Do Son Attackers are actively exploiting CVE-2026-110447 (CVSS 9.2), a critical Nextcloud Collabora Online RCE flaw in richdocumentscode, to deploy PHP webshells.
Technical details and PoC exploit code for CVE-2026-74580 (Vghost), an 8.8-severity Linux vhost vulnerability allowing root LPE and VM escape, are out.
Patch CVE-2026-110005 (CVSS 9.9), a critical Komodo Periphery vulnerability allowing authenticated users to run arbitrary OS commands as root on the host.
DOJ officials announced an OpenAI recording device arrest after an engineer allegedly hid bugs in executive rooms. Read the case details.
Patch four IBM WebSphere Liberty vulnerabilities, including critical 9.1-rated CVE-2026-93895 and CVE-2026-93909 authentication and access bypass flaws.
The DOJ and FBI raided DPRK IT worker laptop farms in Texas, seizing 187 devices and charging 14 suspects in a $3M fraud scheme hitting 70+ US firms.
PoC and technical details for CVE-2026-103572, an 8.8-severity Visual Studio Copilot RCE and SSMS flaw, are now public. Patch your IDE immediately.
The October 2026 Patch Tuesday fixes 1,414 flaws and three zero-day vulnerabilities, including an exploited Windows Shell bypass. Patch now.
Eight SuiteCRM vulnerabilities, including a CVSS 9.4 remote code execution flaw and SQL injection bugs, are fixed. Upgrade to 8.10.2 or 7.15.2 now.
An unpatched Shopware vulnerability, CVE-2026-104937, lets stored XSS steal admin tokens and lead to RCE in Shopware 6.7. Restrict media uploads now.
The Chrome security update to version 155 fixes 37 flaws, including seven critical bugs and 25 use after free issues. Update Chrome now.
A TanStack Start vulnerability, CVE-2026-102989 (CVSS 9.3), allows unauthenticated reflected XSS via crafted links. Upgrade to the patched packages.
NVIDIA AIStore vulnerabilities, including a CVSS 10.0 flaw enabling remote code execution, lead 18 fixes across NVIDIA AI tools. Upgrade to AIStore 5.0.
Read the latest Docker Hub security advisory regarding CVE-2026-105445. Learn how this critical access token vulnerability impacts supply chain security.
Fifteen Wazuh vulnerabilities, including two CVSS 9.4 flaws that allow remote code execution as root, are fixed in 4.14.8. Upgrade managers and agents now.
Thirteen Fortinet vulnerabilities are now fixed, including a CVSS 9.6 FortiSandbox authentication bypass and a 9.4 FortiSIEM flaw. Patch now.
UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.
Four Zoom Workplace vulnerabilities, including privilege escalation and certificate flaws rated up to CVSS 8.1, are now fixed. Update to 7.2.0 or later.
Two Ivanti critical vulnerabilities rated CVSS 9.9 in Neurons Patch for Intune and Xtraction risk credential theft. Update Xtraction and rotate secrets.
Eight unpatched Siemens S7-1500 vulnerabilities enable cross-site scripting in the PLC web server, rated up to CVSS 9.4. Apply Siemens mitigations now.
Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1.1.2 now.
cybernewswire
Torrance, California, 13th October 2026, CyberNewswire