Friday, October 30, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Drupal 104
- WordPress 2 critical 61
- Unknown 3 critical 57
- IBM 6 critical 33
- Microsoft 1 critical 26
- Google 23
- ThemeREX 23 critical 23
- Red Hat 18
- Progress 6 critical 15
- digitalbazaar 15
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: 404 Media Apple Is Entering Its Slop Era
My ears perked up when I heard Apple’s new foldable phones were cracking . I licked my lips when the company announced it’s releasing a touch-screen laptop . This was a company that once charged $19 for a polishing cloth , asked $200 for a VESA mount , and sold $700 wheels for the Mac Pro. Now it’s borrowing tired ideas from its competitors and launching hardware its previous leaders rejected. The once dominant company is struggling to find its feet in an AI-driven post-Tim Cook world. John Ternus is the new CEO — a 25 year veteran of the company with a track record of pushing harebrained…
Also in Bleeping Computer Malwarebytes Labs CCCS Alerts & Advisories +3
-
Researcher Uses Claude AI to Extract Internal Anthropic Binary and Recover Google Cloud Token
A security researcher got Claude AI to hand over an internal Anthropic program and a memory dump that held pieces of a working Google Cloud token. The findings were published on October 29, 2026. They show how a helpful chatbot can expose the systems that run it. The work started with a plain question about the sandbox, the locked-down space where Claude runs code. Claude’s answers led the researcher to a downloaded binary, a memory file, and a rebuilt Google service account ID token that Google accepted as valid. Anthropic later said the sandbox findings did not break its threat model. Chris…
Also in SecurityWeek The Hacker News Zero Day Initiative +1
-
Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers
Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines . The findings published on October 29 show how browser features built into AI assistants can break security boundaries when given extra access to their host apps. The researchers named the attack class EMBRACE, short for an embedded browser trusted like a real one. These are separate flaws sharing one design problem. Features meant to help assistants preview projects, read pages, and track tabs gave…
Also in The Register Security The Hacker News Dark Reading +1
-
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers. The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea. The attackers also honed in on US government-affiliated firewalls. “Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell…
Also in The Hacker News Bleeping Computer Zero Day Initiative +3
-
Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application
Also in Recorded Future Intelligence Dark Reading Cisco Security Advisories
-
Hackers target government Windows systems in Asia with new malware
The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers.
Also in Bleeping Computer Cyber Security News The Register Security +3
-
CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229 . This GitLab vulnerability could allow code execution without logging in. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming evidence of active exploitation and raising the urgency for organizations running affected GitLab servers. The vulnerability affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow or wraparound caused by insufficient checks on regular expressions inside CI/CD configurations. A…
Also in SecurityWeek CISA Alerts & Advisories The Hacker News
-
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise
Also in CCCS Alerts & Advisories SecurityWeek The Hacker News +1
-
In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security
Crypto exchange Binance has paused trading after discovering unknown parties cracked one of its workers’ laptops and used it to make massive trades. Late on Thursday, US time, the company used its social media feeds to report “Our teams are aware of reports of a potential security issue and are actively investigating.” The exchange insisted “User funds are completely safe” and warned its customers “should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” The company soon froze $2.5 billion worth of assets and warned that the figure…
Also in Bleeping Computer The Hacker News The Record +1
-
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. Combined with an
Also in Dark Reading Infosecurity Magazine The Hacker News +3
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-61991 | AjaxLoadMore CacheAjax Load More | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isUnauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-84295 | WS_FTP ServerProgress | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isImproper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials. Attack
Exploitation
|
|||||||||
| CVE-2026-107327 | Langflow OSSIBM | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isIBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. Attack
Exploitation
|
|||||||||
| CVE-2026-107328 | Langflow OSSIBM | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isIBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. Attack
Exploitation
|
|||||||||
| CVE-2026-107329 | Langflow OSSIBM | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isIBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. Attack
Exploitation
|
|||||||||
| CVE-2026-119145 | frappefrappe | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isFrappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to l… Attack
Exploitation
|
|||||||||
| CVE-2026-90868 | WS_FTP ServerProgress | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isAn OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations. Attack
Exploitation
|
|||||||||
| CVE-2026-97854 | NWR100Yamaha Corporation | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isYamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product. Attack
Exploitation
|
|||||||||
| CVE-2026-104339 | Langflow OSSIBM | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isIBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. Attack
Exploitation
|
|||||||||
| CVE-2026-110186 | Langflow OSSIBM | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isIBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Massive leak exposes 41,000 DHS workers and undercover ICE agents
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates. The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border…
Also in Wired Security
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.