{"date_iso":"2026-10-30","date_human":"Friday, October 30, 2026","generated_utc":"2026-10-30 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Apple Is Entering Its Slop Era","link":"https://www.404media.co/apple-is-entering-its-slop-era/","reason":"Apple","category":"News","sources":["404 Media","Bleeping Computer","CCCS Alerts & Advisories","Malwarebytes Labs","The Hacker News","Zero Day Initiative"],"coverage":6,"cve_ids":["CVE-2026-86950"],"summary":"My ears perked up when I heard Apple\u2019s new foldable phones were cracking . I licked my lips when the company announced it\u2019s releasing a touch-screen laptop . This was a company that once charged $19 for a polishing\u2026","source":"404 Media","date_rel":"25m ago","thumbnail":"https://images.unsplash.com/photo-1673713234831-bff865b62328?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3wxMTc3M3wwfDF8c2VhcmNofDR8fGlwaG9uZSUyMGNyYWNrfGVufDB8fHx8MTc5MzMwMTg1Nnww&ixlib=rb-4.1.0&q=80&w=2000","description":"My ears perked up when I heard Apple\u2019s new foldable phones were cracking . I licked my lips when the company announced it\u2019s releasing a touch-screen laptop . This was a company that once charged $19 for a polishing cloth , asked $200 for a VESA mount , and sold $700 wheels for the Mac Pro. Now it\u2019s borrowing tired ideas from its competitors and launching hardware its previous leaders rejected. The once dominant company is struggling to find its feet in an AI-driven post-Tim Cook world. John Ternus is the new CEO \u2014 a 25 year veteran of the company with a track record of pushing harebrained\u2026","related":[{"title":"Fake crypto app on Apple App Store linked to $23K wallet theft","link":"https://www.bleepingcomputer.com/news/security/fake-crypto-app-on-apple-app-store-linked-to-23k-wallet-theft/","source":"Bleeping Computer","date_rel":"17h ago"},{"title":"Have an older iPhone or iPad? Apple has a security update for you","link":"https://www.malwarebytes.com/blog/bugs/2026/10/have-an-older-iphone-or-ipad-apple-has-a-security-update-for-you","source":"Malwarebytes Labs","date_rel":"29 Oct"},{"title":"Apple security advisory (AV26-1099)","link":"https://cyber.gc.ca/en/alerts-advisories/apple-security-advisory-av26-1099","source":"CCCS Alerts & Advisories","date_rel":"28 Oct"},{"title":"ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-831/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-830/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads","link":"https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html","source":"The Hacker News","date_rel":"27 Oct"}]},{"title":"Researcher Uses Claude AI to Extract Internal Anthropic Binary and Recover Google Cloud Token","link":"https://cybersecuritynews.com/researcher-uses-claude-ai/","reason":"Google","category":"News","sources":["CCCS Alerts & Advisories","Cyber Security News","SecurityWeek","The Hacker News","Zero Day Initiative"],"coverage":5,"cve_ids":[],"summary":"A security researcher got Claude AI to hand over an internal Anthropic program and a memory dump that held pieces of a working Google Cloud token. The findings were published on October 29, 2026. They show how a helpful\u2026","source":"Cyber Security News","date_rel":"4h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Researcher-Uses-Claude-AI-to-Extract-Internal-Anthropic-Binary-and-Recover-Google-Cloud-Token.webp","description":"A security researcher got Claude AI to hand over an internal Anthropic program and a memory dump that held pieces of a working Google Cloud token. The findings were published on October 29, 2026. They show how a helpful chatbot can expose the systems that run it. The work started with a plain question about the sandbox, the locked-down space where Claude runs code. Claude\u2019s answers led the researcher to a downloaded binary, a memory file, and a rebuilt Google service account ID token that Google accepted as valid. Anthropic later said the sandbox findings did not break its threat model. Chris\u2026","related":[{"title":"Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model","link":"https://www.securityweek.com/google-says-gemini-4-carbon-leads-in-finding-exploiting-and-fixing-vulnerabilities/","source":"SecurityWeek","date_rel":"21h ago"},{"title":"Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities","link":"https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html","source":"The Hacker News","date_rel":"23h ago"},{"title":"ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-818/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"Google security advisory (AV26-1085) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1085","source":"CCCS Alerts & Advisories","date_rel":"27 Oct"}]},{"title":"Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers","link":"https://cybersecuritynews.com/popular-ai-embedded-browsers-hacked/","reason":"Github","category":"News","sources":["Check Point Research","Cyber Security News","Dark Reading","The Hacker News","The Register Security"],"coverage":5,"cve_ids":[],"summary":"Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines . The findings published on\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Researchers-Hacked-Cursor-GitHub-Copilot-Codex-VS-Code-and-Claude-Desktop-Embedded-Browsers-1.webp","description":"Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines . The findings published on October 29 show how browser features built into AI assistants can break security boundaries when given extra access to their host apps. The researchers named the attack class EMBRACE, short for an embedded browser trusted like a real one. These are separate flaws sharing one design problem. Features meant to help assistants preview projects, read pages, and track tabs gave\u2026","related":[{"title":"Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour","link":"https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153","source":"The Register Security","date_rel":"29 Oct"},{"title":"GitHub Launches npm Firewall to Block Malicious Packages Before Installation","link":"https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html","source":"The Hacker News","date_rel":"29 Oct"},{"title":"GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub","link":"https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github","source":"Dark Reading","date_rel":"28 Oct"},{"title":"Tricks from the Past deployed via signed ChatGPT and Claude binaries","link":"https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/","source":"Check Point Research","date_rel":"27 Oct"}]},{"title":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers","link":"https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456","reason":"Linux","category":"News","sources":["Bleeping Computer","ESET WeLiveSecurity","Tenable Security Advisories","The Hacker News","The Register Security","Zero Day Initiative"],"coverage":6,"cve_ids":["CVE-2026-98432"],"summary":"Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to\u2026","source":"The Register Security","date_rel":"17h ago","thumbnail":"https://image.theregister.com/?imageId=5304691&width=800","description":"Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers. The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea. The attackers also honed in on US government-affiliated firewalls. \u201cWithin hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell\u2026","related":[{"title":"Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions","link":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html","source":"The Hacker News","date_rel":"20h ago"},{"title":"CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks","link":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"ZDI-26-837: Linux Kernel XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-837/","source":"Zero Day Initiative","date_rel":"29 Oct"},{"title":"ZDI-26-836: Linux Kernel CIFS File System Use-After-Free Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-836/","source":"Zero Day Initiative","date_rel":"29 Oct"},{"title":"ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-835/","source":"Zero Day Initiative","date_rel":"29 Oct"},{"title":"[R1] Tenable Plugin Feed ID #202610282338 Fixes One Vulnerability","link":"https://www.tenable.com/security/tns-2026-33","source":"Tenable Security Advisories","date_rel":"28 Oct"}]},{"title":"Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving","link":"https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html","reason":"Teams","category":"News","sources":["Cisco Security Advisories","Dark Reading","Recorded Future Intelligence","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won\u2019t break anything. Their\u2026","source":"The Hacker News","date_rel":"57m ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitJWSYL167QzDoyvN2y9DAuXmFFe0en34dEHp-I2sSVLEPIfljdlRfeIthyMQUgSvf9AfwW4p-solbE5zH3cKpfeLKWg-IqPnVdHbKQ99Bw91fDAoqHx3E9mlpNmXYA5i3RnaTYxZYkZcwbeY31O4CljtFQYp2JPLTmJo1BI09Al9Kh-CDtzFubVly7hM/s1600/cp.jpg","description":"The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won\u2019t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application","related":[{"title":"Prediction Markets Emerge as a New Vertical for Traffer Teams","link":"https://www.recordedfuture.com/research/prediction-markets-traffer-teams","source":"Recorded Future Intelligence","date_rel":"29 Oct"},{"title":"External Teams Chats Anchor 15-Minute Malware Delivery","link":"https://www.darkreading.com/cloud-security/email-bombing-external-teams-chats-repeatable-access-path","source":"Dark Reading","date_rel":"27 Oct"},{"title":"Cisco Unified Communications Products Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"27 Oct"}]},{"title":"Hackers target government Windows systems in Asia with new malware","link":"https://therecord.media/hackers-target-government-windows-systems-asia-new-malware","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","The Hacker News","The Record","The Register Security"],"coverage":5,"cve_ids":[],"summary":"The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers.","source":"The Record","date_rel":"20m ago","thumbnail":"http://cms.therecord.media/uploads/japan_asia_ffd5c2ef19.png","description":"","related":[{"title":"Microsoft finally fixes VPN issues caused by September updates","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-finally-fixes-vpn-issues-caused-by-september-updates/","source":"Bleeping Computer","date_rel":"1h ago"},{"title":"Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates","link":"https://cybersecuritynews.com/microsoft-fixes-remote-desktop-connection-failures/","source":"Cyber Security News","date_rel":"4h ago"},{"title":"Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched","link":"https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508","source":"The Register Security","date_rel":"13h ago"},{"title":"Microsoft fixes Remote Desktop failures caused by recent Windows updates","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-remote-desktop-failures-caused-by-recent-windows-updates/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"Windows 11 KB5127936 update released with 41 changes and fixes","link":"https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5127936-update-released-with-41-changes-and-fixes/","source":"Bleeping Computer","date_rel":"29 Oct"},{"title":"Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win","link":"https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html","source":"The Hacker News","date_rel":"28 Oct"}]},{"title":"CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks","link":"https://cybersecuritynews.com/gitlab-integer-overflow-vulnerability-exploited/","reason":"CVE-2026-97229","category":"News","sources":["CISA Alerts & Advisories","Cyber Security News","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":["CVE-2026-97229"],"summary":"The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229 . This GitLab vulnerability could allow code execution without logging in. CISA added the flaw to its Known\u2026","source":"Cyber Security News","date_rel":"4h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/CISA-Warns-of-GitLab-Integer-Overflow-Vulnerability-Exploited-in-Attacks-CVE-2026-97229.webp","description":"The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229 . This GitLab vulnerability could allow code execution without logging in. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming evidence of active exploitation and raising the urgency for organizations running affected GitLab servers. The vulnerability affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow or wraparound caused by insufficient checks on regular expressions inside CI/CD configurations. A\u2026","related":[{"title":"Max-Severity GitLab Vulnerability Exploited Against Alpine Linux","link":"https://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/","source":"SecurityWeek","date_rel":"3h ago"},{"title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA Alerts & Advisories","date_rel":"29 Oct"},{"title":"Attacker Tried to Exploit Alpine Linux\u2019s GitLab via CVSS 10.0 Flaw Its Ruby Left Open","link":"https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html","source":"The Hacker News","date_rel":"29 Oct"}]},{"title":"CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV","link":"https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html","reason":"Cisco","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active\u2026","source":"The Hacker News","date_rel":"5h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiw1Ms9mKdtALczFoDaNy5Bm0HVMfxu0ps0ykDUXuLn3BeOEqUCDnzUiCP2lU_7xbC2kYuIAGCuOiQCGIlkR6wYBfCfb7g0wRESfIFaMtSltOjWphyswldC4LJxFf0RnCB9FzEVc-euJGtGbUvpJr7FOE0QefC3_rn8xLSFTij_yJn1MNP6bJVu8VgrcLaV/s1600/github-cisco.jpg","description":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise","related":[{"title":"Cisco security advisory (AV26-1102) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1102","source":"CCCS Alerts & Advisories","date_rel":"16h ago"},{"title":"Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps","link":"https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/","source":"SecurityWeek","date_rel":"22h ago"},{"title":"Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys","link":"https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html","source":"The Hacker News","date_rel":"29 Oct"},{"title":"Cisco open sources tool for detecting AI agents on hacking sprees","link":"https://www.theregister.com/security/2026/10/28/cisco-open-sources-tool-for-detecting-ai-agents-on-hacking-sprees/5305867","source":"The Register Security","date_rel":"28 Oct"}]},{"title":"In the year AI re-wrote the infosec rulebook, it\u2019s comforting to know crypto exchanges still have bad security","link":"https://www.theregister.com/security/2026/10/30/in-the-year-ai-re-wrote-the-infosec-rulebook-its-comforting-to-know-crypto-exchanges-still-have-bad-security/5306539","reason":"Exchange","category":"News","sources":["Bleeping Computer","The Hacker News","The Record","The Register Security"],"coverage":4,"cve_ids":[],"summary":"Crypto exchange Binance has paused trading after discovering unknown parties cracked one of its workers\u2019 laptops and used it to make massive trades. Late on Thursday, US time, the company used its social media feeds to\u2026","source":"The Register Security","date_rel":"8h ago","thumbnail":"https://image.theregister.com/?imageId=5306544&width=800","description":"Crypto exchange Binance has paused trading after discovering unknown parties cracked one of its workers\u2019 laptops and used it to make massive trades. Late on Thursday, US time, the company used its social media feeds to report \u201cOur teams are aware of reports of a potential security issue and are actively investigating.\u201d The exchange insisted \u201cUser funds are completely safe\u201d and warned its customers \u201cshould remain cautious of scams and should not trust unofficial links, messages, or requests for account information.\u201d The company soon froze $2.5 billion worth of assets and warned that the figure\u2026","related":[{"title":"Binance links $6.3 billion crypto theft to compromised DevOps laptop","link":"https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/","source":"Bleeping Computer","date_rel":"3h ago"},{"title":"Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen","link":"https://thehackernews.com/2026/10/binance-suffers-security-breach.html","source":"The Hacker News","date_rel":"8h ago"},{"title":"Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds","link":"https://therecord.media/binance-hit-by-record-6-billion-crypto-hack","source":"The Record","date_rel":"12h ago"},{"title":"Binance probes potential $5.8 billion crypto-theft hack","link":"https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/","source":"Bleeping Computer","date_rel":"14h ago"}]},{"title":"Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls","link":"https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html","reason":"Android","category":"News","sources":["Dark Reading","Infosecurity Magazine","The Hacker News","Zero Day Initiative"],"coverage":4,"cve_ids":[],"summary":"A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed\u2026","source":"The Hacker News","date_rel":"29 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguzUg6G-A4KdRvBuhj9LZ93cFfXfvMNkg3dJO0H9sfNJ3MTlecsgLEMIk5TnIrdl2N6UGB8D9rlqLduGEZVm7X-XrWZr6Xh5ZrVp38x5uTd1vHyHGcjRR2N3gctNen-CBSz8JihnNL57galBoeOVKwG5w3qsOZnqmGYdkxzjurrI3QWolmS1Qfz_E_Wog/s1600/telegram.jpg","description":"A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. Combined with an","related":[{"title":"Claude Model Builds Exploits Across Major Browsers & OSes","link":"https://www.darkreading.com/application-security/claude-model-exploits-major-browsers-oses","source":"Dark Reading","date_rel":"18h ago"},{"title":"MR ROBOT Malware-as-a-Service Targets Indian Bank Customers","link":"https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/","source":"Infosecurity Magazine","date_rel":"29 Oct"},{"title":"Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S","link":"https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html","source":"The Hacker News","date_rel":"28 Oct"},{"title":"Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits","link":"https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html","source":"The Hacker News","date_rel":"28 Oct"},{"title":"ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-828/","source":"Zero Day Initiative","date_rel":"28 Oct"},{"title":"ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-827/","source":"Zero Day Initiative","date_rel":"28 Oct"}]}],"worth_reading":[{"title":"Massive leak exposes 41,000 DHS workers and undercover ICE agents","link":"https://arstechnica.com/security/2026/10/massive-leak-exposes-41000-dhs-workers-and-undercover-ice-agents/","reason":"Undercover Exposes Massive","category":"Media","sources":["Ars Technica Security","Wired Security"],"coverage":2,"cve_ids":[],"summary":"An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email\u2026","source":"Ars Technica Security","date_rel":"23h ago","thumbnail":"https://cdn.arstechnica.net/wp-content/uploads/2026/10/ice-agent-500x500.jpg","description":"An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive information on undercover and surveillance programs. In all, the leak provides a map of how DHS is organized and how it operates. The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border\u2026","related":[{"title":"Massive Leak Exposes 41,000 Homeland Security Workers\u2014Including Undercover ICE Agents","link":"https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/","source":"Wired Security","date_rel":"28 Oct"}]}],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-61991","vendor":"Ajax Load More","product":"AjaxLoadMore Cache","severity":"CRITICAL","score":10.0,"description":"Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/ajax-load-more-cache/vulnerability/wordpress-ajaxloadmore-cache-plugin-3-1-1-remote-code-execution-rce-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61991"},{"id":"CVE-2026-84295","vendor":"Progress","product":"WS_FTP Server","severity":"CRITICAL","score":10.0,"description":"Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-84295"},{"id":"CVE-2026-107327","vendor":"IBM","product":"Langflow OSS","severity":"CRITICAL","score":9.9,"description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.","cwe":"CWE-862","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7293016"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107327"},{"id":"CVE-2026-107328","vendor":"IBM","product":"Langflow OSS","severity":"CRITICAL","score":9.9,"description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7293016"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107328"},{"id":"CVE-2026-107329","vendor":"IBM","product":"Langflow OSS","severity":"CRITICAL","score":9.9,"description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7293016"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107329"},{"id":"CVE-2026-119145","vendor":"frappe","product":"frappe","severity":"CRITICAL","score":9.9,"description":"Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to l\u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j","https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-119145"},{"id":"CVE-2026-90868","vendor":"Progress","product":"WS_FTP Server","severity":"CRITICAL","score":9.9,"description":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-90868"},{"id":"CVE-2026-97854","vendor":"Yamaha Corporation","product":"NWR100","severity":"CRITICAL","score":9.8,"description":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://jvn.jp/en/vu/JVNVU91027179/","https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-97854"},{"id":"CVE-2026-104339","vendor":"IBM","product":"Langflow OSS","severity":"CRITICAL","score":9.8,"description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7293015"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-104339"},{"id":"CVE-2026-110186","vendor":"IBM","product":"Langflow OSS","severity":"CRITICAL","score":9.8,"description":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7294467"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110186"}],"vendor_spikes":[{"vendor":"Drupal","count":104,"critical_count":0},{"vendor":"WordPress","count":61,"critical_count":2},{"vendor":"Unknown","count":57,"critical_count":3},{"vendor":"IBM","count":33,"critical_count":6},{"vendor":"Microsoft","count":26,"critical_count":1},{"vendor":"Google","count":23,"critical_count":0},{"vendor":"ThemeREX","count":23,"critical_count":23},{"vendor":"Red Hat","count":18,"critical_count":0},{"vendor":"Progress","count":15,"critical_count":6},{"vendor":"digitalbazaar","count":15,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":20,"new_cve_count":650,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-86950":{"anchor":"#dev-1","rank":1,"coverage":6},"CVE-2026-98432":{"anchor":"#dev-4","rank":4,"coverage":6},"CVE-2026-97229":{"anchor":"#dev-7","rank":7,"coverage":4}}}