{"date_iso":"2026-10-29","date_human":"Thursday, October 29, 2026","generated_utc":"2026-10-29 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour","link":"https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153","reason":"Github","category":"News","sources":["Check Point Research","Cyber Security News","Dark Reading","Infosecurity Magazine","The Hacker News","The Register Security","Wiz Research"],"coverage":7,"cve_ids":[],"summary":"EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a\u2026","source":"The Register Security","date_rel":"57m ago","thumbnail":"https://image.theregister.com/?imageId=5241038&width=800","description":"EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. Most (77) of the malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes. \u201cOur guess is\u2026","related":[{"title":"GitHub Launches npm Firewall to Block Malicious Packages Before Installation","link":"https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html","source":"The Hacker News","date_rel":"2h ago"},{"title":"GitHub Launches Copilot Fusion for Smarter and Cheaper AI Coding","link":"https://cybersecuritynews.com/github-launches-copilot-fusion/","source":"Cyber Security News","date_rel":"2h ago"},{"title":"GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub","link":"https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github","source":"Dark Reading","date_rel":"17h ago"},{"title":"Tricks from the Past deployed via signed ChatGPT and Claude binaries","link":"https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/","source":"Check Point Research","date_rel":"27 Oct"},{"title":"Worm armed 42 GitHub repos by hiding a payload too big to fail","link":"https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570","source":"The Register Security","date_rel":"26 Oct"},{"title":"LiteLLM supply chain attack started with an exposed master key","link":"https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544","source":"The Register Security","date_rel":"26 Oct"}]},{"title":"Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads","link":"https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html","reason":"Apple","category":"News","sources":["404 Media","CCCS Alerts & Advisories","Malwarebytes Labs","SANS Internet Storm Center","The Hacker News","Zero Day Initiative"],"coverage":6,"cve_ids":["CVE-2026-86950"],"summary":"Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds\u2026","source":"The Hacker News","date_rel":"27 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqZx9ghfLBFufN5Q4s1dq2U1rXwenlfzU7UsqQfLWn3AEUe5CX3krGuvC6DM4mF2T9MmscvntBNxmgU7UjNOnfJQteKvuAs-4Nq0vJ3TnTkuFy1TRO3ibdh2Ekqi_WqiInvPkXjYlnvrCuYb5mb8neOOqBbmf_034wh8MPOLPKW2Nvvezpb2LFNXPbeUa6/s1600/apple-patch.jpg","description":"Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in","related":[{"title":"Have an older iPhone or iPad? Apple has a security update for you","link":"https://www.malwarebytes.com/blog/bugs/2026/10/have-an-older-iphone-or-ipad-apple-has-a-security-update-for-you","source":"Malwarebytes Labs","date_rel":"1h ago"},{"title":"Apple security advisory (AV26-1099)","link":"https://cyber.gc.ca/en/alerts-advisories/apple-security-advisory-av26-1099","source":"CCCS Alerts & Advisories","date_rel":"17h ago"},{"title":"ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-831/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-830/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"Apple Patches for October 2026, (Mon, Oct 26th)","link":"https://isc.sans.edu/diary/rss/33458","source":"SANS Internet Storm Center","date_rel":"27 Oct"},{"title":"iPhone Duo Users Are Already Seeing a Big Old Crease in the Middle of Their $2,000 Foldable iPhone","link":"https://www.404media.co/iphone-duo-crackgate-crease-folding-phone/","source":"404 Media","date_rel":"26 Oct"}]},{"title":"Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys","link":"https://cybersecuritynews.com/microsoft-urges-admins-to-migrate-passkeys/","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","CyberScoop","Huntress","Proofpoint Threat Insight","The Hacker News","The Register Security"],"coverage":7,"cve_ids":[],"summary":"Microsoft urged Entra ID administrators to migrate from SMS and voice authentication in Entra ID to passkeys before retirement begins on February 1, 2027, to reduce phishing risks and prevent sign-in disruptions. The\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Microsoft-Urges-Admins-Passkeys.webp","description":"Microsoft urged Entra ID administrators to migrate from SMS and voice authentication in Entra ID to passkeys before retirement begins on February 1, 2027, to reduce phishing risks and prevent sign-in disruptions. The reminder, published on October 27 under Message Center notice MC1528000, follows July announcements. Retirement covers Worldwide and Government Community Cloud environments and should finish in early February 2027. Administrators should not wait until the change reaches their tenant before preparing affected users. According to the Microsoft retirement notice , users with another\u2026","related":[{"title":"Windows 11 KB5127936 update released with 41 changes and fixes","link":"https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5127936-update-released-with-41-changes-and-fixes/","source":"Bleeping Computer","date_rel":"56m ago"},{"title":"Microsoft Edge 0-Click Exploit Chains Five Flaws to Execute Code and Escape Sandbox","link":"https://cybersecuritynews.com/microsoft-edge-zero-click-exploit/","source":"Cyber Security News","date_rel":"4h ago"},{"title":"Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win","link":"https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html","source":"The Hacker News","date_rel":"20h ago"},{"title":"Microsoft urges Entra ID admins to migrate users to passkeys","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"Microsoft releases out-of-band Windows fixes with certificate updates","link":"https://www.theregister.com/security/2026/10/27/microsoft-releases-out-of-band-windows-fixes-with-certificate-updates/5305637","source":"The Register Security","date_rel":"27 Oct"},{"title":"What happens when security tools go dark before the ransomware","link":"https://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed/","source":"CyberScoop","date_rel":"27 Oct"}]},{"title":"319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users","link":"https://cybersecuritynews.com/319-chrome-extensions/","reason":"Chrome","category":"News","sources":["CCCS Alerts & Advisories","Cyber Security News","Google Project Zero","Malwarebytes Labs","SecurityWeek"],"coverage":5,"cve_ids":[],"summary":"A network of 319 browser extensions has been linked to search hijacking affecting roughly 13.4 million users over a decade. Marketed as PDF converters, manual finders, safe search tools, and AI search helpers, these\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/319-Chrome-Extensions-Found-Hijacking-Searches-Affecting-13.4-Million-Users.webp","description":"A network of 319 browser extensions has been linked to search hijacking affecting roughly 13.4 million users over a decade. Marketed as PDF converters, manual finders, safe search tools, and AI search helpers, these extensions redirect queries through operator-controlled servers before sending users to Yahoo or Bing. The business model turns ordinary searches into referral income while exposing queries to an intermediary. Similar behavior appeared in an earlier Chrome extension search hijacking investigation involving 23 add-ons, showing how basic browser settings can support large\u2026","related":[{"title":"Google Chrome security advisory (AV26-1095)","link":"https://cyber.gc.ca/en/alerts-advisories/google-chrome-security-advisory-av26-1095","source":"CCCS Alerts & Advisories","date_rel":"22h ago"},{"title":"Chrome and Firefox Updates Patch Over 200 Vulnerabilities","link":"https://www.securityweek.com/chrome-and-firefox-updates-patch-over-200-vulnerabilities/","source":"SecurityWeek","date_rel":"23h ago"},{"title":"Chrome and Firefox updates fix serious security flaws. Install them now","link":"https://www.malwarebytes.com/blog/ai/2026/10/chrome-and-firefox-updates-fix-serious-security-flaws-install-them-now","source":"Malwarebytes Labs","date_rel":"28 Oct"},{"title":"Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines","link":"https://projectzero.google/2026/10/fuzzing-v-AI.html","source":"Google Project Zero","date_rel":"27 Oct"}]},{"title":"Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys","link":"https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html","reason":"Cisco","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the\u2026","source":"The Hacker News","date_rel":"4h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDuVB5nQJHwAnAATDQxAqD8KtWk7IpNvBqXQq6RPkqJ72joLVDp5dUDDdYmRHlrbUhJQpaQQ59p245XjotvW2DNx_fKk7cPp0wJUsK0z5IQY2jXA1oP-YcYKLtSdBXnZJDNECWOzX9tP3-12cKXJm2A1KKoBsu9CEiOYKbgJDVqvQt7YRF8Fzd706YumA/s1600/cisco-sdwan.jpg","description":"Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they","related":[{"title":"Cisco security advisory (AV26-1102)","link":"https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1102","source":"CCCS Alerts & Advisories","date_rel":"43m ago"},{"title":"Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon\u2019s \u2018Silent Train\u2019 Network","link":"https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/","source":"SecurityWeek","date_rel":"2h ago"},{"title":"Cisco open sources tool for detecting AI agents on hacking sprees","link":"https://www.theregister.com/security/2026/10/28/cisco-open-sources-tool-for-detecting-ai-agents-on-hacking-sprees/5305867","source":"The Register Security","date_rel":"28 Oct"}]},{"title":"Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls","link":"https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html","reason":"Android","category":"News","sources":["Cyber Security News","Infosecurity Magazine","The Hacker News","Zero Day Initiative"],"coverage":4,"cve_ids":[],"summary":"A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguzUg6G-A4KdRvBuhj9LZ93cFfXfvMNkg3dJO0H9sfNJ3MTlecsgLEMIk5TnIrdl2N6UGB8D9rlqLduGEZVm7X-XrWZr6Xh5ZrVp38x5uTd1vHyHGcjRR2N3gctNen-CBSz8JihnNL57galBoeOVKwG5w3qsOZnqmGYdkxzjurrI3QWolmS1Qfz_E_Wog/s1600/telegram.jpg","description":"A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. The flaw can be triggered in every version from","related":[{"title":"MR ROBOT Malware-as-a-Service Targets Indian Bank Customers","link":"https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/","source":"Infosecurity Magazine","date_rel":"3h ago"},{"title":"Hackers Infect 17,960 Android Phones With Banking Trojans, Steal 7.6 Million SMS Messages","link":"https://cybersecuritynews.com/hackers-infect-17960-android-phones/","source":"Cyber Security News","date_rel":"4h ago"},{"title":"Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S","link":"https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html","source":"The Hacker News","date_rel":"19h ago"},{"title":"Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits","link":"https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html","source":"The Hacker News","date_rel":"28 Oct"},{"title":"ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-828/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-827/","source":"Zero Day Initiative","date_rel":"28 Oct"}]},{"title":"Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls","link":"https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html","reason":"Asa","category":"News","sources":["Bleeping Computer","Cisco Security Advisories","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the\u2026","source":"The Hacker News","date_rel":"2h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKqTkl_DfXdrvaLinBOu5OU0NISVo_mPJfqRmnHL-m8efFXEijbxOVsFgrSPparCspKfoUtxDtfA7gu8myFTfvWCFJfse3BQakKGOZCA54pWh371KyXdluHyqjckIBFjZ36Ogv1EI42yDCO2dt02noigEyL2RKJ8lEivH3PCWJURryc1JtNO9djpeW88tJ/s1600/cisco-flaws.jpg","description":"Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the","related":[{"title":"New Cisco firewall zero-day exploited to crash SSL VPN devices","link":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/","source":"Bleeping Computer","date_rel":"1h ago"},{"title":"Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August","link":"https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/","source":"SecurityWeek","date_rel":"3h ago"},{"title":"Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20Remote%20Access%20SSL%20VPN%20Tunnel%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco Security Advisories","date_rel":"17h ago"}]},{"title":"PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw","link":"https://thehackernews.com/2026/10/php-issues-second-windows-security.html","reason":"CVE-2026-111497","category":"News","sources":["CCCS Alerts & Advisories","Rapid7 Blog","Sophos Threat Research","Tenable Blog","The Hacker News"],"coverage":5,"cve_ids":["CVE-2026-111497"],"summary":"PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and\u2026","source":"The Hacker News","date_rel":"26 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWGYEqFaRxRywsWzBt-2T2G_Jpdp4zy3iV7qI1alNGRaBf_8TMdzRQQb335GhASkVoXD3q9mGkiLjAog4ez9d7DHhl88lkNVvuhI74KiKZP0zZpb2O8yyqyDw12WoYTiGaq1AVfG9TfGcdNhP-DmRwuKJ4Pj4mr9rEo-TVLYxYSpmUogJUSFZFL_VaduQ/s1600/php-windows.jpg","description":"PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but","related":[{"title":"AL26-027 - Critical vulnerability impacting Google Brotli \u2013 CVE-2026-111497","link":"https://cyber.gc.ca/en/alerts-advisories/al26-027-critical-vulnerability-impacting-google-brotli-cve-2026-111497","source":"CCCS Alerts & Advisories","date_rel":"28 Oct"},{"title":"Node2Shell (CVE-2026-111497) in active exploitation","link":"https://www.sophos.com/en-us/blog/node2shell-cve-2026-111497-in-active-exploitation","source":"Sophos Threat Research","date_rel":"28 Oct"},{"title":"Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)","link":"https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497","source":"Tenable Blog","date_rel":"27 Oct"},{"title":"CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder","link":"https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder","source":"Rapid7 Blog","date_rel":"26 Oct"}]},{"title":"NIK C2: The new AI-enabled command-and-control framework","link":"https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/","reason":"Windows","category":"Threat Intel","sources":["Cisco Talos","Cyber Security News","Microsoft Security"],"coverage":3,"cve_ids":["CVE-2026-62740","CVE-2026-62877"],"summary":"Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called \u201cNIK C2.\u201d NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to\u2026","source":"Cisco Talos","date_rel":"2h ago","thumbnail":"https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/10/NIKC2-Header.jpg","description":"Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called \u201cNIK C2.\u201d NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim\u2019s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session. In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is a HTTP endpoint that enables ChatGPT-style conversations programmatically. In addition to the features that enable\u2026","related":[{"title":"Hackers Use Fake Cloudflare Verification Pages to Target Windows and Mac Users","link":"https://cybersecuritynews.com/fake-cloudflare-verification/","source":"Cyber Security News","date_rel":"4h ago"},{"title":"CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62740","source":"Microsoft Security","date_rel":"22h ago"},{"title":"CVE-2026-62877 Windows Win32k Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62877","source":"Microsoft Security","date_rel":"22h ago"}]},{"title":"Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble","link":"https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121","reason":"Oracle","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News","The Register Security"],"coverage":4,"cve_ids":["CVE-2026-101767"],"summary":"Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle\u2026","source":"The Register Security","date_rel":"17h ago","thumbnail":"https://image.theregister.com/?imageId=5306136&width=800","description":"Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells. First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. \u201cOur Oracle\u2026","related":[{"title":"Oracle Corporation security advisory (AV26-1071) \u2013 Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/oracle-corporation-security-advisory-av26-1071","source":"CCCS Alerts & Advisories","date_rel":"19h ago"},{"title":"Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch","link":"https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html","source":"The Hacker News","date_rel":"28 Oct"},{"title":"Hackers now scanning systems for recently-patched Oracle flaw","link":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","source":"Bleeping Computer","date_rel":"28 Oct"},{"title":"ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws","link":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html","source":"The Hacker News","date_rel":"28 Oct"}]}],"worth_reading":[{"title":"Discover and remediate PHP2Shell exposure with Tenable","link":"https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable","reason":"CVE-2026-109618","category":"Research","sources":["CCCS Alerts & Advisories","Cisco Security Advisories","ESET WeLiveSecurity","Tenable Blog"],"coverage":4,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell\u2026","source":"Tenable Blog","date_rel":"26 Oct","thumbnail":"","description":"Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they\u2019re affected and update PHP to fixed versions. Tenable helps you find PHP2Shell across your attack surface. Tenable One Attack Surface Management discovers externally facing PHP assets. Tenable\u2026","related":[{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"20h ago"},{"title":"AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2","link":"https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619","source":"CCCS Alerts & Advisories","date_rel":"27 Oct"},{"title":"PHP2Shell: What to know about two critical PHP flaws","link":"https://www.welivesecurity.com/en/videos/php2shell-what-know-two-critical-php-flaws/","source":"ESET WeLiveSecurity","date_rel":"26 Oct"}]}],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-61564","vendor":"WWBN","product":"AVideo-Encoder","severity":"CRITICAL","score":10.0,"description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-qu\u2026","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411","https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61564"},{"id":"CVE-2026-61567","vendor":"WWBN","product":"AVideo-Encoder","severity":"CRITICAL","score":10.0,"description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as s\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/WWBN/AVideo-Encoder/commit/99b8ad9b66fe5726cababbe29dce9d9695131caa","https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-rf63-6vwm-wv8p"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61567"},{"id":"CVE-2026-44179","vendor":"xwikisas","product":"xwiki-pro-macros","severity":"CRITICAL","score":9.9,"description":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` conten\u2026","cwe":"CWE-95","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca","https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5","https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-44179"},{"id":"CVE-2026-86397","vendor":"Dell","product":"PowerProtect Data Domain","severity":"CRITICAL","score":9.8,"description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain \u2026","cwe":"CWE-862","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0034,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-86397"},{"id":"CVE-2026-86400","vendor":"Dell","product":"PowerProtect Data Domain","severity":"CRITICAL","score":9.8,"description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain \u2026","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.009,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-86400"},{"id":"CVE-2026-86384","vendor":"Dell","product":"PowerProtect Data Domain","severity":"CRITICAL","score":9.8,"description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain \u2026","cwe":"CWE-321","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.005,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-86384"},{"id":"CVE-2026-103780","vendor":"Dell","product":"PowerProtect Data Domain","severity":"CRITICAL","score":9.8,"description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain \u2026","cwe":"CWE-121","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-103780"},{"id":"CVE-2026-114278","vendor":"Eclipse Foundation","product":"Eclipse Che","severity":"CRITICAL","score":9.8,"description":"The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c \"echo \"...\" > ...\" invocation \u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/476","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-114278"},{"id":"CVE-2026-118477","vendor":"EISGE","product":"Kalifast","severity":"CRITICAL","score":9.8,"description":"The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbi\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://advisories.orangecyberdefense.com/advisories/166"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-118477"},{"id":"CVE-2026-115968","vendor":"Ultimate Member","product":"Ultimate Member","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-13-1-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115968"}],"vendor_spikes":[{"vendor":"Unknown","count":185,"critical_count":0},{"vendor":"Linux","count":106,"critical_count":0},{"vendor":"WordPress","count":46,"critical_count":1},{"vendor":"Dell","count":36,"critical_count":7},{"vendor":"Microsoft","count":34,"critical_count":0},{"vendor":"Juniper","count":18,"critical_count":2},{"vendor":"labstack","count":16,"critical_count":0},{"vendor":"Jenkins","count":15,"critical_count":0},{"vendor":"highcharts","count":15,"critical_count":0},{"vendor":"n8n-io","count":14,"critical_count":0}],"epss_risers":[],"developing_map":{"https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html":4},"trending_count":20,"new_cve_count":723,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-86950":{"anchor":"#dev-2","rank":2,"coverage":6},"CVE-2026-111497":{"anchor":"#dev-8","rank":8,"coverage":5},"CVE-2026-62740":{"anchor":"#dev-9","rank":9,"coverage":3},"CVE-2026-62877":{"anchor":"#dev-9","rank":9,"coverage":3},"CVE-2026-101767":{"anchor":"#dev-10","rank":10,"coverage":4}}}