📰 BleepingComputer

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]

#CyberNews #Infosec

🔴 CVE Digest — 17 Oct 2026
1 critical vulnerability

🔴 CVE-2026-111911 · CVSS 9.8
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 18 Oct 2026
5 critical vulnerabilities

🔴 CVE-2026-112005 · CVSS 9.2
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write...
🔴 CVE-2026-111998 · CVSS 9.8
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to...
🔴 CVE-2026-110886 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms...
🔴 CVE-2026-110372 · CVSS 9.8
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This...
🔴 CVE-2026-109894 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

#CyberNews #Infosec

🔴 CVE Digest — 19 Oct 2026
3 critical vulnerabilities

🔴 CVE-2026-103091 · CVSS 9.3
Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy...
🔴 CVE-2026-102503 · CVSS 9.3
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress...
🔴 CVE-2026-108983 · CVSS 9.8
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

#CVE #Critical #Vulnerability

📰 BleepingComputer

Microsoft: October Windows Server updates break Exchange sign-in, mail flow

Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. [...]

#CyberNews #Infosec

🔴 CVE Digest — 19 Oct 2026
3 critical vulnerabilities

🔴 CVE-2026-111406 · CVSS 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG...
🔴 CVE-2026-110887 · CVSS 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote...
🔴 CVE-2026-78162 · CVSS 10.0
Deserialization of Untrusted Data vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.0.0 before...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Microsoft fixes classic Outlook bug that hid Copilot buttons

Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. [...]

#CyberNews #Infosec

📰 BleepingComputer

Inside the Underground Market for Know Your Client Services

Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts. [...]

#CyberNews #Infosec

📰 BleepingComputer

F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]

#CyberNews #Infosec

📰 Dark Reading

The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience

An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.

#CyberNews #Infosec

📰 BleepingComputer

Microsoft fixes game, app crashes caused by recent Windows update

Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]

#CyberNews #Infosec

📰 Dark Reading

OnlyFans Copyright Takedowns Expose Compromised Websites

Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think...

#CyberNews #Infosec

🔴 CVE Digest — 19 Oct 2026
2 critical vulnerabilities

🔴 CVE-2026-112296 · CVSS 9.8
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote...
🔴 CVE-2026-112292 · CVSS 9.8
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read,...

#CVE #Critical #Vulnerability

📰 BleepingComputer

OpenCode hack exposes API keys amid AI distillation attacks

The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]

#CyberNews #Infosec

🔴 CVE Digest — 19 Oct 2026
5 critical vulnerabilities

🔴 CVE-2026-107188 · CVSS 9.6
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be...
🔴 CVE-2026-111862 · CVSS 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages...
🔴 CVE-2026-111058 · CVSS 9.8
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default...
🔴 CVE-2026-111057 · CVSS 10.0
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4,...
🔴 CVE-2026-109432 · CVSS 9.8
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Bullhorn takes staffing platform offline to contain cyberattack

Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]

#CyberNews #Infosec

📰 BleepingComputer

Hackers hijack AOMEI update servers to secretly spread malware

Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a [...]

#CyberNews #Infosec

🔴 CVE Digest — 19 Oct 2026
2 critical vulnerabilities

🔴 CVE-2026-109437 · CVSS 9.8
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent...
🔴 CVE-2026-112377 · CVSS 9.1
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS...

#CVE #Critical #Vulnerability

📰 Dark Reading

'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery

Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.

#CyberNews #Infosec