📰 BleepingComputer

Nikkei discloses third data breach in a month, 1.8M records exposed

Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. [...]

#CyberNews #Infosec

📰 BleepingComputer

WordPress SEO plugin Rank Math compromised to backdoor websites

Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]

#CyberNews #Infosec

📰 Dark Reading

Researchers Infiltrate Microsoft Tech Support Scam Operation

A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.

#CyberNews #Infosec

📰 Dark Reading

ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.

#CyberNews #Infosec

🔴 CVE Digest — 19 Oct 2026
3 critical vulnerabilities

🔴 CVE-2026-112780 · CVSS 9.3
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary...
🔴 CVE-2026-112779 · CVSS 9.8
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed...
🔴 CVE-2026-112776 · CVSS 9.8
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 20 Oct 2026
4 critical vulnerabilities

🔴 CVE-2026-112900 · CVSS 9.2
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking...
🔴 CVE-2026-112403 · CVSS 9.2
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a...
🔴 CVE-2026-112398 · CVSS 9.2
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines...
🔴 CVE-2026-112393 · CVSS 9.2
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 20 Oct 2026
8 critical vulnerabilities

🔴 CVE-2026-77936 · CVSS 9.8
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never...
🔴 CVE-2026-77933 · CVSS 9.8
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a...
🔴 CVE-2026-77932 · CVSS 9.8
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the...
🔴 CVE-2026-75128 · CVSS 9.8
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name...
🔴 CVE-2026-109442 · CVSS 9.8
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST...
🔴 CVE-2026-109395 · CVSS 9.1
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based...
🔴 CVE-2026-112371 · CVSS 9.9
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of...
🔴 CVE-2026-112370 · CVSS 9.9
A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 20 Oct 2026
1 critical vulnerability

🔴 CVE-2026-113380 · CVSS 9.3
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Revolut outage disrupts online banking operations worldwide

Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. [...]

#CyberNews #Infosec

🔴 CVE Digest — 20 Oct 2026
4 critical vulnerabilities

🔴 CVE-2026-43845 · CVSS 9.2
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
🔴 CVE-2026-43844 · CVSS 9.3
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
🔴 CVE-2026-43838 · CVSS 9.2
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code...
🔴 CVE-2026-43836 · CVSS 9.3
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.

#CVE #Critical #Vulnerability

📰 BleepingComputer

OVHcloud CLI releases backdoored on GitHub to steal developer secrets

French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]

#CyberNews #Infosec

📰 BleepingComputer

Ahold Delhaize: Cyberattack affects services across US and Europe

Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]

#CyberNews #Infosec

🔴 CVE Digest — 20 Oct 2026
1 critical vulnerability

🔴 CVE-2026-9589 · CVSS 9.3
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Windows Server 2025 gets support for quick machine recovery

Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]

#CyberNews #Infosec

📰 BleepingComputer

CJIS v6.1 Compliance: 5 Practical Priorities for Agencies

CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness. [...]

#CyberNews #Infosec

📰 BleepingComputer

Hacker gets 8 years for stealing $3.3 million from taxpayers

A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]

#CyberNews #Infosec

🔴 CVE Digest — 20 Oct 2026
5 critical vulnerabilities

🔴 CVE-2026-113620 · CVSS 9.8
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not...
🔴 CVE-2026-113391 · CVSS 9.9
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the...
🔴 CVE-2026-113390 · CVSS 9.9
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of...
🔴 CVE-2026-113389 · CVSS 9.9
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function...
🔴 CVE-2026-105312 · CVSS 9.9
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an...

#CVE #Critical #Vulnerability

📰 BleepingComputer

DHS bans DeepSeek products across US federal civilian agencies

The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]

#CyberNews #Infosec

📰 Dark Reading

Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree

A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.

#CyberNews #Infosec

📰 Dark Reading

Close Identity Gaps in Software Development Before Unleashing AI

Artificial Intelligence is complicating security in the software development lifecycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead.

#CyberNews #Infosec