Sunday, October 25, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 16
- Unknown 7
- YunaiV 4
- CervantesSec 3
- Travisun 3
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations
Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information. Microsoft detailed the change in Message Center notice MC1519866 , published on October 21, 2026. Targeted Release is scheduled to begin in early November and finish by mid-November. Worldwide general availability is expected to start in early December and…
Also in Bleeping Computer Bleeping Computer Dark Reading +3
-
Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell . PHP RCE Vulnerabilities Both flaws involve PHP’s…
Also in Cisco Security Advisories Palo Alto Unit 42 CCCS Alerts & Advisories
-
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Also in Microsoft Security Microsoft Security
-
Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values. An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an…
Also in Wiz Research
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Also in The Hacker News The Register Security
-
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
Also in SecurityWeek
-
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
Also in CCCS Alerts & Advisories
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as "Linus Torvalds Turns to Slop." In the podcast Pivot to AI, podcaster David Gerard agreed: "Linux kernel goes full AI slop code." Meanwhile, in the Tom's Hardware comments section, commenter "LordVile" wrote: "This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage." They followed this by saying this is the "same reason he's flipped-flopped on AI." I've…
Also in The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-115933 | postiz-appGitroomHQ | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isPostiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request it… Attack
Exploitation
|
|||||||||
| CVE-2026-114196 | Paytiumpaytiumsupport | Critical | 9.8 | 0.6% | — | None linked | — | EPSS 0.6%CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. Attack
Exploitation
|
|||||||||
| CVE-2026-94075 | NewslettersMicrosoft | Critical | 9.8 | 0.6% | — | None linked | — | EPSS 0.6%CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1. Attack
Exploitation
|
|||||||||
| CVE-2026-115932 | postiz-appGitroomHQ | Critical | 9.6 | — | — | None linked | — | CVSS 9.6No fix linked | |
What it isWhen a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a pos… Attack
Exploitation
|
|||||||||
| CVE-2026-115995 | Unitree Go2Unitree Robotics | Critical | 9.6 | — | — | None linked | — | CVSS 9.6No fix linked | |
What it isA security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to … Attack
Exploitation
|
|||||||||
| CVE-2026-111402 | NewslettersMicrosoft | Critical | 9.3 | 0.4% | — | None linked | — | EPSS 0.4%CVSS 9.3No fix linked | |
What it isImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1. Attack
Exploitation
|
|||||||||
| CVE-2026-112866 | Product Filter by WBWWPFactory | Critical | 9.3 | 0.4% | — | None linked | — | EPSS 0.4%CVSS 9.3No fix linked | |
What it isImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3… Attack
Exploitation
|
|||||||||
| CVE-2026-114820 | Oracle Java SEOracle | Critical | 9.1 | — | — | None linked | — | CVSS 9.1No fix linked | |
What it isVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17… Attack
Exploitation
|
|||||||||
| CVE-2026-110018 | aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation BuilderWordPress | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isThe aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builde… Attack
Exploitation
|
|||||||||
| CVE-2026-116009 | camaleon-cmsowen2345 | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isCamaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were “now being broadly exploited in the wild.” Read full article Comments
Also in Bleeping Computer
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.