Thursday, October 29, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Unknown 185
- Linux 106
- WordPress 1 critical 46
- Dell 7 critical 36
- Microsoft 34
- Juniper 2 critical 18
- labstack 16
- Jenkins 15
- highcharts 15
- n8n-io 14
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Register Security Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. Most (77) of the malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes. “Our guess is…
Also in The Hacker News Cyber Security News Dark Reading +3
-
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in
Also in Malwarebytes Labs CCCS Alerts & Advisories Zero Day Initiative +3
-
Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys
Microsoft urged Entra ID administrators to migrate from SMS and voice authentication in Entra ID to passkeys before retirement begins on February 1, 2027, to reduce phishing risks and prevent sign-in disruptions. The reminder, published on October 27 under Message Center notice MC1528000, follows July announcements. Retirement covers Worldwide and Government Community Cloud environments and should finish in early February 2027. Administrators should not wait until the change reaches their tenant before preparing affected users. According to the Microsoft retirement notice , users with another…
Also in Bleeping Computer Cyber Security News The Hacker News +3
-
319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users
A network of 319 browser extensions has been linked to search hijacking affecting roughly 13.4 million users over a decade. Marketed as PDF converters, manual finders, safe search tools, and AI search helpers, these extensions redirect queries through operator-controlled servers before sending users to Yahoo or Bing. The business model turns ordinary searches into referral income while exposing queries to an intermediary. Similar behavior appeared in an earlier Chrome extension search hijacking investigation involving 23 add-ons, showing how basic browser settings can support large…
Also in CCCS Alerts & Advisories SecurityWeek Malwarebytes Labs +1
-
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they
Also in CCCS Alerts & Advisories SecurityWeek The Register Security
-
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. The flaw can be triggered in every version from
Also in Infosecurity Magazine Cyber Security News The Hacker News +3
-
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the
Also in Bleeping Computer SecurityWeek Cisco Security Advisories
-
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
Also in CCCS Alerts & Advisories Sophos Threat Research Tenable Blog +1
-
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP endpoint that enables ChatGPT-style conversations programmatically. In addition to the features that enable…
Also in Cyber Security News Microsoft Security Microsoft Security
-
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble
Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells. First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. “Our Oracle…
Also in CCCS Alerts & Advisories The Hacker News Bleeping Computer +1
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-61564 | AVideo-EncoderWWBN | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isAVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-qu… Attack
Exploitation
|
|||||||||
| CVE-2026-61567 | AVideo-EncoderWWBN | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isAVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as s… Attack
Exploitation
|
|||||||||
| CVE-2026-44179 | xwiki-pro-macrosxwikisas | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isXWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` conten… Attack
Exploitation
|
|||||||||
| CVE-2026-86397 | PowerProtect Data DomainDell | Critical | 9.8 | 0.3% | — | None linked | — | EPSS 0.3%CVSS 9.8No fix linked | |
What it isDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain … Attack
Exploitation
|
|||||||||
| CVE-2026-86400 | PowerProtect Data DomainDell | Critical | 9.8 | 0.9% | — | None linked | — | EPSS 0.9%CVSS 9.8No fix linked | |
What it isDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain … Attack
Exploitation
|
|||||||||
| CVE-2026-86384 | PowerProtect Data DomainDell | Critical | 9.8 | 0.5% | — | None linked | — | EPSS 0.5%CVSS 9.8No fix linked | |
What it isDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain … Attack
Exploitation
|
|||||||||
| CVE-2026-103780 | PowerProtect Data DomainDell | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain … Attack
Exploitation
|
|||||||||
| CVE-2026-114278 | Eclipse CheEclipse Foundation | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation … Attack
Exploitation
|
|||||||||
| CVE-2026-118477 | KalifastEISGE | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbi… Attack
Exploitation
|
|||||||||
| CVE-2026-115968 | Ultimate MemberUltimate Member | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and update PHP to fixed versions. Tenable helps you find PHP2Shell across your attack surface. Tenable One Attack Surface Management discovers externally facing PHP assets. Tenable…
Also in Cisco Security Advisories CCCS Alerts & Advisories ESET WeLiveSecurity
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.