🔴 CVE Digest — 24 Oct 2026
1 critical vulnerability

🔴 CVE-2026-115806 · CVSS 9.8
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 24 Oct 2026
4 critical vulnerabilities

🔴 CVE-2026-94075 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object...
🔴 CVE-2026-114196 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue...
🔴 CVE-2026-112866 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product...
🔴 CVE-2026-111402 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 24 Oct 2026
1 critical vulnerability

🔴 CVE-2026-116014 · CVSS 9.2
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 24 Oct 2026
1 critical vulnerability

🔴 CVE-2026-115932 · CVSS 9.6
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it...

#CVE #Critical #Vulnerability

📰 BleepingComputer

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]

#CyberNews #Infosec

🔴 CVE Digest — 24 Oct 2026
3 critical vulnerabilities

🔴 CVE-2026-115933 · CVSS 9.9
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a...
🔴 CVE-2026-115557 · CVSS 9.4
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without...
🔴 CVE-2026-110956 · CVSS 9.8
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 24 Oct 2026
1 critical vulnerability

🔴 CVE-2026-114820 · CVSS 9.1
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 25 Oct 2026
1 critical vulnerability

🔴 CVE-2026-115995 · CVSS 10.0
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 25 Oct 2026
1 critical vulnerability

🔴 CVE-2026-116207 · CVSS 9.1
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability...

#CVE #Critical #Vulnerability

📰 BleepingComputer

AI coding agents hijacked using AGENTS.md file in Downloads folder

Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. [...]

#CyberNews #Infosec

🔴 CVE Digest — 25 Oct 2026
1 critical vulnerability

🔴 CVE-2026-116163 · CVSS 9.1
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the...

#CVE #Critical #Vulnerability

📰 BleepingComputer

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]

#CyberNews #Infosec

📰 BleepingComputer

Kali Linux 2026.3 released with 6 new tools, desktop updates

Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]

#CyberNews #Infosec

🔴 CVE Digest — 26 Oct 2026
5 critical vulnerabilities

🔴 CVE-2026-116235 · CVSS 9.1
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of...
🔴 CVE-2026-116234 · CVSS 9.1
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file...
🔴 CVE-2026-116233 · CVSS 9.1
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the...
🔴 CVE-2026-116232 · CVSS 9.9
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component...
🔴 CVE-2026-116231 · CVSS 9.9
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the...

#CVE #Critical #Vulnerability

📰 BleepingComputer

When an AI Agent Is the Incident, the Identity Record Is the Evidence

A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does. [...]

#CyberNews #Infosec

📰 BleepingComputer

Chinese man extradited for role in $36 million cryptocurrency scam

A Chinese national was arraigned in California after being extradited from the Netherlands for his alleged involvement in a cryptocurrency investment scam that stole nearly $37 million from 174 victims in the United States. [...]

#CyberNews #Infosec

📰 Dark Reading

10 Software Security Practices Built for the Next 250 Years

This Cybersecurity Awareness Month's theme, "Securing the Next 250," asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations.

#CyberNews #Infosec

🔴 CVE Digest — 26 Oct 2026
8 critical vulnerabilities

🔴 CVE-2026-115693 · CVSS 9.1
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to...
🔴 CVE-2026-107656 · CVSS 9.6
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6,...
🔴 CVE-2026-59107 · CVSS 9.8
A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust...
🔴 CVE-2026-59106 · CVSS 9.8
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of...
🔴 CVE-2026-116485 · CVSS 9.8
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify...
🔴 CVE-2026-116214 · CVSS 9.3
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers...
🔴 CVE-2026-115188 · CVSS 9.9
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an...
🔴 CVE-2026-110475 · CVSS 9.3
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Microsoft releases emergency .NET patches for critical Brotli flaw

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]

#CyberNews #Infosec

📰 BleepingComputer

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]

#CyberNews #Infosec