Saturday, October 31, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 3 critical 77
- Unknown 35
- Microsoft 2 critical 23
- Dell 17
- HashiCorp 16
- Red Hat 12
- pgadmin.org 1 critical 12
- SQLite 11
- Liquid Web / StellarWP 7
- Scribus 7
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks
Apple has issued a fresh round of threat notifications to selected iPhone users in 99 countries, warning that they have been targeted by sophisticated mercenary spyware attacks. Security researcher Costin Raiu reported the new wave on October 30, 2026, saying it was separate from August’s alerts and linked to new attacks. “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” Apple said in the notice shared by Raiu. The company did not name the attackers or connect the warnings to any specific region…
Also in CyberScoop 404 Media Bleeping Computer +2
-
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers. The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea. The attackers also honed in on US government-affiliated firewalls. “Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell…
Also in CCCS Alerts & Advisories Bleeping Computer The Hacker News +3
-
Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours
Cursor has confirmed that malicious Claude Code extension packages were available through its VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The altered packages targeted Windows and macOS users and attempted to install an SSH backdoor for lasting remote access. According to Cursor’s security notice, the affected versions were Anthropic.claude-code 2.1.312 and 2.1.313. They were available between approximately 2:27 a.m. and 1:35 p.m. Pacific Time, a window of 11 hours and eight minutes. Cursor said Anthropic did not develop these malicious versions. The confirmation…
Also in Cyber Security News Cisco Talos Microsoft Security +1
-
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
-
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart
Also in CCCS Alerts & Advisories SecurityWeek Bleeping Computer
-
Google Launches Gemini 4 Carbon With State-Of-The-Art Cybersecurity Capabilities
Google has announced Gemini 4 Carbon, its latest AI model built to find software flaws , test whether attackers could exploit them, and produce fixes. Unveiled on October 28, 2026, Carbon builds on Gemini 4 Argon and targets complex security and coding work that can take days. Access will begin with selected cyber defenders, not a public launch. According to Google’s announcement , Carbon combines stronger cybersecurity skills with improved handling of long tasks. Google says internal teams have seen it work through dead ends while tracing subtle bugs across large codebases and low-level…
Also in CrowdStrike Blog The Hacker News
-
Hackers steal $6.3 billion from Binance in record crypto heist
Binance has suspended all withdrawals after the world’s largest cryptocurrency exchange fell victim to what appears to be the biggest heist in history. The exchange put the “estimated total impact” of the hack at about $6.3 billion and said around $3 billion of affected assets, mainly stablecoins that act as cash for the crypto market, had been frozen. But analysts at Elliptic said the attacker had changed about $3.3 billion into digital assets that could not be frozen and was working to cash those out as traditional currency. Read full article Comments
Also in Bleeping Computer The Register Security The Hacker News +1
-
Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours
Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours. These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The update closes the code execution weakness alongside stored cross-site scripting, information disclosure, and permission issues. The official…
Also in SecurityWeek The Hacker News SecurityWeek
-
North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages
A North Korea-aligned hacking group has moved beyond fake job interviews and now steals developer credentials to plant malware in trusted software projects. The group, tracked as DeceptiveDevelopment, used the stolen access to change code in public and private repositories between April and September 2026. Every poisoned project then became a new way into the systems of the people who use it. The group has been known for years for tricking developers with fake recruiters and coding tests. In earlier campaigns, it mainly wanted to steal cryptocurrency wallets and browser logins. The new…
-
Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application
Also in Microsoft Security Blog Recorded Future Intelligence
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-61738 | CoPilotsocfortress | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isSOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin a… Attack
Exploitation
|
|||||||||
| CVE-2026-61826 | bazarrmorpheus65535 | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isBazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global aut… Attack
Exploitation
|
|||||||||
| CVE-2026-61728 | CoPilotsocfortress | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isSOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit store… Attack
Exploitation
|
|||||||||
| CVE-2026-116241 | pgAdmin 4pgadmin.org | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it ispgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quo… Attack
Exploitation
|
|||||||||
| CVE-2026-62853 | thinglinksmqttsnet | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated at… Attack
Exploitation
|
|||||||||
| CVE-2025-31704 | Intelligent Connection CenterDahua | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isA vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execut… Attack
Exploitation
|
|||||||||
| CVE-2026-119597 | OpenDeepWikiAIDotNet | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isOpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer t… Attack
Exploitation
|
|||||||||
| CVE-2026-110799 | Vvvebgivanz | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isVvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of t… Attack
Exploitation
|
|||||||||
| CVE-2026-119660 | MuseBotyincongcyincong | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isMuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cook… Attack
Exploitation
|
|||||||||
| CVE-2026-61737 | ng-antd-adminhuajian123 | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can b… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.