Security","date_rel":"22 Oct"},{"title":"PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure","link":"https://www.infosecurity-magazine.com/news/php2shell-exploitation-attempt/","source":"Infosecurity Magazine","date_rel":"22 Oct"},{"title":"Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","link":"https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched","link":"https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/","source":"Wired Security","date_rel":"22 Oct"},{"title":"Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware","link":"https://www.huntress.com/blog/amazon-clickfix-finger","source":"Huntress","date_rel":"21 Oct"}]},{"title":"Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","link":"https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html","reason":"Gitlab","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past\u2026","source":"The Hacker News","date_rel":"18h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5n8ST_yuElQgTwbfq1oFnVAoiTvZCW_Ct1b8lT_OQ9dnyeXfocrqzTUJJ1t920YaEa-7Sonxl9KlthV4x7lXI3dmJxc9_S11NjWRJ6dcgfsX4UGhv0KFWZsZrzXKpjh92JPyDdHPlCPQh1AHd0YKM44sVcc9d-57r8_BdrIb3V06MWfk8bRAy4kDU6I/s1600/ruby-rce.jpg","description":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any","related":[{"title":"ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More","link":"https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"Max-severity GitLab bug allows remote code execution over 12 years of releases","link":"https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854","source":"The Register Security","date_rel":"22 Oct"},{"title":"GitLab security advisory (AV26-1074)","link":"https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1074","source":"CCCS Alerts & Advisories","date_rel":"22 Oct"},{"title":"GitLab warns of new max severity code execution vulnerability","link":"https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/","source":"Bleeping Computer","date_rel":"22 Oct"},{"title":"Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases","link":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","source":"The Hacker News","date_rel":"21 Oct"}]},{"title":"Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches","link":"https://www.theregister.com/columnists/2026/10/23/torvalds-ai-is-fine-for-competent-devs-but-spare-us-the-drive-by-patches/5304357","reason":"Linux","category":"News","sources":["CISA Alerts & Advisories","CISA ICS Advisories","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as \"Linus\u2026","source":"The Register Security","date_rel":"23 Oct","thumbnail":"https://image.theregister.com/?imageId=5226908&width=800","description":"Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as \"Linus Torvalds Turns to Slop.\" In the podcast Pivot to AI, podcaster David Gerard agreed: \"Linux kernel goes full AI slop code.\" Meanwhile, in the Tom's Hardware comments section, commenter \"LordVile\" wrote: \"This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage.\" They followed this by saying this is the \"same reason he's flipped-flopped on AI.\" I've\u2026","related":[{"title":"Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","link":"https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 TM MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16","source":"CISA Alerts & Advisories","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11","source":"CISA ICS Advisories","date_rel":"22 Oct"},{"title":"Siemens SIMATIC S7-1500 TM MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16","source":"CISA ICS Advisories","date_rel":"22 Oct"}]},{"title":"BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","link":"https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html","reason":"Windows","category":"News","sources":["Huntress","Microsoft Security","The Hacker News"],"coverage":3,"cve_ids":["CVE-2026-102208","CVE-2026-61359","CVE-2026-83862"],"summary":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan\u2026","source":"The Hacker News","date_rel":"18h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0cTK7D5hQFR-3qGTicTlfi6_CbnMIgCJWIojDeXmZr91hrIPqhhxZ72mAsnB6kBOcCdscZOL_VN8RhAdYIxq3d128rkaDweIApSaV5w3IzB1YGN3XNnlarG0IKN5VuDJy_RnPBxXZoKQ1Yh950YFNz-b_pbvEY_QlQa5Tr-BP4366UgkGIg968J-QEN1M/s1600/uefi.jpg","description":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report","related":[{"title":"CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862","source":"Microsoft Security","date_rel":"22h ago"},{"title":"CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208","source":"Microsoft Security","date_rel":"22h ago"},{"title":"OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL","link":"https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61359","source":"Microsoft Security","date_rel":"21 Oct"},{"title":"Attack Reduction in Huntress Managed ESPM: Disrupting ClickFix","link":"https://www.huntress.com/blog/espm-attack-reduction-clickfix","source":"Huntress","date_rel":"21 Oct"}]},{"title":"Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands","link":"https://cybersecuritynews.com/okta-access-gateway-flaw/","reason":"Okta","category":"News","sources":["Cyber Security News","Wiz Research"],"coverage":2,"cve_ids":["CVE-2026-115547"],"summary":"Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance\u2019s Admin Console. Tracked as CVE-2026-115547, the vulnerability\u2026","source":"Cyber Security News","date_rel":"21h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Critical-Okta-Access-Gateway-Flaw-Lets-Attackers-With-Admin-Access-Execute-System-Commands.webp","description":"Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance\u2019s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values. An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an\u2026","related":[{"title":"ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors","link":"https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors","source":"Wiz Research","date_rel":"22 Oct"}]},{"title":"Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","link":"https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html","reason":"Fortinet","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this\u2026","source":"The Hacker News","date_rel":"23h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSk-Q06Dd5YyYmXWMt9b860DzGRKbTae_QwvoZDKNICaEznAj2AUurJmv6vPnpcH7qqDjauFZWWx7GX1RN93BLaU9Rqgiqe9j1iQRg2Vqcz3HpSqgesA6oS-GrMTyx4CTzwOD7C_z205k57ZpT70Gv4RXi-65X-nyI04wpA3raJ5nh46pN5ox42cyLnHjv/s1600/1000117358.jpg","description":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,","related":[{"title":"Fortinet security advisory (AV26-1081)","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1081","source":"CCCS Alerts & Advisories","date_rel":"22h ago"},{"title":"Fortinet security advisory (AV26-1037) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","source":"CCCS Alerts & Advisories","date_rel":"23h ago"}]},{"title":"IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall","link":"https://www.theregister.com/security/2026/10/22/it-department-and-auditors-at-major-pharmacy-chain-got-into-a-rip-roaring-fight-about-using-password-on-cisco-firewall/5304592","reason":"Cisco","category":"News","sources":["CCCS Alerts & Advisories","The Register Security","Zero Day Initiative"],"coverage":3,"cve_ids":[],"summary":"Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week\u2019s sad story involves a major American pharmacy chain that couldn\u2019t fill a\u2026","source":"The Register Security","date_rel":"22 Oct","thumbnail":"https://image.theregister.com/?imageId=5304595&width=800","description":"Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week\u2019s sad story involves a major American pharmacy chain that couldn\u2019t fill a prescription for password security. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our tale comes courtesy of red team and pen testing specialist Dahvid Schloss, who currently serves as COO of Suzu Labs, a cybersecurity company that boasts \u201cwe break your systems before adversaries do.\u201d Over a\u2026","related":[{"title":"ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-788/","source":"Zero Day Initiative","date_rel":"22 Oct"},{"title":"Cisco security advisory (AV26-1073)","link":"https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1073","source":"CCCS Alerts & Advisories","date_rel":"21 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-53942","vendor":"conda","product":"infrastructure","severity":"CRITICAL","score":9.9,"description":"Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/u\u2026","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://github.com/conda/infrastructure/commit/9c0f23857282ff5cf7a6b3ad6bf0dd6f9974be55","https://github.com/conda/infrastructure/security/advisories/GHSA-pf87-fcg3-wjfh"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-53942"},{"id":"CVE-2026-115889","vendor":"bytecodealliance","product":"wasmtime","severity":"CRITICAL","score":9.9,"description":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wa\u2026","cwe":"CWE-197","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0","https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","https://github.com/bytecodealliance/wasmtime/pull/12613"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115889"},{"id":"CVE-2026-115893","vendor":"bytecodealliance","product":"wasmtime","severity":"CRITICAL","score":9.9,"description":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditio\u2026","cwe":"CWE-691","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115893"},{"id":"CVE-2026-115931","vendor":"GitroomHQ","product":"postiz-app","severity":"CRITICAL","score":9.9,"description":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be rea\u2026","cwe":"CWE-73","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gadvisory.org/advisories/PSA-2026-JNXM56","https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115931"},{"id":"CVE-2026-63244","vendor":"WizLearn Technologies Pte. Ltd.","product":"Learning Management System","severity":"CRITICAL","score":9.8,"description":"An authentication\nbypass vulnerability in WizLearn Technologies' Learning Management System (LMS)\ncould allow an unauthenticated remote attacker to bypass password\nauthentication and the OAuth authentication flow by sending a specially craf\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0054,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-155"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-63244"},{"id":"CVE-2026-112862","vendor":"xnau webdesign","product":"Participants Database","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0031,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-8-5-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112862"},{"id":"CVE-2026-25784","vendor":"Hallo Welt! GmbH","product":"BlueSpice","severity":"CRITICAL","score":9.8,"description":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's Local\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0034,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-25784"},{"id":"CVE-2026-112846","vendor":"ThemeREX Group","product":"Save Life","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/theme/save-life/vulnerability/wordpress-save-life-theme-1-2-14-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112846"},{"id":"CVE-2026-112847","vendor":"ThemeREX","product":"ZenSoul","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/theme/zensoul/vulnerability/wordpress-zensoul-theme-1-13-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112847"},{"id":"CVE-2026-112848","vendor":"AivahThemes","product":"Hostme v2","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112848"}],"vendor_spikes":[{"vendor":"Linux","count":203,"critical_count":0},{"vendor":"WordPress","count":21,"critical_count":1},{"vendor":"Microsoft","count":20,"critical_count":1},{"vendor":"Zimbra","count":16,"critical_count":0},{"vendor":"CGM","count":11,"critical_count":0},{"vendor":"Apple","count":11,"critical_count":0},{"vendor":"Unknown","count":11,"critical_count":0},{"vendor":"intranda","count":10,"critical_count":3},{"vendor":"Eclipse Foundation","count":9,"critical_count":0},{"vendor":"Google","count":8,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":18,"new_cve_count":469,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-109618":{"anchor":"#dev-1","rank":1,"coverage":8},"CVE-2026-109619":{"anchor":"#dev-1","rank":1,"coverage":8},"CVE-2026-102208":{"anchor":"#dev-7","rank":7,"coverage":3},"CVE-2026-61359":{"anchor":"#dev-7","rank":7,"coverage":3},"CVE-2026-83862":{"anchor":"#dev-7","rank":7,"coverage":3},"CVE-2026-115547":{"anchor":"#dev-8","rank":8,"coverage":2}}}