What Got Pwned today: data breaches, hacks & exploited CVEs
Today's data breaches, ransomware attacks, cyber outages, actively exploited vulnerabilities and critical CVEs with their CVSS scores. Each item is first spotted on X and kept only after we find an official source such as a vendor advisory, NVD, CISA KEV, a company statement or a regulatory filing. Most recently added first.
Mercury is a tool that turns data notebooks into websites. Two flaws let anyone who can reach a Mercury server run commands on it without logging in. Fixes are out, with version 3.2.6 covering both; active exploitation is not confirmed by an official source.
What this means
If you run Mercury, upgrade to 3.2.6 or later, which the NVD record says fixes CVE-2026-111058; CVE-2026-111057 was fixed in 3.2.4.
According to the GitHub advisory, an attacker could read, change or delete any file the Mercury process can reach, including notebooks, uploaded data, environment variables and secrets.
If a vulnerable Mercury server was reachable from the internet, rotate any secrets it held, since patching doesn't undo an existing compromise.
Neither the advisories nor the NVD records say these flaws have been exploited in the wild.
Technical details
Mercury, a Python framework for sharing Jupyter notebooks as web apps and dashboards, has two related flaws. According to GHSA-f8c7-rwf9-fmgm and the NVD record, a missing comma in the endpoint blocklist in versions 3.0.0 to before 3.2.4 lets unauthenticated requests reach Jupyter Server's terminal API at /api/terminals and open an OS shell (CVE-2026-111057). Separately, before 3.2.6 default tokenless deployments let anonymous clients create Jupyter kernels and run arbitrary Python through /api/kernels (CVE-2026-111058).
affected
mljar Mercury 3.0.0 to before 3.2.4 (CVE-2026-111057) and before 3.2.6 (CVE-2026-111058)
A flaw in several Fortinet products, including the FortiOS software that runs FortiGate firewalls, lets someone who already has an administrator login write or delete files on the device. Fortinet and the US cyber agency CISA both say attackers have used it in real attacks. Fixed versions are available for some product lines; older lines must move to a fixed release.
What this means
If you run FortiOS 7.6.0 to 7.6.4 or 7.4.0 to 7.4.9, Fortinet says to upgrade to 7.6.5 or 7.4.10 or above; FortiOS 7.2, 7.0 and 6.4 have no fix and must migrate to a fixed release.
Fortinet's advisory also lists fixes for FortiPAM 1.7.1, FortiProxy 7.6.5 and 7.4.12, and FortiSwitchManager 7.2.8 and 7.0.7.
The flaw needs an authenticated administrator account, so limit who can log in to device management and change admin passwords if they may have been exposed.
Patching doesn't undo an existing compromise; CISA's listing asks organisations to follow its forensic triage guidance as well as patch.
Technical details
CVE-2025-61624 is a path traversal flaw in the command line interpreter of Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager that can let a privileged attacker write or delete arbitrary files through crafted arguments to existing commands. Fortinet's advisory FG-IR-26-122 (first published 2026-04-14) rates it Medium, CVSS 6.0, and marks it as known exploited. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-16 with a federal due date of 2026-10-19.
affected
Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager (multiple versions)
Unitree's Go2 robot dog has a flaw in its voice-chat feature that could let someone over the network run their own commands on the robot. Unitree has confirmed the issue and released version 1.1.11.5 to fix it. There is no report that anyone is exploiting it.
What this means
If you own a Unitree Go2, update its firmware to 1.1.11.5 or later, the version the NVD record says fixes the flaw.
According to the NVD record, versions 1.1.11.0 through 1.1.11.4 are affected.
Active exploitation is not confirmed.
Technical details
Unitree Robotics' Go2 firmware up to 1.1.11.4 has an OS command injection flaw in the set_volume function of gpt_thread.py in the chat_go component, which can be triggered remotely by manipulating the Value argument. The NVD record says upgrading to version 1.1.11.5 fixes it and that the vendor confirmed the report. Active exploitation has not been reported.
affected
Unitree Robotics Unitree Go2 firmware up to 1.1.11.4 (chat_go component); fixed in 1.1.11.5
Newsletters, a WordPress add-on that sites use to send email newsletters, has a flaw that could let an outsider without an account read or tamper with the site's database, including user accounts and private data. A fixed version, 4.18.2, is available. Active exploitation is not confirmed.
What this means
If your WordPress site uses the Newsletters plugin 4.18.1 or older, Patchstack says to update to version 4.18.2 or later.
Patchstack warns that flaws like this are often used in mass attacks against many WordPress sites at once.
Neither Patchstack nor the developer has said the flaw has been exploited.
Technical details
Patchstack, the CVE numbering authority, published CVE-2026-111402 for an SQL injection flaw in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting versions up to and including 4.18.1. Patchstack lists it as exploitable without authentication, scores it CVSS 3.1 9.3, and says version 4.18.2 fixes it. The NVD record was published on 24 October 2026 and NVD has not added its own score.
affected
Tribulant Software Newsletters (newsletters-lite) WordPress plugin versions up to and including 4.18.1 (fixed in 4.18.2)
asVereinbase, a WordPress add-on, has a login flaw that could let an outsider sign in as any user of the site, including the administrator, without knowing the password. A fixed version, 1.1.8, is available. Active exploitation is not confirmed.
What this means
If your WordPress site uses asVereinbase older than 1.1.8, WPScan says to update to 1.1.8.
WPScan plans to publish proof-of-concept details on 22 November 2026, which usually makes attacks easier for anyone still unpatched.
Neither WPScan nor the developer has said the flaw has been exploited.
Technical details
WPScan published CVE-2026-110956 for the asVereinbase WordPress plugin before version 1.1.8: the plugin does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match. An unauthenticated attacker can log in as any user, including an administrator. WPScan scores it CVSS 3.1 9.8 and lists it as fixed in 1.1.8; NVD has not added its own score.
affected
asVereinbase WordPress plugin versions before 1.1.8 (fixed in 1.1.8)
Chari-Loto, a Japanese app for betting on bicycle and motorbike races, says attackers broke into its system on 21 October through a security flaw and took personal details of 373 members, including names, addresses, bank account details and betting history. The company has confirmed the breach and says passwords and full card numbers were not taken.
What this means
Chari-Loto says it is contacting the 373 affected members individually.
The company warns customers to watch for phone calls or emails pretending to be Chari-Loto and says it never asks for passwords, PINs or card details by phone or email.
Chari-Loto says it has fixed the vulnerability and that no misuse of the stolen data has been confirmed so far.
Technical details
Chari-Loto Co., Ltd., which runs the Chari-Loto keirin and auto-race betting service, says a third party exploited a vulnerability to access its system between about 09:30 and 13:00 on 21 October 2026. After finding suspicious logs on 22 October it suspended the app, fixed the vulnerability and resumed service on 23 October, and on 24 October identified that data of 373 Charica members was taken, including names, addresses, contact details, bank account details, partial card details (last four digits and expiry), balances and betting history. The company says login passwords, full card numbers and security codes were not exposed, no secondary misuse has been confirmed, and it has reported the incident to Japan's Personal Information Protection Commission.
Oracle has released a second emergency Java update this week. It removes trust in certificates from eMudhra, a company whose weakly generated security keys were recently distrusted by the major web browsers, so Java apps stop accepting connections vouched for by those certificates. Oracle's alert does not say the flaw is being exploited; active exploitation is not confirmed.
What this means
If you run Oracle Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 or 27.0.1, GraalVM for JDK 17.0.21 or 21.0.13, or GraalVM Enterprise Edition 21.3.20, update to the latest Java version or apply the mitigations Oracle's alert points to.
Oracle says the update removes the impacted eMudhra root CA certificates, so any service your Java apps reach that relies on those certificates will stop being trusted after updating.
Oracle says unsupported older releases are not tested but are likely also affected, and recommends upgrading to supported versions.
Oracle has not said whether the flaw has been exploited, and CISA's assessment on the NVD record lists exploitation as none.
Technical details
Oracle issued Security Alert CVE-2026-114820 on 24 October 2026 for the JSSE (TLS) component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition; the fix is a Java update that removes the set of impacted root CA certificates related to eMudhra. Oracle scores it CVSS 3.1 9.1, remotely exploitable without authentication, with high impact to confidentiality and integrity. Affected supported versions are Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and GraalVM Enterprise Edition 21.3.20.0.2.
affected
Oracle Java SE (8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2), Oracle GraalVM for JDK (17.0.21.0.2, 21.0.13.0.2), GraalVM Enterprise Edition 21.3.20.0.2
Keystone, a company that sells hardware crypto wallets (small devices that store the keys to cryptocurrency), confirmed that someone broke into its online store and took customers' shipping details: names, contact details, home addresses and what they ordered. Keystone says payment details, recovery phrases and private keys were not exposed. It is emailing affected customers.
What this means
Keystone warns that scammers may pose as the company by phone, text, email or mail, offering refunds, replacement devices or order "fixes"; it says none of these come from Keystone.
Keystone says it will never ask for your recovery phrase or private keys, and you should never enter your recovery phrase into a device you didn't order.
Because home addresses and order details leaked, buyers may be targeted as known crypto holders; type keyst.one yourself rather than clicking links in unexpected messages, as Keystone advises.
Keystone hasn't said how many customers are affected or which time period of orders is involved; it says a detailed report is coming.
Technical details
Keystone, a hardware crypto wallet maker, says it detected unauthorized access to its official website on October 20, 2026 and, after verifying API activity with Shopify, confirmed on October 23 that a third party obtained customer shipping information. It says names, contact details, shipping addresses and order details (items and prices) were exposed, but not payment card or bank details, recovery phrases, private keys or wallet passwords. Keystone says it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers, with a detailed report to follow.
affected
Keystone (hardware crypto wallet maker): official website/Shopify store customers' names, contact details, shipping addresses and order details
Participants Database, a WordPress add-on that sites use for sign-up forms and member lists, has a flaw that could let an outsider without an account make the site run harmful actions on its server. There is no fix from the developer yet. Active exploitation is not confirmed.
What this means
If your WordPress site uses Participants Database 2.7.8.5 or older, Patchstack says no official patch is available yet, so consider disabling the plugin or using a firewall rule that blocks the attack until a fix ships.
Patchstack warns that flaws like this are often used in mass attacks against many WordPress sites at once.
Neither Patchstack nor the developer has said the flaw has been exploited.
Technical details
Patchstack, the CVE numbering authority, published CVE-2026-112862 for a deserialization of untrusted data (PHP object injection) flaw in the xnau webdesign Participants Database WordPress plugin, affecting versions up to and including 2.7.8.5. Patchstack lists it as exploitable without authentication, scores it CVSS 3.1 9.8, and says no official patch is available. The NVD record was published on 23 October 2026 and NVD has not added its own score.
affected
xnau webdesign Participants Database (participants-database) WordPress plugin versions up to and including 2.7.8.5 (no official patch)
SuggestArr, a self-hosted tool that suggests movies and shows for home media servers, has a flaw that lets anyone who can reach it pretend to be a trusted local computer and get full admin access, without a password. It only affects setups using its 'local bypass' login mode. A fixed version is out; active exploitation is not confirmed.
What this means
If you run SuggestArr 2.16.1 or older with AUTH_MODE=local_bypass, update to 3.0.0, the patched version listed in the GitHub advisory.
Until you update, don't rely on local_bypass mode on an instance reachable from untrusted networks; the advisory says the default trusted ranges include all common private network addresses.
Neither the maintainer nor the NVD record says the flaw has been exploited.
Technical details
SuggestArr's GitHub advisory GHSA-fcjm-xhw8-pmh5 describes an authentication bypass in its local_bypass mode: the app trusts request.remote_addr, which its ProxyFix configuration fills from the client-controlled X-Forwarded-For header. A remote, unauthenticated attacker who sets that header to an address in the trusted ranges gets an admin session and can read data such as the user list and job configurations. Versions up to 2.16.1 are affected and 3.0.0 fixes it.
affected
SuggestArr (giuseppe99barchetta/SuggestArr) 2.16.1 and earlier with local_bypass authentication mode (fixed in 3.0.0)
Frontline Education, a company whose software many US school districts use for staff records and school health records, confirmed that outsiders got into part of its systems through a flaw in another company's software. Staff and students at districts that use Frontline Central or School Health Management may be affected. Frontline says it has fixed the flaw and is sending notices to the people whose details were involved.
What this means
Frontline says notices come from frontline@notifications.cyberscout.com or no-reply@support.frontlineed.com, and some districts found them in spam folders, so check there if your district uses Frontline Central or School Health Management.
Frontline says districts that don't and never did use Frontline Central or School Health Management were not affected.
Frontline hasn't said publicly how many people are affected or exactly which details were taken; it says this varies by district and individual.
Leaked personal details are often used in scam emails, texts and calls, so be wary of unexpected requests for personal information or passwords.
Technical details
Frontline Education, a US school software provider, says that in August 2026 it identified a vulnerability in a third-party software product that allowed unauthorized access to part of its environment holding data related to its Frontline Central and School Health Management products. It says it remediated the vulnerability with an independent cybersecurity firm, engaged law enforcement, has notified all affected school districts, and is notifying affected individuals in cooperation with those districts. Frontline says the information involved varies by district and individual.
affected
Frontline Education (US school software provider): Frontline Central and School Health Management data for affected school districts' staff and students
Save Life, a paid WordPress design theme for charity and donation websites, has a flaw that could let an outsider without an account make the site run harmful actions on its server. There is no fix from the developer yet. Active exploitation is not confirmed.
What this means
If your WordPress site uses the Save Life theme 1.2.14 or older, Patchstack says no official patch is available yet, so consider switching themes or using a firewall rule that blocks the attack until a fix ships.
Patchstack warns that flaws like this are often used in mass attacks against many WordPress sites at once.
Neither Patchstack nor the developer has said the flaw has been exploited.
Technical details
Patchstack, the CVE numbering authority, published CVE-2026-112846 for a deserialization of untrusted data (PHP object injection) flaw in the ThemeREX Group Save Life WordPress theme, affecting versions up to and including 1.2.14. Patchstack lists it as exploitable without authentication, scores it CVSS 3.1 9.8, and says no official patch is available. The NVD record was published on 23 October 2026 and NVD has not added its own score.
affected
ThemeREX Group Save Life (save-life) WordPress theme versions up to and including 1.2.14 (no official patch)
conda is a widely used tool for installing Python and data-science software. Its project's automated build scripts on GitHub had a flaw that could let an outsider's proposed code change run with a privileged project access key. The conda team has fixed it; there is no official word that anyone abused it.
What this means
The advisory says the problem is fixed by commit 9c0f238 in the conda/infrastructure repository; projects that copied the same update workflow should check it for the same pattern.
Ordinary conda users don't need to update anything for this specific issue, because the flaw is in the project's GitHub automation rather than the conda program itself.
Neither GitHub's advisory nor the NVD record says the flaw was exploited.
Technical details
GitHub's advisory GHSA-pf87-fcg3-wjfh for the conda organization's infrastructure repository describes a "Pwn Request" weakness in the .github/workflows/update.yml workflow used in conda/conda: comments of "@conda-bot render" or "@conda-bot recreate" on a pull request made the workflow check out the pull request's own code with the SYNC_TOKEN secret and render its templates through an unsandboxed Jinja2 environment. The advisory says this let untrusted pull request content reach template rendering in a privileged token context, and that commit 9c0f238 fixes it. GitHub, as the CVE numbering authority, scores it CVSS 3.1 9.9; the NVD record was published on 23 October 2026 and NVD has not added its own score.
affected
conda/conda GitHub Actions workflow .github/workflows/update.yml from the conda/infrastructure templates, before commit 9c0f238
Wasmtime is a widely used engine that runs WebAssembly, small programs that are meant to stay locked inside a safe sandbox. On Arm-based 64-bit machines, a specially built program can make it jump to the wrong code and break out of that sandbox. Fixed versions are out; active exploitation is not confirmed.
What this means
If you run the wasmtime Rust crate on aarch64, upgrade to 36.0.19, 48.0.7 or 49.0.4, which the GitHub advisory lists as patched versions.
The advisory says any Wasmtime engine on aarch64 with default settings is affected, so services that run untrusted Wasm modules on Arm servers are the most exposed.
Wasmtime is often embedded inside other software, so check your dependencies and vendors for bundled copies.
The GitHub advisory and NVD record do not say the flaw has been exploited in the wild.
Technical details
CVE-2026-115893 affects Wasmtime, the Bytecode Alliance's WebAssembly runtime, when it uses the default Cranelift compiler backend on aarch64 (64-bit Arm). According to the maintainers' GitHub advisory, a Wasm br_table instruction with more than about 256,000 targets can be compiled with an incorrect conditional branch target, letting a user-controlled Wasm module jump to arbitrary code and escape the sandbox; every aarch64-capable version since 2020 is affected. The issue is fixed in Wasmtime 36.0.19, 48.0.7 and 49.0.4.
affected
Wasmtime (Rust crate wasmtime) on aarch64 with the default Cranelift backend, before 36.0.19, 37.0.0 to before 48.0.7, and 49.0.0 to before 49.0.4
Froxlor is free software that web hosts use to manage customer websites on their servers. A hosting customer with a normal account could abuse a scheduled background task to take full control of the whole server. A fix is out in version 2.3.15; active exploitation is not confirmed.
What this means
If you run Froxlor 2.0.0 through 2.3.14, upgrade to 2.3.15, which the maintainers' advisory lists as the patched version.
The advisory says the traffic statistics task is switched on by default, so shared hosting servers with untrusted customer accounts are the most exposed.
Updating doesn't undo a takeover that already happened; check for unexpected symlinks in customer document roots and unexpected ownership changes on system directories.
The GitHub advisory and NVD record do not say the flaw has been exploited in the wild.
Technical details
CVE-2026-113678 affects Froxlor, an open-source server management panel for web hosting, in versions 2.0.0 through 2.3.14. According to the maintainers' GitHub advisory, the root-run traffic statistics cron runs chown -R on a directory inside the customer's document root without checking for symlinks, so an authenticated hosting customer can replace that directory with a symlink, take ownership of any host directory and escalate to root. The issue is fixed in Froxlor 2.3.15.
affected
Froxlor server management panel (froxlor/froxlor) 2.0.0 through 2.3.14
Okinawa Tourist, a Japanese travel company known for OTS Rent-a-Car, confirmed that personal details of up to about 730,000 customers leaked. The data includes names, addresses, phone numbers, emails, birth dates and driver's license numbers. The company says no credit card data was in the affected system and it has reported the leak to police and Japan's privacy regulator.
What this means
OTS warns that the leaked details may be used in fake emails, texts or calls pretending to be OTS; don't open unexpected links or give passwords, codes or card numbers.
New bookings for OTS Rent-a-Car, OTS HOTEL, OTS ACTIVITIES and OTS Club are paused; OTS says bookings completed before 20 October 16:30 can still be used.
OTS is still checking whether up to 6,000 driver's license images in a separate database leaked.
OTS hasn't said how the data was taken.
Technical details
Okinawa Tourist Service Inc. (沖縄ツーリスト株式会社, OTS) said in its second report on 23 October 2026 that customers' personal information was leaked, after it matched information said to have been leaked externally against its own records. It blocked outside access to the affected site from 18 October and suspended new bookings for OTS Rent-a-Car, OTS HOTEL, OTS ACTIVITIES, its Digital DMO Platform and OTS Club from 20 October 16:30. Up to about 730,000 customers are affected; the exposed system held names, birth dates, gender, addresses, phone numbers, email addresses, Facebook IDs and Japanese driver's license numbers and dates, while up to 6,000 license images in a separate database are still under investigation and no card data was held.
affected
Okinawa Tourist Service Inc. (沖縄ツーリスト株式会社, OTS, Japan): OTS Rent-a-Car, OTS HOTEL, OTS ACTIVITIES, Digital DMO Platform and OTS Club customers, up to about 730,000 people
JETS, the company that runs Jamaica's main debit card network and its bank-to-bank transfer system, was hacked in part of its office computer systems. Some old debit card numbers and the names of some people who received transfers may have been exposed, but PINs and security codes were not. Jamaica's central bank says the payment networks still work normally.
What this means
The Bank of Jamaica advises checking account and card transactions regularly and reporting anything unfamiliar to your bank promptly.
Expect scam calls, texts or emails that claim to come from your bank, JETS or the Bank of Jamaica; the central bank says never share a PIN, CVV, one-time password or online banking login.
JETS hasn't said how many customers are affected or how the attackers got in.
Technical details
The Bank of Jamaica says JETS Limited, which operates the MultiLink debit card and Automated Clearing House (ACH) networks, issued a statement on 22 October 2026 about a cyber incident involving a limited part of its internal administrative systems. According to the central bank, JETS says files accessed may have exposed some card numbers in historical administrative data and the names of some customers who received ACH transfers, while PINs, CVVs and card expiry dates are not stored there and were not affected. JETS has confirmed the MultiLink and ACH networks were not affected and remain fully operational.
affected
JETS Limited (Jamaica Electronic Transfer Services), operator of the MultiLink debit card and ACH networks: internal administrative systems
A Japanese stock-prediction website called AI Lab 225 was hacked, and attackers had access to its server since mid-September 2026. Members' names, emails, birth dates and passwords may have leaked, and the company admits the passwords were stored without any protection. The company confirmed the breach and has reported it to Japan's privacy regulator.
What this means
Nihon Seirei says anyone who used their AI Lab 225 password on other services should change it there, because the passwords were stored unencrypted.
The company says it has reset all member passwords and stopped Facebook login; members need to set a new password through the site's forgotten-password page.
Watch for suspicious emails or calls claiming to be from the company; it says it will never ask for passwords or card details.
The company says it held no credit card information.
Technical details
Nihon Seirei Co., Ltd. (日本成令株式会社) said on 23 October 2026 that the server of its AI Lab 225 Nikkei-225 prediction site was accessed without authorization; it confirmed the intrusion on 22 October and cut off the access route that day. The company says an intruder had been on the server since around 13 September 2026 and a malicious program had also been planted around January 2022. Information that may have leaked includes names, email addresses, birth dates and login passwords of about 380 members (including former members), email addresses and passwords from about 19,250 incomplete sign-ups, and inquiry details; the company says passwords were stored unencrypted.
affected
Nihon Seirei Co., Ltd. (日本成令株式会社), AI Lab 225 (Japan): about 380 members and former members, about 19,250 incomplete registrations, and inquiry senders
The TOTOLINK EX200, a home Wi-Fi range extender, has a flaw that could let an attacker on the network take over the device by sending it a specially crafted request. Instructions for attacking it have been published. No fix is listed, and attacks in the wild are not confirmed.
What this means
According to the NVD record, TOTOLINK EX200 firmware 5.2.3c.7200 is affected and attack code is public.
The NVD record lists no patched firmware; check TOTOLINK's site for updates, and consider replacing the device or keeping its management page off untrusted networks until one exists.
Active exploitation is not confirmed by an official source.
Technical details
The NVD record for CVE-2026-114382 describes a stack-based buffer overflow in the setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi (component lan.so) in TOTOLINK EX200 firmware 5.2.3c.7200, triggered through the Comment argument and reachable remotely. VulDB, the CVE numbering authority, scores it CVSS 3.1 10.0 (CVSS 4.0 9.3) and says the exploit has been released publicly. The record lists no vendor fix.
affected
TOTOLINK EX200 Wi-Fi range extender firmware 5.2.3c.7200
BlueSpice, a company wiki system built on the software behind Wikipedia, shipped a ready-made server package with a setting left too open. That could let someone without an account give themselves full administrator control of the wiki. Updated packages fix it; active exploitation is not confirmed.
What this means
If you run the bluespice/wiki container from BlueSpice 5.2.3 to 5.2.6, or a 5.2.7 image published before 2026-10-19 15:37 UTC, update to the re-published 5.2.7 image as BSSA-2026-07 says.
The same advisory also covers CVE-2026-25716, a missing permission check in the BlueSpiceUserManager extension, fixed in BlueSpice 5.1.11 and 5.2.7.
BlueSpice's advisory includes a section on checking for misuse; an update does not undo admin access an attacker may already have gained.
Neither BlueSpice nor NVD has said the flaw has been exploited.
Technical details
Hallo Welt! GmbH published BlueSpice advisory BSSA-2026-07 for CVE-2026-25784, an insecure default in the bluespice/wiki container image where the setting meant to limit internal service token authentication to the container network evaluated to an empty string when WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set, removing the IP restriction. The NVD record says this allows privilege escalation; BlueSpice scores it CVSS 3.1 9.8 and CVSS 4.0 9.3. Affected are bluespice/wiki images in BlueSpice 5.2.3 to 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC, fixed by the re-published 5.2.7 images.
affected
BlueSpice bluespice/wiki container in BlueSpice 5.2.3 to 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC (fixed in re-published 5.2.7 images)
Electrum, a popular Bitcoin wallet app, had a weakness that lets a dishonest server it connects to show a fake pending payment to an address that looks like the real one. If the user then pays a higher fee to speed up that fake payment, the money goes to the attacker. Electrum's developers confirm this is happening in the wild and that at least one user lost funds; version 4.8.3 fixes it.
What this means
Electrum's maintainers say users should upgrade to version 4.8.3.
Until upgraded, the advisory says to check the destination addresses and amounts every time you sign a transaction, including fee bumps; the attackers' addresses matched the last four characters of the real ones.
The advisory says people who connect only to Electrum servers they trust, such as their own, are not affected.
Technical details
Electrum's maintainers published advisory GHSA-6jp4-8v48-cc5v (rated high) describing how a malicious Electrum server can withhold a transaction the wallet just broadcast and show a conflicting, invalidly signed transaction that pays an attacker's lookalike address instead. If the user then fee-bumps (RBF) that fake transaction, the wallet signs a real payment to the attacker. The maintainers say some servers are performing this attack in the wild, that one reporting user lost money, and that version 4.8.3 fixes it by verifying signatures on the wallet's own inputs in unconfirmed transactions.
affected
Electrum Bitcoin wallet before 4.8.3 when connected to an untrusted Electrum server (fixed in 4.8.3)
Product Filter by WBW, a WordPress add-on that lets online shops built on WooCommerce filter their product lists, has a flaw that lets an outsider without an account sneak commands into the site's database. That could expose or alter stored data. Version 3.4.7 fixes it; active exploitation is not confirmed.
What this means
If your WooCommerce store uses Product Filter by WBW 3.4.6 or older, update to 3.4.7 or later, as Patchstack advises.
Patchstack says SQL injection like this can let attackers read, modify or delete the site's database, including user accounts.
Neither Patchstack nor the developer has said the flaw has been exploited.
Technical details
Patchstack, the CVE numbering authority, published CVE-2026-112866 for a blind SQL injection flaw in the WPFactory Product Filter by WBW WordPress plugin (woo-product-filter), affecting versions up to and including 3.4.6. Patchstack lists it as exploitable without authentication, scores it CVSS 3.1 9.3, and says version 3.4.7 fixes it. The NVD record was published on 24 October 2026 and NVD has not added its own score.
affected
Product Filter by WBW (woo-product-filter) WordPress/WooCommerce plugin versions up to and including 3.4.6 (fixed in 3.4.7)
Treasure Factory, a Japanese secondhand-goods chain, says an intruder broke into the system it uses to manage home pickup and moving requests and took about 746,000 customer email addresses, a handful with names and addresses. Card details were not included. The company confirmed the theft and has reported it to Japan's privacy regulator and the police.
What this means
Treasure Factory warns that the stolen email addresses may be used for phishing, so customers should not click links or open attachments in unexpected messages.
The company says store and app customer data is kept in separate systems and was not part of this incident.
Treasure Factory says it will contact affected customers individually; its pickup and moving request forms are expected to reopen around October 28.
Technical details
Japanese reuse retailer Treasure Factory (TSE Prime 3093) disclosed on October 23, 2026 that a third party exploited a database-access vulnerability in the case management system for its home pickup (出張買取) and Torefac moving services early on October 20 and obtained data. It confirmed 746,277 customer records (email addresses, 11 of them also with name and address), plus 750 partner and employee names and emails and 1,000 device records. The company says no payment card data was involved, the incident is unrelated to the recent PHP vulnerabilities, and it plans to reopen the system around October 28.
affected
Treasure Factory Co., Ltd. (株式会社トレジャー・ファクトリー, Japan): home pickup and Torefac moving case management system; 746,277 customer records, 750 partner/employee records
SpeeCAN RAIDEN, a service many Japanese towns use to email residents about disasters and emergencies, was hacked. The attackers used it to send about 1.4 million fake emails designed to steal information, and subscribers' email addresses and other contact details may have leaked. The operator, Arcadia, confirmed the break-in and is still investigating how much data was taken.
What this means
People subscribed to a town's disaster-alert emails should be wary of messages that ask them to click links or enter details; Arcadia says the fake emails imitated real companies.
Arcadia asks all customers to change their login password and set up two-step verification on the admin screen.
Arcadia says the number of emails sent is not the number of people whose data leaked; the full extent is still under investigation.
Technical details
Arcadia (Minoh, Osaka), which runs the SpeeCAN RAIDEN disaster and safety alert service used by Japanese local governments, says a third party gained unauthorized access to its systems and a malicious program sent 1,423,428 phishing emails between 01:17 and 07:16 on October 13, 2026, at least 869,575 of them to addresses Arcadia does not hold. Its notices say contact names, email addresses (an estimated up to about 3,136,000), phone and fax numbers and message history in SpeeCAN RAIDEN may have leaked, and that NET119 and 119RAIDEN were also accessed. Arcadia has reported to Japan's Personal Information Protection Commission and police, suspended external API integrations on October 22 and asked administrators to enable two-step verification.
affected
Arcadia Inc. (株式会社アルカディア, Japan): SpeeCAN RAIDEN disaster-alert email service (up to about 3.136 million email addresses), Raiden School, NET119 and 119RAIDEN
Prime Mover, a WordPress add-on used on more than 10,000 sites to back up and move websites, has a flaw that lets an outsider hide malicious data in an ordinary comment. If the site's admin later runs a backup or restore, that data can change the site's settings and lead to a takeover. Version 2.2.2 fixes it; active exploitation is not confirmed.
What this means
If your WordPress site uses Prime Mover 2.2.1 or older, update to 2.2.2 or later, whose changelog lists the object-injection fix.
Until you update, avoid running Prime Mover exports or restores, since the NVD record says that is the step that triggers the flaw.
Neither Wordfence nor the developer has said whether the flaw has been exploited.
Technical details
Wordfence, the CVE numbering authority, published CVE-2026-115806 on 24 October 2026: a PHP object injection flaw in the Prime Mover – Backup and Migration WordPress plugin, affecting all versions up to and including 2.2.1. An unauthenticated attacker can plant a crafted serialized object in a normal blog comment; when an administrator later runs a Prime Mover export or restore, the plugin unserializes it, and a gadget chain in the plugin's own bundled Freemius library lets it write arbitrary WordPress options. Wordfence scores it CVSS 3.1 9.8; the plugin's 2.2.2 changelog says it hardened unserialize handling to prevent object injection.
affected
Prime Mover – Backup and Migration WordPress plugin versions up to and including 2.2.1 (fixed in 2.2.2)
SYSTEM5, a Japanese computer shop, confirmed hackers got into systems connected to its online store and took customer details. Names, email addresses, reward-point and review information for up to about 15,000 customers may be affected. The company says credit card numbers and passwords were not stored, so they were not leaked.
What this means
SYSTEM5 says it will contact affected customers individually once it identifies them.
SYSTEM5 warns the stolen details may be used in scam emails; it says it will never ask for your password or card details by email or phone.
Points, product reviews and online invoices are still suspended, and the company hasn't given a date for restoring them.
Technical details
Japanese PC retailer SYSTEM5 (System Five Co.) said on October 24, 2026 that its investigation into unauthorized access to systems linked to its online shop, first announced October 22, found that some customers' personal information was obtained by a third party. Names, email addresses, point information and product-review data of up to about 15,000 registered customers may have been taken; the company says it does not hold card numbers or passwords. It has reported the incident to Japan's Personal Information Protection Commission and police, and reopened the shop with emailed six-digit login codes in place of passwords.
Dora-Tora, a website run by Japanese highway operator NEXCO East that shows traffic conditions, was broken into. Some members' email addresses and passwords, plus gender, prefecture and birth year, may have been seen by the intruder. NEXCO East confirmed the incident and is contacting the people affected by email.
What this means
NEXCO East asks users who reuse the same email and password on other sites to change those passwords, because attackers may try them elsewhere.
NEXCO East warns affected users not to open suspicious emails, links or attachments.
The company hasn't said how many people are affected or how the attackers got in; Dora-Tora and My Route remain suspended.
Technical details
East Nippon Expressway Company (NEXCO East) said on October 23, 2026 that its highway traffic information site Dora-Tora (Drive Traffic) was accessed by a third party and that some registered users' email addresses, passwords, gender, prefecture and birth year may have been viewed. The company had suspended Dora-Tora and its My Route email service for emergency system maintenance on October 21. It says it is emailing affected users individually.
affected
NEXCO East (East Nippon Expressway) Dora-Tora traffic information site
Postiz, a self-hosted app for scheduling social media posts, had a serious flaw. Anyone who can sign up for an account on a Postiz server (sign-up is open by default) could read the server's secret settings and passwords or crash it. A fix is out in version 2.25.2; exploitation is not confirmed.
What this means
If you run Postiz 2.23.0 or later but older than 2.25.2, update to 2.25.2 as the release notes and advisory recommend.
The advisory's workaround is setting DISABLE_REGISTRATION=true, which limits who can exploit it but does not fix it, since any existing user still can.
Because the server's secrets could be read, consider rotating the session-signing secret and connected-service credentials after updating; a patch doesn't undo an earlier leak.
No in-the-wild exploitation has been reported in the official sources.
Technical details
Postiz, an open-source social media scheduling app, disclosed CVE-2026-115931 (PSA-2026-JNXM56): the backend did not restrict which internal provider functions a signed-in user could call on their connected channels. According to the advisory, any registered user can read any file the backend process can read, including its environment with the session-signing secret, database address and connected-service credentials, and can crash the backend with one request. Versions 2.23.0 and later before 2.25.2 are affected; the fix is in v2.25.2, and the CVSS 3.1 score is 9.9.
affected
Postiz (gitroomhq/postiz-app) 2.23.0 to before 2.25.2
A company that sends emails for Nomura Securities' i-Port tool, a portfolio tracker used by banks and other financial firms, was hacked. Email addresses and related details of i-Port subscribers may have been stolen. Nomura confirmed the vendor breach and says portfolio and trading-account data were not part of it.
What this means
Nomura says affected financial-institution customers will be contacted individually.
Watch for scam emails pretending to be Nomura or related parties; Nomura asks people not to open links or attachments in suspicious emails and to use the contacts on its official site.
Nomura hasn't said how many addresses may be affected, and its notice doesn't say whether other Yumirlink clients are affected.
Technical details
Nomura Securities said on October 23, 2026 that Yumirlink, the vendor that sends emails to subscribers of its i-Port portfolio management tool for financial institutions, reported on October 22 that an intrusion into its systems may have leaked stored customer email addresses and related data. According to Nomura, Yumirlink detected unauthorized access to part of its email delivery service on October 16 and confirmed on October 22 that data had been taken from a database. Nomura says i-Port portfolio data and securities account information are not involved and it has found no misuse or access to its own systems.
futureshop, a service many Japanese online shops use to run their websites, was hacked through a software flaw. Member details of one shop's customers, about 3.15 million records with names, addresses, emails and phone numbers, were stolen; card numbers were not. The company has confirmed the leak and says other shops' data shows no sign of the same access.
What this means
futureshop says passwords were stored hashed (scrambled) and card details were never on its servers, but customers of the affected shop should change that password anywhere else they reuse it.
Expect scam emails, calls or texts using the leaked names and addresses; futureshop says it never asks for passwords or login details by email or phone.
futureshop has not publicly named the affected store in its notice; that store's customers are being contacted through the store.
futureshop says it has fixed the exploited vulnerability on all admin servers and will announce further prevention steps after an outside investigation.
Technical details
Future Shop Co., Ltd., which runs the Japanese SaaS e-commerce platform futureshop, said an outside party exploited a vulnerability in software on its servers on October 17, 2026 and took member data of one store on October 18; it detected the access on October 19 and took four servers (c02, c05, c12, g06) offline for maintenance on October 21. Its October 23 notice says 3,147,469 member records of that one store were leaked, including member ID, name, email, address, birth date, phone number, gender and hashed passwords, but no card data. The company reported the case to Japan's Personal Information Protection Commission and says no similar access to other stores' data has been found.
Goobi viewer, a web app libraries and archives use to show digitised books and documents online, had a serious flaw. Anyone on the internet could use one of its connections, without logging in, to make the server fetch internal data, read some of its files, or wipe its search index. A fix is out in version 26.05; exploitation is not confirmed.
What this means
If you run Goobi viewer 24.03 or later but older than 26.05, update to 26.05 as the advisory says.
The advisory gives a workaround if you can't update yet: block /tasks/download/monitor.socket in the Apache httpd vhost or with a Tomcat security constraint.
The advisory says the exposed search index contains metadata for every record without the viewer's access restrictions, so check whether restricted records could have been read.
No in-the-wild exploitation has been reported in the official sources.
Technical details
The Goobi viewer project (intranda) disclosed CVE-2026-46651: the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users in versions 24.03 up to before 26.05. According to GHSA-79jg-3m2m-jgc8, an attacker can read responses from arbitrary HTTP GET requests reachable from the server (including the local Solr instance and cloud metadata endpoints), read some local files, and destroy the Solr index. The GitHub CNA scores it CVSS 3.1 9.8, and it is fixed in v26.05.
affected
Goobi viewer (intranda goobi-viewer-core / io.goobi.viewer:viewer-core) 24.03 to before 26.05
Microsoft disclosed a maximum-severity flaw in Azure Kubernetes Configuration Service, a part of Microsoft's cloud that manages settings for Kubernetes clusters (groups of servers that run apps). A key function had no login check, so an attacker could have gained higher access without permission. Microsoft says it already fixed this on its side, and it lists the flaw as not exploited.
What this means
Microsoft says the flaw is fully mitigated in its service and customers do not need to take any action.
Microsoft's advisory lists the flaw as not publicly disclosed and not exploited at the time it was published.
Microsoft publishes CVEs like this for cloud services for transparency, so there is no patch to install.
Technical details
Microsoft published CVE-2026-83938, a missing authentication for critical function (CWE-306) flaw in Azure Kubernetes Configuration Service that allows an unauthorized attacker to elevate privileges over a network. Microsoft rates it Critical with CVSS 3.1 base score 10.0. The MSRC entry says the issue has already been fully mitigated by Microsoft, customers have no action to take, and it was not publicly disclosed or exploited at release.
affected
Microsoft Azure Kubernetes Configuration Service (cloud service)
blastmail is a Japanese service many companies use to send newsletters. Its operator, a Rakus subsidiary, confirms that hackers got in and copied data on all of its business customers, and for some customers also their mailing lists, meaning the names and emails of people who signed up. Several newspapers and companies have said their subscribers' details leaked. The breach is confirmed.
What this means
If you get newsletters from a Japanese company or newspaper, your name and email may have leaked; Ehime Shimbun and Niigata Nippo warn of scam emails pretending to be them and ask readers not to open unexpected links or attachments.
Rakus says blastmail has been stopped since 21 October 0:30 JST with no restart date, so newsletters sent through it are paused.
Rakus says it will contact affected customers individually and is still investigating how the attackers got in.
Rakus says card numbers were not held by the service; Ehime Shimbun says no passwords, phone numbers or card details were in its leaked data.
Technical details
Rakus Co., Ltd. says an outside party broke into two API servers of its subsidiary Rakus Light Cloud, ran commands and connected to the sales-management system and the blastmail service database, taking data out. Rakus says the contract details of all blastmail customers (company name, contact name, phone number, email address, billing email, contract and payment history) were taken, and for some customers delivery information such as recipient lists also leaked; it does not hold card numbers. The service has been stopped since 21 October 0:30 JST, and customers such as Ehime Shimbun (about 32,000 newsletter recipients) and Niigata Nippo have published their own breach notices.
affected
Rakus Light Cloud (株式会社ラクスライトクラウド), blastmail (ブラストメール) email-delivery service, Japan: all contract customers and some customers' recipient lists (incl. Ehime Shimbun, Niigata Nippo)
GitHub has flagged a group of at least ten packages on npm, the main place JavaScript developers download code from, as malware. They all have names ending in "testmetest", and some versions run hidden code that steals passwords and keys as soon as they are installed. GitHub says any computer that installed them should be treated as fully taken over.
What this means
Check your projects and lockfiles for any npm package whose name ends in "testmetest" and remove it; GitHub lists them as malicious.
GitHub says to rotate every secret and key stored on an affected computer, doing so from a different, clean computer.
GitHub warns that removing the package may not remove everything the malware installed, so rebuilding the machine is the safer option.
GitHub hasn't said how many people downloaded these packages.
Technical details
Between 22 October 06:31 and 20:37 UTC GitHub published critical malware advisories for at least ten npm packages ending in "testmetest", including event-emitter-testmetest, data-pipeline-testmetest, log-sink-testmetest, sdk-utils-testmetest and kvarzo8f3atestmetest. The advisory for event-emitter-testmetest, credited to OpenSSF, says the npm account testnewtestme2 published it on 21 October and that versions 1.0.6, 1.0.7, 4.1.0 and 5.0.0 run an obfuscated loader or a full credential stealer, some of them automatically during npm install.
Next.js, a very popular toolkit for building websites, had two serious flaws that could let an outsider run their own code on a website's server without logging in. One affects sites using a newer caching feature, the other the built-in image resizing on Linux servers. Fixes are out, and active exploitation is not confirmed.
What this means
If you run Next.js 16.x, update to 16.4.1 or later; on 15.x, update to 15.5.28, the fixed versions listed in the GitHub advisories.
Vercel says there is no workaround for the 'use cache' flaw and advises upgrading even if your app has no such function.
For the image flaw, the advisory says making sure the sharp package Next.js uses is 0.35.5 or later also fixes it; redeploy after updating.
The advisories do not say either flaw has been exploited in the wild.
Technical details
Vercel published two critical advisories for the next npm package, both scored CVSS 4.0 9.5, with no CVE ids assigned in the GitHub advisories. GHSA-673q-mjm6-r5xr lets an unauthenticated request reach remote code execution in App Router apps using Cache Components when a 'use cache' function returns multiple typed arrays (next 16.0.0 to 16.4.0, fixed in 16.4.1, no workaround). GHSA-2464-fhr4-w9xw is a memory flaw in an upstream library used by Image Optimization that can lead to remote code execution when SVG files are processed on glibc-based Linux (next 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0, fixed in 15.5.28 and 16.4.1, or with sharp 0.35.5 or later).
affected
npm package next: 16.0.0 to 16.4.0 (both flaws, fixed in 16.4.1) and 10.0.0 to 15.5.27 (Image Optimization SVG flaw, fixed in 15.5.28)
cve
no CVE
cvss
CVSS 4.0 9.5 (Vercel / GitHub advisories (both GHSAs scored 9.5); no CVE or NVD score published)
Hackers broke into the website of Times Car, a big Japanese car-sharing service run by Park24. The company confirms that personal details for about 6.6 million accounts, including names, addresses and driver's license information, were sent out to the attackers, plus about 1.46 million encrypted photos of ID documents such as driver's licenses. Park24 says credit card numbers were not stored and it has seen no sign the data was sold or posted online.
What this means
Park24 warns that affected members may get phishing emails, fake websites, impersonation and scam calls using the leaked details; it says it never asks for passwords or card details by email, SMS or phone.
Park24 says the ID images were encrypted, so being sent out doesn't mean they could be viewed, but it can't rule out future decryption; it plans a 3,000-yen payment to members whose ID images were sent out.
Park24 says it is notifying affected customers individually and will delete all ID-document images it holds by the end of October 2026.
Park24 hasn't disclosed which vulnerability the attackers used.
Technical details
Park24 says it detected abnormal access to the Times Car web system on September 25, 2026, and a completed forensic investigation found attackers exploited a vulnerability in the web system, then reached databases and file storage. Its fifth report on October 23 says names, addresses, dates of birth, phone numbers, email addresses and driver's license details for 6,628,007 accounts show signs of being sent out, along with about 1.46 million encrypted ID-document images; the Times Club web system was also accessed. Park24 says full card numbers and security codes are not stored, it has found no sign the data was sold or published, and it will delete all held ID images by the end of October 2026.
affected
Park24 Co., Ltd. / Times Mobility (タイムズカー Times Car car-sharing and Times Club members, Japan): 6,628,007 accounts and about 1.46 million ID-document images
Hackers got into the parcel-tracking website of Sagawa Express, one of Japan's biggest delivery companies. The company says up to about 53 million records with names, addresses and phone numbers of senders and recipients may have leaked, but that number counts the same person many times and not all of it is confirmed to have been taken. Credit card details and passwords were not involved.
What this means
Sagawa warns of fake emails, text messages and calls pretending to be from Sagawa; don't open links or give personal details in unexpected messages.
Sagawa says it will contact affected customers in turn, and its public notice counts as notification for people it can't reach individually.
Parcel tracking on the website is back, but Sagawa says the tracking API, online pickup booking, delivery-address changes and some return services are still suspended; deliveries continue as normal.
Sagawa hasn't said how the attackers got in or how many individual people are affected.
Technical details
Sagawa Express says it confirmed unauthorized third-party access to its website's parcel-tracking service (お荷物問い合わせサービス) on September 30, 2026, cut outside access to the system and suspended several web services. In its fifth report on October 23 it says up to about 53.23 million personal data records, counted with duplicates, may have leaked: sender and recipient names, addresses and phone numbers from shipping labels handled June 21 to September 30, 2026, contract customers' details, and Smart Club members' names, addresses, phone numbers, email addresses and member IDs. It says no card data or passwords are involved, not all records are confirmed to have left, no misuse has been found, and parcel tracking resumed on October 23 while other services stay suspended.
affected
Sagawa Express Co., Ltd. (佐川急便株式会社, Japan): parcel-tracking service; senders and recipients on labels from 21 June to 30 September 2026, contract customers and Smart Club members
Second Retailing, the Japanese company behind the GEO rental and game shops and 2nd Street secondhand stores, says hackers got into its internal computer systems. It shut down its apps and online shops as a precaution, and they are still offline with no date to return. The break-in is confirmed, but the company says its investigation found no sign that customer data was taken.
What this means
The 2nd Street and GEO apps, online stores, mail-in buyback and rental services are suspended; Second Retailing says stores stay open and in-store buyback without the app still works.
Second Retailing says no leak of personal or confidential data was found, so it hasn't asked customers to take any action.
The company hasn't said when online services will return or how the attackers got in.
Technical details
Second Retailing Co., Ltd. says it confirmed unauthorized access by a third party to its internal systems on October 15, 2026, and from 21:00 on October 17 suspended apps and web services for 2nd Street, GEO, GEO Mobile and other brands to prevent further harm. In a second report on October 19 it says its investigation with outside security specialists found no suspicious external connections to or direct access of its database servers and no leak of personal or confidential information. The services remain suspended with no restart date announced; stores keep normal hours.
affected
Second Retailing Co., Ltd. (株式会社セカンドリテイリング, formerly GEO Holdings): 2nd Street, GEO, GEO Mobile apps and web services, Japan
Studio, a Japanese service people use to build websites without coding, says attackers broke into its cloud systems and that information on all of its users may have been taken, including messages visitors sent through website contact forms and saved passwords for linked services. Japan's government Digital Agency, which used Studio for its website, says up to about 13,000 contact-form messages may be affected. The break-in is confirmed; Studio says it hasn't confirmed the data was actually taken but is treating it as if it was.
What this means
Studio asks site owners to replace and revoke API keys and tokens for outside services they linked to Studio themselves, because it says it can't revoke those for them.
Studio says it changed its own credentials and encryption keys, but notes that this can't protect information that may already have been taken.
People who sent messages through a contact form on a Studio-built site may get notices from that site; the Digital Agency warns of scam emails, calls and texts pretending to be from it and says it never asks for passwords or card details by email or phone.
Studio hasn't yet published a final count of affected accounts or the results of its external investigation.
Technical details
Studio Inc., which runs the Japanese no-code website builder Studio, says a third party exploited a vulnerability in part of the service to access its cloud environment between September 30 and October 1, 2026 (JST) and left the data retrievable from outside until it fixed the flaw on October 14. It says data for all registered customers may have leaked, including account details with hashed passwords, site content, form submissions and stored API keys and tokens, and that encrypted items may be readable because the decryption key was read in the same intrusion. Japan's Digital Agency said on October 22 that up to 13,323 contact-form entries submitted from May 2021 to March 2023 and 35 staff or contractor Studio accounts may have leaked through the incident.
affected
Studio Inc. (Studio no-code website builder, Japan; all registered users and data from sites built with it, including Japan's Digital Agency contact forms)
M3, a Japanese medical information company, says hackers got into the system behind MR-kun, a service it runs for drug companies. It has confirmed that names, workplaces and some email addresses of 25,775 doctors and other members and 2,260 drug company staff were taken. M3 says passwords and payment details were not part of the leak. The leak is confirmed.
What this means
M3 asks members and business partners to watch for suspicious emails, texts and calls pretending to be from M3.
M3 says it began emailing affected members on October 22 and that its messages will never ask for passwords, card or bank details.
M3 says login passwords, m3 points and card numbers were not part of the leak.
M3 hasn't said how the attackers got in; it says its investigation continues.
Technical details
M3, Inc. says it confirmed unauthorized access by a third party to the system behind MR-kun, its service for pharmaceutical companies, on October 14, 2026, and cut off the access route the same day. In its second report on October 23 it says it confirmed leaks affecting 25,775 m3.com members and others (6 with email addresses) and 2,260 pharmaceutical company staff (264 with email addresses), including names, workplaces and some service-usage and account-assignment data. M3 says login passwords and m3 points were not included, it doesn't hold card numbers, and it has seen no public posting or misuse of the data.
affected
M3, Inc. (エムスリー株式会社) MR-kun (MR君) service: 25,775 m3.com members and others and 2,260 pharmaceutical company staff, Japan
Arkadiko, a cryptocurrency lending service on Stacks (a network built on top of Bitcoin), says an attacker got a harmful program approved through its own community voting system and used it to take most of the funds held in its vaults. Arkadiko's early estimate is about 2 million stSTX and about 1.65 sBTC tokens. Its USDA stablecoin, a token meant to stay worth one dollar, lost that value. Arkadiko has confirmed the attack.
What this means
Arkadiko says users with open stSTX or sBTC vaults can't change them for now because the collateral is gone, and redemptions and liquidations are paused; the DEX and other STX vault functions still work.
Arkadiko says the USDA depeg also hit USDA holders and DEX liquidity providers, not only vault users.
Arkadiko says it is trying to recover the funds through exchange freezes and a police report, but hasn't said whether or when users will be repaid.
Arkadiko says further updates will come on X, so treat other messages offering refunds or recovery as likely scams.
Technical details
In a thread on its official X account, Arkadiko says a malicious contract passed through the protocol's governance on October 22, 2026 and was used to drain most of the assets held in Arkadiko vaults, causing its USDA stablecoin to lose its peg. Arkadiko's preliminary estimate is about 2 million stSTX and about 1.65 sBTC drained. It says it disabled the malicious contract, temporarily paused governance, vault redemptions and liquidations, contacted exchanges to request freezes of the stolen funds and is filing a police report.
affected
Arkadiko Protocol (Stacks DeFi lending protocol; stSTX and sBTC vaults, USDA stablecoin holders and DEX liquidity providers)
Wasmtime is a widely used engine that runs WebAssembly, small programs that are meant to stay locked inside a safe sandbox. A specially built program can trick its compiler and break out of that sandbox, which could let it affect the host system running it. Fixed versions 36.0.19 and 43.0.0 are out; active exploitation is not confirmed.
What this means
If you use the wasmtime Rust crate before 36.0.19, or 37.0.0 up to before 43.0.0, upgrade to 36.0.19 or 43.0.0, which the GitHub advisory lists as fixed versions.
According to the advisory, a Wasmtime engine with default settings (the Cranelift backend) is affected on any architecture, so services that run untrusted Wasm modules are the most exposed.
Wasmtime is often embedded inside other software, so check your dependencies and vendors for bundled copies.
The GitHub advisory and NVD record do not say the flaw has been exploited in the wild.
Technical details
CVE-2026-115889 affects Wasmtime, the WebAssembly runtime from the Bytecode Alliance, in versions before 36.0.19 and from 37.0.0 before 43.0.0. According to the GitHub advisory, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds, so a very large or specially crafted Wasm function can cause miscompilation, type confusion and escape from the Wasm sandbox on any architecture using the default Cranelift backend. The issue is fixed in Wasmtime 36.0.19 and 43.0.0.
affected
Wasmtime (Rust crate wasmtime) before 36.0.19 and 37.0.0 to before 43.0.0, default Cranelift backend; fixed in 36.0.19 and 43.0.0
Pillow, a widely used Python library that programs use to open and edit pictures, has a flaw in how it reads FlashPix images, an old picture format. A booby-trapped image file can let an attacker run their own code on a server that opens it, even if the file has a harmless-looking name. A fix is out in version 13.0.0; active exploitation is not confirmed.
What this means
If you use Pillow 12.3.0 or earlier, upgrade to 13.0.0, which the GitHub advisory lists as the first fixed version.
According to the advisory, only setups with the optional olefile package installed can read FlashPix files, but the file is recognized by its contents, so renaming or filtering by extension does not block it.
Services that open or make thumbnails of untrusted uploads are the most exposed; Pillow is often pulled in by other Python software, so check containers and dependencies too.
The NVD record and GitHub advisory do not say the flaw has been exploited in the wild.
Technical details
CVE-2026-112398 is a heap buffer overflow in the FlashPix (FPX) JPEG-tile decoder of the Python imaging library Pillow, affecting versions up to and including 12.3.0. According to the GitHub advisory, an application that opens a single crafted OLE2 FlashPix file with Image.open() while the optional olefile dependency is installed can be made to run attacker-chosen code, and files are detected by content rather than extension. The issue is fixed in Pillow 13.0.0.
affected
Python Pillow 12.3.0 and earlier (FlashPix/FPX input with olefile installed); fixed in 13.0.0
A serious bug was found in odhcpd, a program on OpenWrt routers that hands out network addresses to devices. An attacker on the network could send one specially crafted message to crash it or possibly take over the router, without needing a password. A fix exists in odhcpd 25.12; attacks in the wild have not been confirmed.
What this means
If you run OpenWrt, update odhcpd to version 25.12 or later, which the NVD record says contains the fix.
According to the NVD record, odhcpd runs as root, so a successful attack could give full control of the router.
The attack needs an unauthenticated DHCPv6 packet (UDP port 547, per the advisory), so devices on the router's local network or relayed DHCPv6 traffic are the main exposure.
Neither the advisory nor NVD reports active exploitation.
Technical details
odhcpd, the DHCPv6, DHCPv4 and router-advertisement server used by OpenWrt, has two stack buffer overflows in its DHCPv6 IA response handling: a single unauthenticated DHCPv6 REQUEST carrying enough IA options can write past a fixed 512-byte stack buffer. The NVD record says odhcpd runs as root on OpenWrt and embedded targets often lack stack canaries and ASLR, making code execution realistic; the issue is fixed in odhcpd version 25.12. The GitHub advisory (GHSA-7fwx-hhrg-3496) was published on 18 June 2026 and the CVE was published to NVD on 23 October 2026; neither source reports exploitation in the wild.
The Japan Times, an English-language newspaper in Japan, and its parent group confirmed a ransomware attack (malicious software that locks files and is often used to steal data) on an old internal file server. Data the attackers say they stole has been posted online and may include information on former staff and business partners up to August 2022, such as bank details and, for some people, ID documents. The company says its news site, subscriber records and payment systems were not affected.
What this means
The group says it sent individual notices on 23 October; people who worked for or did business with the group up to August 2022 and did not get one can contact incident-support@news2u.co.jp.
The group asks affected people to check bank statements regularly for unauthorized withdrawals or suspicious transactions.
Be wary of emails, calls or letters claiming to be from the group, and don't click links, open attachments or enter passwords or PINs, as the group advises.
The group says Japan Times Online subscribers, subscriber databases and payment systems were not affected, so readers' subscription data is not part of this incident according to the company.
Technical details
The Japan Times, Ltd. and its group company News2u Holdings, Inc. say a group-managed server was hit by ransomware on 18 September 2026, and that on 15 October data the attacker claims to have taken was published on an external website. In their third update on 23 October 2026, they say exposure cannot be ruled out for an administrative file server used until August 2022, holding business-partner details (including bank account details for transfers) and personal data of employees and former employees up to August 2022, including for some people MyNumber, passport, residence card and health insurance card information. The group says The Japan Times Online, subscriber databases and payment systems run on separate infrastructure with no impact identified, and it sent individual notifications on 23 October.
affected
The Japan Times, Ltd. and News2u Holdings, Inc. (Tokyo): administrative file server used until August 2022 with employee, former-employee and business-partner data from 2001 to August 2022
Good Smile Company, the Japanese maker of anime figures such as Nendoroids, says hackers got into its official online shop between 19 and 22 October 2026 and could see customers' names, addresses, phone numbers, email addresses and order details, plus the last four digits and expiry date of payment cards. Full card numbers and security codes were not exposed. The company has shut the shop while it investigates.
What this means
Good Smile Company warns that scammers may use the leaked details in fake emails, calls or texts pretending to be the company, government bodies or banks; don't respond to unexpected messages or click their links.
The company says it will email members who may be affected once its checks are done, and has set up a separate customer-support form for questions.
The official shop is closed and the company hasn't said when it will reopen or how many members are affected.
Technical details
Good Smile Company (株式会社グッドスマイルカンパニー) said on 23 October 2026 that its log analysis found repeated unauthorized access to the administration data of its e-commerce site, the Good Smile Company Official Shop, from about 15:00 on 19 October to about 22:00 on 22 October 2026 (Japan time). Information that may have been viewed includes members' names, gender, addresses, phone numbers and email addresses, order details, and card brand, last four digits and expiry date; full card numbers, cardholder names and security codes are not included. The company says it closed the site, believes a vulnerability was the cause, has fixed the suspected vulnerability, and reported the incident to Japan's Personal Information Protection Commission.
affected
Good Smile Company Official Shop (グッドスマイルカンパニー公式ショップ) members and orders, Japan
Nextcloud is a self-hosted file-sharing and collaboration system, and one of its optional add-ons runs a built-in office-document server. A flaw in that add-on lets attackers run their own commands on the server without logging in, and attackers have already used it, according to the official vulnerability record and CISA. A fixed version is available; standalone Collabora servers are not affected.
What this means
If your Nextcloud has the 'Collabora Online - Built-in CODE Server' (richdocumentscode) app installed, update it to 26.4.303 or later; the Nextcloud community warning says versions 26.4.302 and older are affected.
Setups that use the richdocuments app without richdocumentscode, or run Collabora separately (Docker, Linux packages or a hosting provider), are not affected according to that warning.
Because the flaw was exploited before many admins knew about it, updating does not undo an existing compromise; check the server for unexpected PHP files and suspicious requests to the app's proxy.php.
CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities list on 23 October 2026, with a 26 October deadline for US federal agencies.
Technical details
CVE-2026-110447 is an OS command injection (CWE-78) in proxy.php of Collabora Online Built-in CODE Server (richdocumentscode), a Nextcloud app, that allows remote code execution when the bundled CODE server isn't running, for example after a restart. The CVE record says it was exploited in the wild in September and October 2026, that versions before 26.4.303 are affected, and that standalone Collabora Online servers are not. CISA added it to its Known Exploited Vulnerabilities catalog on 23 October 2026 with a remediation due date of 26 October 2026.
affected
Collabora Online Built-in CODE Server (Nextcloud app richdocumentscode) before 26.4.303; standalone Collabora Online not affected
The University of Copenhagen, Denmark's largest university, has confirmed that hackers broke into one of its test systems and got access to personal details of about 525,000 people, including names, Danish personal ID numbers (CPR numbers), phone numbers and private email addresses. The university says the break-in was found on Tuesday and has been stopped, and that daily operations were not affected.
What this means
People with a past or present connection to the University of Copenhagen should watch for scam emails, texts and calls that use their name, phone number or email, since leaked contact details are commonly used for phishing.
Because CPR numbers were in the database, according to KU, affected people should be wary of anyone asking them to confirm their CPR number or other identity details.
KU says it is still working out the exact scope of the leak and will share more information later; it hasn't said how the attackers got in or who exactly is in the database.
KU says the incident has been reported to the Danish Data Protection Agency (Datatilsynet) and other relevant authorities are being kept informed.
Technical details
The University of Copenhagen (Københavns Universitet, KU) said on 23 October 2026 that it detected a cyberattack in which hackers gained access to one of the university's test environments; the attack was discovered on Tuesday and then brought under control. KU says the hackers obtained access to information on about 525,000 people, in a database containing full names, CPR numbers (Danish national identity numbers), work and private phone numbers and private email addresses. KU says there is no sign the hackers reached systems supporting daily operations, the access has been closed, and the incident has been reported to the Danish Data Protection Agency (Datatilsynet).
affected
University of Copenhagen (Københavns Universitet), Denmark: test-environment database with personal data on about 525,000 people
Microsoft disclosed a maximum-severity flaw in VM Inspector, an Azure tool for examining cloud virtual machines (computers rented in Microsoft's cloud). An attacker could have gained higher access without permission. Microsoft says it has already fixed the problem on its side, and it lists the flaw as not exploited.
What this means
Microsoft says the flaw is fully mitigated in its service and customers do not need to take any action.
Microsoft's advisory lists the flaw as not publicly disclosed and not exploited at the time it was published.
Microsoft publishes CVEs like this for cloud services for transparency, so there is no patch to install.
Technical details
Microsoft published CVE-2026-110063, an improper link resolution before file access ('link following', CWE-59) flaw in VM Inspector for Azure Virtual Machines that allows an unauthorized attacker to elevate privileges over a network. Microsoft rates it Critical with CVSS 3.1 base score 10.0. The MSRC entry says the issue has already been fully mitigated by Microsoft, customers have no action to take, and it was not publicly disclosed or exploited at release.
affected
Microsoft VM Inspector for Azure Virtual Machines (cloud service)
Initia, a cryptocurrency blockchain project, has paused its main blockchain and the smaller networks built on it (called rollups) after what it calls a security incident. Initia confirms the incident and the pause, but hasn't said what happened or whether anyone lost money.
What this means
Initia says its L1 and rollups are halted, so transactions on those networks are paused until it says otherwise.
Initia hasn't said what caused the incident, whether funds were taken, or who is affected.
Initia warns users to be cautious of unofficial links, messages and claims; fake 'refund' or 'recovery' offers are a common scam after incidents like this.
Technical details
Initia said on its official X account that as of 15:41:30 UTC on 23 October 2026 the Initia L1 and its rollups were halted due to a security incident. The team says it is investigating and working with security teams, validators and exchanges to establish the full scope of any impact, and will share verified information through its official channels. Initia has not said what happened or whether any funds were lost.
SAP, whose software runs finance and operations at many large companies, has fixed several critical flaws. The worst are in a programming toolkit for Python developers (rated 10 out of 10) and in two SAP business systems (9.9), where in S/4HANA a user with certain business permissions could run their own code and take over the system. SAP has not said they are being exploited; active exploitation is not confirmed.
What this means
SAP strongly recommends customers apply the October 2026 security notes on priority; for SAP Cloud SDK for Python, the affected versions are those below 0.45.2.
According to the NVD record, CVE-2026-89107 needs an authenticated user with specific business privileges, so reviewing who holds rule-maintenance roles in S/4HANA limits who could abuse it.
SAP has not said whether any of these flaws have been exploited.
Technical details
SAP's October 2026 Security Patch Day (13 October) released 16 new security notes and 4 GitHub security advisories. The critical items include CVE-2026-89111, an OAuth2 SSRF in the SAP Cloud SDK for Python library before 0.45.2 (CVSS 10.0, GHSA-4mv3-jxxm-9cx2); CVE-2026-89110, broken access control in SAP NetWeaver Visual Composer VC70RUNTIME 7.50 (CVSS 9.9, note 3797111); and CVE-2026-89107, code injection in SAP S/4HANA Manage Substitution/Validation Rules, S4CORE 105-109 (CVSS 9.9, note 3805589). The NVD record for CVE-2026-89107 says an authenticated attacker with specific business privileges could submit input interpreted as ABAP code, leading to full compromise of the system.
affected
SAP Cloud SDK for Python < 0.45.2; SAP NetWeaver Visual Composer VC70RUNTIME 7.50; SAP S/4HANA (Manage Substitution/Validation Rules) S4CORE 105-109
Comic Cmoa, a large Japanese online comic and e-book store run by NTT Solmare, says hackers got into its systems and took customer details. Up to about 4.2 million log records (which may count some customers more than once) with email addresses, nicknames, birth dates and gender leaked, plus 319 account records that also included scrambled passwords. The company has confirmed the breach and the store is still offline.
What this means
NTT Solmare says it will email the customers whose information was leaked.
The company says card details were not stored on the affected system and it has found no leak of purchase history or users' bookshelves.
NTT Solmare asks customers who reuse the same email and password elsewhere to change those passwords, and to watch for fake emails or websites pretending to be the company.
The company says every customer will be asked to reset their password when the store reopens; it hasn't given a reopening date.
Technical details
NTT Solmare, which runs the Japanese e-book store Comic Cmoa (コミックシーモア), says it judged on 15 October 2026 that its servers had likely been accessed without authorization, stopped the service that morning, and on 16 October confirmed that member information had been taken. Its fourth report (21 October) says 319 member-database records (email address, hashed password, nickname, birth date, gender) and up to about 4.2 million records in system log files (email address, nickname, birth date, gender; may include duplicates of the same customer; no passwords) were leaked. The company says the intrusion route and attack method have been identified and blocked, credit card data was not held on the affected system, and the service remains suspended with no restart date yet.
Cysic, a cryptocurrency project, says an attacker abused its bridge (the service that moves tokens between blockchains) on 17 October to create 10 million CYS tokens out of thin air. Cysic says users' own wallets and its main network were not affected. The bridge is paused, and Cysic plans to destroy 7.2 million tokens from its own reserves to make up for the extra supply.
What this means
Cysic says its cross-chain bridge remains suspended until a security review is finished.
Cysic says it plans to burn 7.2M CYS from Foundation Reserves by the end of October and will publish the on-chain burn records once confirmed.
Cysic hasn't publicly explained how the attacker was able to mint the tokens.
Messages offering refunds or bridge access outside Cysic's official channels are a common scam after incidents like this.
Technical details
Cysic says on its official X account that on 17 October 2026 a security incident involving the unauthorized minting of 10M CYS tokens occurred through the Cysic bridge, that user wallets and mainnet operations were unaffected, and that the bridge is suspended pending a security review. On 22 October Cysic offered the party responsible a 10% recovery bounty for returning 90% of the identified ETH proceeds within 72 hours, saying it would otherwise escalate to law enforcement. On 23 October it said it plans to burn 7.2M CYS from Foundation Reserves by the end of October to offset the unauthorized minting.
Palo Alto Networks firewalls include GlobalProtect, a VPN gateway that employees use to connect to their company network from outside. A flaw fixed in May lets attackers open a VPN connection without logging in, skipping two-step verification. Palo Alto's own research team now says ransomware gangs Qilin and INC are using it to break into company networks, and CISA confirms it is exploited.
What this means
If you run PAN-OS with GlobalProtect, upgrade to a fixed release from Palo Alto's advisory (for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6 or later); Cloud NGFW and Panorama are not affected.
Palo Alto says you can reduce the risk by using a dedicated certificate for Authentication Override cookies, or by turning Authentication Override off.
Unit 42 advises hunting for its published indicators and treating any successful gateway-connected events tied to them as an incident; patching does not undo an attacker who already got in.
Palo Alto hasn't said how many organizations have been breached this way.
Technical details
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS that lets an attacker establish an unauthorized VPN connection when Authentication Override cookies use a reused or shared certificate. Palo Alto Networks patched it in May 2026 and CISA added it to KEV on 29 May 2026 with known ransomware use. In an update dated 19 October, Palo Alto's Unit 42 says ransomware operators Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are exploiting it to get VPN sessions past MFA, then moving laterally with RMM tools, RDP and SMB toward data theft and ransomware deployment.
affected
Palo Alto Networks PAN-OS GlobalProtect portal and gateway (10.2, 11.1, 11.2, 12.1) and Prisma Access
PHP, the programming language behind a large share of websites, has warned about another way an attacker could run code on a web server, two days after its emergency PHP2Shell fixes. It only affects sites set up in an unusual way, and PHP says it is unlikely in practice. There is no fix yet, and active exploitation is not confirmed.
What this means
PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release; if you already did this for CVE-2026-109619 on 21 October, PHP says to keep it in place and no further action is needed.
According to PHP, only applications that change session.serialize_handler to php at runtime with ini_set() before session_start() are at risk; applications that never change the handler at runtime can keep the feature enabled.
The 21 October PHP2Shell updates do not fix this issue, but you should still install them, since those flaws are being exploited.
PHP hasn't published a severity score or a list of affected versions yet; it says the full advisory comes with the next release.
Technical details
On 23 October php.net published an informational advisory for CVE-2026-115560, a remote code execution vector in session upload progress that is separate from the PHP2Shell bugs fixed on 21 October. PHP says it only occurs when an application sets session.serialize_handler to php_binary or php_serialize in its configuration, switches it to php at runtime with ini_set() before calling session_start(), and still has session upload progress enabled. PHP is treating it as unlikely in practice, will fix it in the next regular bugfix release with a full advisory, and recommends setting session.upload_progress.enabled=0 until then.
affected
PHP web applications that switch session.serialize_handler from php_binary or php_serialize to php at runtime with session upload progress enabled (no fixed version yet)
Sentry's add-on for Next.js websites, a popular tool developers use to report app errors, has a flaw that can let someone skip a site's login checks on certain pages. It only matters for sites set up in a specific way. A fix is out, and active exploitation is not confirmed.
What this means
If your Next.js app uses @sentry/nextjs, update to 9.47.2, 10.75.2 or 11.0.0-rc.1 or later, the fixed versions listed in the GitHub advisory.
According to the NVD record, you are only exposed if you set tunnelRoute, build with webpack, have a page whose path collides with the tunnel path, and rely only on middleware to check who can see it.
Adding authorization checks inside the pages themselves, not only in middleware, limits the impact of this kind of bypass.
The NVD record does not say the flaw has been exploited in the wild.
Technical details
CVE-2026-114139 affects the @sentry/nextjs npm package from 9.36.0 until 9.47.2, 10.75.2 and 11.0.0-rc.1. According to the NVD record, its webpack integration skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite only serves the exact tunnel path, so when an app route collides with the tunnel path or a root dynamic segment resolves under it, an unauthenticated request can reach that route without middleware authorization. Exploitation requires tunnelRoute, a webpack build, a colliding route, and middleware being the only authorization control.
affected
npm package @sentry/nextjs 9.36.0 to before 9.47.2, 10.x before 10.75.2, and 11.0.0 prereleases before 11.0.0-rc.1 (webpack builds with tunnelRoute)
Pillow, a widely used Python library that programs use to open and edit pictures, has a flaw in how it opens EPS images. If an attacker can choose the file's name, they can slip extra instructions to Ghostscript, a helper program Pillow uses for these images, and in some cases run commands. A fix is out in version 13.0.0; active exploitation is not confirmed.
What this means
If you use Pillow from 2.6.0 up to but not including 13.0.0, upgrade to 13.0.0, which the GitHub advisory lists as the first fixed version.
According to the NVD record, the attack works through the file name rather than the file contents, so apps that keep user-supplied names for uploaded EPS files are the most exposed.
Pillow is often installed as a dependency of other Python software, so check installed packages and container images, not only code that imports it directly.
The NVD record does not say the flaw has been exploited in the wild.
Technical details
CVE-2026-112900 affects the Python imaging library Pillow from 2.6.0 until 13.0.0. According to the NVD record, the EPS plugin passes a caller-controlled input filename to Ghostscript after -f without converting it to a safe absolute path, so a filename beginning with a hyphen can be read as a Ghostscript option; arbitrary command execution additionally requires a leading @ argument-file filename and control of the referenced text file, and the chain reproduces with the default -dSAFER invocation. The issue is fixed in Pillow 13.0.0.
affected
Python Pillow 2.6.0 to before 13.0.0 (EPS input via Ghostscript)
An add-on for WordPress websites called WP Mailster has a flaw that lets anyone on the internet, without logging in, upload a malicious file that gives them control of the website's server. The fix is in version 1.9.2.0. The security firm that catalogued it warns it is likely to be exploited, but active exploitation is not confirmed.
What this means
If your WordPress site uses WP Mailster 1.9.1.0 or older, update to 1.9.2.0 or later, as Patchstack advises.
Patchstack says flaws like this are often used in mass attacks against thousands of sites at a time, regardless of their size.
Updating does not remove a web shell (a hidden backdoor file) that may already have been planted, so site owners who were exposed should check for unexpected files.
Neither Patchstack nor the developer has said whether the flaw has been exploited.
Technical details
Patchstack, the CVE numbering authority, published CVE-2026-111832 on 19 October 2026: an unrestricted file upload flaw in the WP Mailster WordPress plugin that lets an unauthenticated attacker upload a web shell to the server. Versions up to and including 1.9.1.0 are affected and 1.9.2.0 fixes it. Patchstack scores it CVSS 3.1 10.0; NVD lists it as deferred with no score of its own.
affected
WP Mailster WordPress plugin versions up to and including 1.9.1.0 (fixed in 1.9.2.0)
Oracle has released fixes for four of the most severe possible flaws (rated 10 out of 10) in its business middleware, the software that connects and secures many large companies' applications. Two products are affected: Oracle Access Manager, which handles logins for other apps, and Oracle SOA Suite. Attackers would not need a password. Oracle has not said they are being exploited; active exploitation is not confirmed.
What this means
If you run Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0, or Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0, apply the October 2026 Critical Patch Update, which Oracle says to do as soon as possible.
Oracle says that until patches are applied, blocking the network protocols an attack needs can reduce risk; for CVE-2026-91216 and CVE-2026-91221 those are T3 and IIOP.
Oracle says attacks on these flaws can significantly impact other products beyond the vulnerable one (a scope change in CVSS terms).
Oracle has not said whether any of these flaws have been exploited.
Technical details
Oracle's October 2026 Critical Patch Update includes 206 new security patches for Oracle Fusion Middleware, four of them rated CVSS 3.1 10.0 and remotely exploitable without authentication. CVE-2026-87337 affects the Authentication Engine of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTP; CVE-2026-91231 (Adapters, over HTTP) and CVE-2026-91216 and CVE-2026-91221 (Fabric Layer, over T3 and IIOP) affect Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. Oracle says a successful attack on the SOA Suite flaws can result in takeover of Oracle SOA Suite.
affected
Oracle Fusion Middleware: Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0; Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0
AND ST HD, a large Japanese clothing retailer that runs the and ST online store, says hackers broke into several of its office servers on 22 October and may have copied details for about 2.5 million customers, such as names, addresses, birthdays, phone numbers and emails. Card details and passwords were not included. Its shops and web store still work, but member points can't be used for now.
What this means
AND ST HD says the possibly leaked customer details include name, date of birth, gender, address, phone number, email address and member ID, which can be used in convincing scam emails, texts and calls; be wary of messages claiming to be from and ST.
The company says credit card and other payment details, and passwords customers set themselves, were not included.
Member points currently can't be used in shops or the web store; AND ST HD says it is starting to contact affected customers and partners and will set up an inquiry desk.
The company is still checking which employee information was affected and hasn't said how the attackers got in.
Technical details
Japanese apparel retailer AND ST HD (株式会社アンドエスティHD) disclosed on 23 October 2026 that around 7:30 a.m. on 22 October an outside party made login attempts on, broke into and extracted data from several of its business servers. It detected the activity around 10:00, isolated the servers and cut off the access route by 17:00. Information that may have leaked covers about 2.5 million customers (name, date of birth, gender, address, phone number, email address and member ID), about 10,000 business-partner records, and employee data still being checked; payment card details and customer-set passwords are not included. The company has consulted police and reported to Japan's Personal Information Protection Commission.
affected
AND ST HD (株式会社アンドエスティHD, Japanese apparel retailer; and ST members, about 2.5 million customer records, about 10,000 business-partner records, employees under review)
Pizza Hut Japan has confirmed that hackers got into part of the system behind its online pizza ordering on 19 October and took some customer details, including email addresses, phone numbers, customer IDs and order records. The company says credit card numbers were not taken. It hasn't said how many customers are affected.
What this means
Pizza Hut Japan warns that people may get suspicious emails, text messages or calls pretending to be from Pizza Hut using the leaked email addresses and phone numbers; don't click links, open attachments or give passwords or card details in response.
The company says credit card information was not part of the leak, and it has not found any secondary damage so far.
Session login tokens (the codes that keep you signed in) were among the leaked data; signing out and changing your Pizza Hut Japan password is a reasonable precaution.
Pizza Hut Japan hasn't said how many customers are affected; it says the cause and full scope are still being investigated.
Technical details
Pizza Hut Japan (日本ピザハット株式会社) said on 23 October 2026 that on 19 October a third party gained unauthorized access to a payment API connected to its Japanese online ordering service and retrieved some information from a database containing customer data. The company lists customer IDs, email addresses, phone numbers, records relating to deleted customer information, session login tokens and transaction records as leaked, and says credit card information was not included. It has blocked the attacking IP addresses, addressed the vulnerability and filed a preliminary report with Japan's Personal Information Protection Commission; the cause and scope are still under investigation.
affected
Pizza Hut Japan Ltd. (日本ピザハット株式会社) online ordering service customers in Japan
The city government of Columbia, South Carolina's capital, now confirms it was hit by ransomware, a type of attack that locks up computer systems, often to demand payment. Several online city services, including the MyColaSC request app, are still offline, and the city says sensitive data within its network was involved. Police, fire, 911, water and online bill payments are still working.
What this means
The city says residents can call (803) 545-3300 for things normally reported through MyColaSC, such as potholes, fallen trees and broken streetlights, and should keep calling 911 for emergencies.
According to the city, police, fire, 911, Columbia Water and the Payment Center, including online payments, are still operating.
The city says the attack involved sensitive data within its network but hasn't said whose information was affected or whether people will be notified; watch for scam messages claiming to be from the city.
The city hasn't said when the affected online services will be back.
Technical details
The City of Columbia, South Carolina, said on 21 October 2026 that it was addressing a security incident on the city network after its IT department identified suspicious activity. In a 23 October update, the city confirmed it is the victim of a ransomware attack discovered on 20 October that impacted several public-facing services and involved sensitive data within the city's network; the South Carolina Law Enforcement Division (SLED) is leading the criminal investigation. MyColaSC and online services for Animal Services, Parks and Recreation reservations and GIS remain affected, while police, fire, 911, Columbia Water and the Payment Center, including online payments, remain operational.
affected
City of Columbia, South Carolina (MyColaSC, Business Licensing, Parks & Recreation, Planning & Development Services, GIS and Animal Services online services)
GitHub has flagged a package called imgdecode on npm, the main place JavaScript developers download code from, as malware. Every version of the package is listed as malicious. GitHub says any computer that installed or ran it should be treated as fully taken over.
What this means
Check your projects (for example with npm ls imgdecode) and remove the package if it is there; GitHub lists every version as malicious.
GitHub says to rotate every secret and key stored on an affected computer, doing so from a different, clean computer.
GitHub warns that removing the package may not remove everything the malware installed, so rebuilding the machine is the safer option.
GitHub hasn't said how many people downloaded the package.
Technical details
On 22 October GitHub published a critical malware advisory, GHSA-hw69-vrvf-87h5, for the npm package imgdecode, listing versions 1.0.0, 1.0.1 and 1.0.2 and marking all versions (>= 0) as affected. GitHub says any computer that installed or ran the package should be considered fully compromised and all secrets on it rotated from a different computer.
affected
npm package imgdecode (all versions; 1.0.0, 1.0.1 and 1.0.2 listed)
CoinDCX, an Indian cryptocurrency exchange, says some customers kept sending crypto to old deposit addresses that attackers had taken over in its July 2025 hack, and its system for moving those deposits to safety stopped working for a while. CoinDCX confirms this caused losses, which it says it covered itself, and that customers' balances were credited. It has not said how much was lost.
What this means
CoinDCX says depositing to deprecated addresses is highly risky; always copy the current deposit address from the CoinDCX app or website rather than reusing an old one.
CoinDCX says all affected users' deposits were credited and its active wallets were not compromised, so it says no user action is needed beyond using current addresses.
CoinDCX hasn't said how much was lost or for how long the sweeping process failed.
CoinDCX asks users to rely only on its official channels for updates, so be wary of messages offering refunds or recovery help.
Technical details
In posts on its official X account, Indian crypto exchange CoinDCX first called claims about suspicious transfers from TQKJQ-linked wallet addresses misleading, then said in a further update that some users had kept depositing crypto to addresses that were compromised in its July 2025 security incident and later deprecated. CoinDCX says its process for regularly sweeping such deposits failed for a period, which it identified on the morning of 22 October 2026, and that this caused operational losses that CoinDCX absorbed. It says affected users' deposits were credited, customer assets remain in segregated cold wallets and its current central and user addresses were not impacted; it has not stated the amount lost or how long the sweeping failed.
affected
CoinDCX (Indian crypto exchange; deprecated deposit addresses compromised in July 2025, including the TQKJQ wallet)
Apache Traffic Server, a proxy and caching server that sits in front of websites to speed them up, has fixed 15 security flaws. The worst one, in an optional image plugin called magick, could let anyone on the internet run commands on the server without logging in. Fixed versions are out; active exploitation is not confirmed.
What this means
If you run Apache Traffic Server, the project says to upgrade to 9.2.16, 10.1.5 or 10.2.1, which fix all 15 issues.
The CVSS 10 magick flaw only matters where the experimental magick plugin is enabled, according to the advisory; check whether your configuration loads it.
Several of the other fixes address request smuggling and cache poisoning, which the advisory says can let attackers slip requests past access controls or serve tampered content to other users.
Neither the advisory nor the CISA KEV catalog says any of these flaws have been exploited in the wild.
Technical details
The Apache Traffic Server project's October 2026 advisory lists 15 vulnerabilities fixed in versions 9.2.16, 10.1.5 and 10.2.1, including request-smuggling, memory-safety, access-control and denial-of-service issues. The most serious, CVE-2026-111813 (CWE-88, argument injection), lets an unauthenticated client control ImageMagick convert arguments through the experimental magick plugin in its default (unsigned) configuration; Apache rates it Critical with CVSS 10. CVE-2026-111812 (origin_server_auth plugin), CVE-2026-111814 (pooled mTLS identity confusion) and CVE-2026-111815 (TLS resumption bypassing per-SNI verify_client STRICT) also carry CVSS 10 base scores but are rated Important or Moderate by Apache.
affected
Apache Traffic Server 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 (fixed in 9.2.16, 10.1.5 and 10.2.1)
Okta fixed a serious flaw in Okta Access Gateway, an on-premises appliance companies use to add Okta sign-in to older internal apps. Someone who already has administrator access to its admin console could use it to run commands on the appliance itself. Okta has released a fixed version; active exploitation is not confirmed.
What this means
If you run the Okta Access Gateway appliance, Okta says to upgrade to version 2026.10.2 or later.
Okta's advisory says the attacker must already be logged in as an OAG administrator, so limiting who has admin console access reduces the risk until you update.
Okta's advisory does not say the flaw has been exploited in the wild.
Technical details
Okta disclosed CVE-2026-115547, an input validation and code injection issue (CWE-94, CWE-20) in the Okta Access Gateway (OAG) Admin Console that processes specially formatted configuration values. An authenticated administrator can use it to execute system commands in the context of the OAG service account. Okta scores it CVSS 3.1 9.1 (PR:H, scope changed) and says appliance versions prior to 2026.10.2 are affected and version 2026.10.2 resolves it.
affected
Okta Access Gateway (OAG) appliance versions prior to 2026.10.2
Microsoft disclosed a maximum-severity flaw in Entra application proxy, a Microsoft cloud service companies use to let staff reach internal apps from outside the office. An attacker could have gained higher access without logging in. Microsoft says it has already fixed the problem on its side, and it lists the flaw as not exploited.
What this means
Microsoft says the flaw is fully mitigated in its cloud service and customers do not need to take any action.
Microsoft's advisory lists the flaw as not publicly disclosed and not exploited at the time it was published.
Microsoft publishes CVEs like this for cloud services for transparency, so there is no patch to install.
Technical details
Microsoft published CVE-2026-97785, an improper authentication flaw (CWE-287) in the AAD App Proxy (Microsoft Entra application proxy) cloud service that let an unauthenticated attacker elevate privileges over a network. Microsoft rates it Critical with CVSS 3.1 base score 10.0. The MSRC entry says the issue has already been fully mitigated by Microsoft, that customers have no action to take, and that it was not publicly disclosed or exploited at release.
affected
Microsoft Entra application proxy (AAD App Proxy) cloud service
GitHub has flagged two packages on npm, the main place JavaScript developers download code from, as containing malware. Both packages offered add-on "skills" for AI coding assistants. GitHub says any computer that installed the listed versions should be treated as fully taken over.
What this means
Check your projects (for example with npm ls) for agentic-awesome-skills or opencode-skills-collection at the versions listed in the GitHub advisories.
GitHub says to rotate every secret and key stored on an affected computer, doing so from a different, clean computer.
GitHub warns that removing the package may not remove everything the malware installed, so rebuilding the machine is the safer option.
GitHub hasn't said how many people downloaded the malicious versions.
Technical details
On 22 October GitHub published two critical malware advisories for npm packages aimed at AI coding-agent users: GHSA-rgwm-3jj9-h563 lists 20 versions of agentic-awesome-skills (18.9.0 to 19.13.0) and GHSA-9855-prwc-mfp2 lists 21 versions of opencode-skills-collection (4.0.56 to 4.1.20). GitHub says any computer that installed or ran these packages should be considered fully compromised and all secrets on it rotated from a different computer.
affected
npm packages agentic-awesome-skills (20 versions, 18.9.0 to 19.13.0) and opencode-skills-collection (21 versions, 4.0.56 to 4.1.20)
CSX, one of the largest US freight railroad companies, has filed an official data breach notice with the Vermont Attorney General, so the breach is confirmed. The notice says Social Security numbers, ID numbers and bank or card account details were involved. The Vermont list counts only 9 Vermont residents and doesn't give a total.
What this means
According to the Vermont Attorney General's listing, the exposed details include Social Security numbers, government ID numbers and financial account and card information, which can be used for identity theft and fraud.
If you get a breach letter from CSX, consider freezing your credit and watching bank and card statements for transactions you don't recognize.
The official listing doesn't say how many people are affected in total or how the attackers got in.
Technical details
The Vermont Attorney General's security breach notice list shows that US freight railroad CSX filed a notice on 20 October 2026 covering 9 Vermont residents. The listing says the information involved includes Social Security numbers, government ID numbers, financial account codes and credit and debit account information. The listing does not give a total number of people affected or describe how the breach happened.
affected
CSX (US freight railroad); individuals whose personal information it holds, including 9 Vermont residents
Osaka University in Japan says personal details of 77,851 graduates, students and staff were downloaded by an outsider. The files were not taken from the university's own systems but from online cloud storage that its IT contractor NEC used to share files with another company the university had not been told about. The university confirms the leak and says it has seen no misuse of the data so far.
What this means
Osaka University says the leaked details are mainly names, university IDs, university email addresses, student or staff numbers and department or affiliation; the exact items differ by person and it will notify each affected person individually.
The university says it has not seen the leaked data misused so far, but warns people to watch for phishing and impersonation emails that use the leaked information.
According to the university, NEC shared and kept the files outside its contract, and NEC's investigation found no sign of unauthorized access to the university's own educational computer system.
The university hasn't said how the third party got access to the cloud storage; it says it has asked NEC to find the cause and prevent a recurrence.
Technical details
Osaka University announced on 21 October 2026 that NEC, which operates its university-wide educational computer system, reported on 9 October that a third party had downloaded files containing the university's personal data on 26 September 2026. The university says an unreported NEC subcontractor was involved in the work, and that NEC, outside its contract, had shared the files with that subcontractor on cloud storage and kept files that should have been deleted after the work ended. The leak covers 77,851 people (59,014 graduates, 15,035 current students and 3,802 staff), mainly names, Osaka University personal IDs, university-issued email addresses, student or staff numbers and affiliation; NEC's investigation found no sign of unauthorized access to the university's system itself.
affected
Osaka University (graduates, current students and staff; files held by contractor NEC on cloud storage shared with an unreported subcontractor)
The Kiloview E3 is a video encoder, a box that turns camera or video feeds into network streams for broadcast and AV setups. The US cybersecurity agency CISA says older firmware has nine security flaws, the worst of which let someone with a login take full control of the device. A fix is available, and CISA says it has no reports of attacks using these flaws.
What this means
If you use a Kiloview E3, update its firmware to V1.30, as Kiloview and CISA recommend.
CISA says a secret key built into the firmware is the same on every device, so attackers could forge admin logins without a password until it is updated.
CISA advises keeping devices like this off the internet and behind firewalls, and using secured remote access such as an up-to-date VPN.
CISA says no known public exploitation of these flaws has been reported to it so far.
Technical details
CISA published ICS advisory ICSA-26-295-01 on 22 October 2026 covering nine vulnerabilities in Kiloview E3 NDI encoder firmware before V1.30. The most severe, CVE-2026-107861 and CVE-2026-110243 (CVSS 3.1 9.9, CVSS 4.0 9.4), are OS command injection flaws that let an authenticated web user run commands as root; others include a hard-coded JWT signing secret shared across devices that allows forged admin tokens (CVE-2026-92450) and unauthenticated ONVIF configuration changes (CVE-2026-110825). Kiloview recommends updating to firmware V1.30, and CISA says no known public exploitation has been reported to it.
HPE fixed 72 security bugs in the software that runs its Aruba business Wi-Fi equipment: the controllers, gateways and access points companies use for their wireless networks. The worst ones could let an attacker with no password take full control of the device. HPE says it knows of no attacks or public exploit code, so active exploitation is not confirmed.
What this means
If you run HPE Networking (Aruba) AOS-10 or AOS-8, HPE says to upgrade to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1 or 8.10.0.24 or later, as applicable.
Until you can patch, HPE recommends limiting the CLI and web management interfaces to a dedicated network segment or VLAN, or behind firewall rules.
HPE says versions past End of Maintenance or End of Support should be treated as affected and are not covered by fixes, so those devices need a supported release.
HPE says it is not aware of public discussion or exploit code targeting these flaws as of 22 October.
Technical details
HPE security bulletin HPESBNW05162 (22 October 2026) fixes 72 vulnerabilities in the AOS-10 and AOS-8 wireless operating systems used on HPE Networking (Aruba) mobility conductors, controllers, gateways and access points. Eight are rated CVSS 3.1 10.0, including unauthenticated authentication bypasses, command injection, SQL injection and buffer overflows that can lead to remote code execution, several reachable through the PAPI access-point management protocol. Fixes are in AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1 and 8.10.0.24; HPE says it is not aware of public discussion or exploit code.
affected
HPE Networking (Aruba) AOS-10 and AOS-8 on Mobility Conductors, Controllers, Gateways and Access Points: AOS-10.8.1.1 and below, 10.7.2.6 and below, 10.4.1.13 and below, AOS-8.13.3.0 and below, 8.10.0.23 and below
CVSS 3.1 10.0 (CNA (HPE, security-alert@hpe.com) for CVE-2026-79844 to CVE-2026-79851; the bulletin covers 72 CVEs in total, many more rated 9.3 to 9.8)
SafeVoice is Nevada's anonymous tip line where students and families report school-safety worries. Nevada officials confirmed that hackers who broke into the company running it, Navigate360, got personal details from about 10% of tips that contained such details. The tip line is still working.
What this means
Nevada's Department of Education says it cannot directly notify everyone affected because tips can be anonymous, so this public notice is the main warning; Navigate360 will also post a public notice under a court order.
Navigate360 has set up a call center for questions at 833-966-1754 (toll free), 6 a.m. to 6 p.m. Pacific Time on weekdays, according to NDE.
SafeVoice remains operational and still accepts reports, the state says; it has also asked for information on alternative vendors.
The state hasn't said how many people are affected or exactly which details were in the compromised tips.
Technical details
The Nevada Department of Education and Department of Public Safety gave public notice on 22 October 2026 of a data breach affecting SafeVoice Nevada, the state's anonymous school-safety reporting system, caused by a multistate criminal cybersecurity incident at technology vendor Navigate360 that occurred between November 2025 and March 2026. Navigate360 told the state this month that its forensic investigation concluded about 10 percent of SafeVoice Nevada tips containing personally identifiable information were compromised. NDE says it cannot reliably identify and directly notify affected people because tips can be anonymous, so it is giving public notice, and Navigate360 will issue a separate public notice under a court order.
affected
SafeVoice Nevada (Nevada Department of Education / Department of Public Safety anonymous school-safety tip line, run by vendor Navigate360)
ILITY, a cryptocurrency network, says an attacker broke into servers it runs and drained about 4.1 million of its ILY tokens from its bridge, the service that moves tokens between blockchains, then sold them on exchanges. ILITY says tokens held in users' own wallets were not touched. The bridge and ILY deposits and withdrawals on exchanges are paused while the attack is investigated.
What this means
ILITY says cross-chain transfers through its bridge are unavailable until a security review is finished, and ILY deposits and withdrawals are suspended on exchanges.
ILITY says assets in user wallets were not stolen, but it hasn't finished working out the full attack path or the actual size of the loss.
ILITY says any reopening of the bridge will be announced only through its official channels, so treat other messages offering refunds or bridge access as likely scams.
Technical details
In a security incident notice posted on its official X account, the ILITY Foundation says 4,121,791 ILY of Foundation-supplied liquidity on the ILITY cross-chain bridge was drained, and that an internal investigation found the attacker targeted Foundation-operated servers using methods including a server-side request forgery (SSRF) attack. The Foundation says the drained ILY were moved to an attacker address and sold on exchanges where the token is listed, and that assets in user wallets were not affected. ILY deposits and withdrawals have been suspended with exchanges, the bridge is halted until a security review is complete, a security firm has been engaged and law enforcement contacted; the root cause and actual size of the loss are still being assessed.
affected
ILITY Foundation (ILITY cross-chain bridge; Foundation-supplied ILY liquidity)
Alabama's nursing licensing agency was hit by ransomware, malicious software that locks up computer systems, starting around September 1, 2026, and its online services went down for weeks. The Board confirms some data was copied out and says personal details of nurses, applicants and members of the public, possibly including Social Security numbers and medical information, may have been exposed. License renewals are now back online in a new system.
What this means
The Board says to be wary of unexpected emails, texts or calls about nursing licenses, renewals, fees, refunds or this incident, and that it will never ask for passwords that way.
The Board recommends changing any reused passwords, turning on multifactor authentication, checking bank, credit and insurance statements, and considering a free credit freeze or fraud alert.
Alabama single-state RN and APRN renewals are online again; the Board says the renewal period ends at 4:30 pm on December 31 and unrenewed licenses lapse.
The Board hasn't said how many people's data was taken; questions go to cybersecurityevent@abn.alabama.gov.
Technical details
The Alabama Board of Nursing (ABN) says a forensic investigation found suspicious activity in its technology environment in August 2026 and confirmed malicious activity as of September 1, 2026, in what it calls a ransomware attack. Investigators confirmed that some data was collected and downloaded; because of forensic limitations from the ransomware deployment, ABN could not establish whether every nurse's, applicant's, licensee's or member of the public's information was accessed, but it believes data that could include names, dates of birth, Social Security numbers, driver's license numbers, professional licensing information and medical information may have been exposed. ABN took affected systems offline with the Alabama Office of Information Technology, is cooperating with the FBI and the Alabama Law Enforcement Agency, and says RN single-state license renewal is now back online.
affected
Alabama Board of Nursing (licensees, applicants and members of the public who interact with the Board)
LiteLLM, a popular gateway that companies run to route their apps' requests to AI services, has a serious flaw. Someone who already has an ordinary user account on a company's LiteLLM server could make themselves an administrator and run commands on that server. Fixes are out; active exploitation is not confirmed.
What this means
If you run the LiteLLM proxy, upgrade to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or 1.104.0rc2 or later, the fixed versions in LiteLLM's advisory.
LiteLLM says that if you can't upgrade right away, setting EXPERIMENTAL_UI_LOGIN=false blocks the vulnerable path, but it also breaks CLI SSO and Claude Code gateway login.
The attacker needs an existing internal user account, so servers with many internal users are more exposed than ones only admins use.
This is a separate issue from the malicious LiteLLM 1.107.0 release; neither LiteLLM nor the NVD record says this flaw has been exploited.
Technical details
LiteLLM's advisory GHSA-7hp6-4w63-5g45 (CVE-2026-114612) says the proxy uses one encryption key both to seal secrets at rest and to mint session tokens, so a user with internal_user privileges can get a forged admin credential encrypted by the API-key flow and replay it as a bearer token. That grants proxy_admin access, including running arbitrary commands through the MCP stdio endpoint. Versions from 1.91.0 are exploitable in the default configuration (1.87.0 to 1.90.x only with EXPERIMENTAL_UI_LOGIN enabled); fixes are in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2.
affected
BerriAI LiteLLM proxy 1.91.0 before 1.100.4, 1.101.x before 1.101.3, 1.102.x before 1.102.2, 1.103.x before 1.103.1, 1.104.0rc1 (1.87.0-1.90.x only with EXPERIMENTAL_UI_LOGIN enabled)
A serious flaw in Atlassian's self-hosted Jira, Confluence, Bitbucket and several related tools lets anyone on the internet, without logging in, read certain files on the server if they know where those files are. The US cyber agency CISA lists it as being exploited in real attacks. Atlassian has released fixes; its cloud-hosted versions are already patched.
What this means
If you run any affected Atlassian Data Center product, Crucible or Fisheye, update to the fixed versions in Atlassian's advisory (for example Jira Software 9.12.40, 10.3.26 or 11.3.12, Confluence 9.2.26 or 10.2.19, Bitbucket 9.4.26, 10.2.8 or 10.5.1).
Atlassian says to take internet-facing instances off the public internet or apply its web application firewall rule until you can patch.
Because CISA confirms exploitation, a patch alone doesn't undo any file reads that already happened; secrets stored in readable files may need to be changed.
Atlassian says its Cloud products are patched and Cloud customers don't need to do anything.
Technical details
Atlassian's advisory for CVE-2026-21589 says an unauthenticated attacker can read specific files inside the web application root directory of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye, if they know the file's exact name and path. Atlassian rates it Critical (CVSS 4.0 9.3), lists fixed versions for each product and says its Cloud products are patched with no evidence of exploitation there. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 15 October 2026.
affected
Atlassian Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, Crucible and Fisheye (all versions before the listed fix versions)
BIND is the software many organisations use to run DNS servers, the internet's address book that turns website names into numbers. Its maker, ISC, fixed four serious bugs on 21 October. The worst could let an attacker corrupt the server's memory and possibly run their own code; the other three can crash the server or overload it. ISC says it is not aware of any attacks, so active exploitation is not confirmed.
What this means
If you run BIND 9, ISC says to upgrade to 9.20.30 or 9.21.27 (or 9.20.30-S1 for the Supported Preview Edition); ISC lists no workarounds for any of the four flaws.
ISC's advisory says CVE-2026-94300 involves GSS-TSIG, the signing method used for secure dynamic DNS updates (common with Active Directory), so servers using it should be patched first.
The other three flaws can make a BIND server crash or run out of resources, which would stop name lookups for the people and systems relying on it.
ISC says it is not aware of any active exploits.
Technical details
ISC disclosed four BIND 9 vulnerabilities on 21 October 2026, all rated High. CVE-2026-94300 (CVSS 3.1 8.1) lets an attacker who captured a GSS-TSIG signed UDP message replay it while the TSIG key is still valid and, combined with crafted queries to a zone the attacker controls, corrupt memory in named, potentially leading to remote code execution. CVE-2026-19630 (resolver CPU/memory exhaustion), CVE-2026-96888 (assertion failure with a redirect zone plus strict QNAME minimisation) and CVE-2026-97313 (assertion failure with certain RPZ configurations) are denial-of-service bugs rated 7.5; ISC lists no workarounds and says it is not aware of active exploits.
affected
ISC BIND 9 DNS server 9.11.0 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26 (plus Supported Preview Edition -S1 builds); fixed in 9.20.30, 9.21.27 and 9.20.30-S1
YOOtheme Pro, a popular theme and page builder used to design Joomla and WordPress websites, had a serious flaw in how it resizes images. An attacker with no login could abuse it to plant their own code on the website and take it over. YOOtheme fixed it in version 5.0.53 on 21 October. The official record's score marks it as attacked, but no details of real-world attacks have been published, so active exploitation is not confirmed.
What this means
If your site runs YOOtheme Pro 5.0.0 to 5.0.52, update to 5.0.53, which YOOtheme's changelog lists as the fix for CVE-2026-102785.
The NVD record says the attack needs no login and only a public image URL from your site, so any site on an affected version is exposed until it is updated.
Updating stops new attacks but does not remove files already planted; site owners may want to check public media folders for unexpected PHP or image files.
YOOtheme hasn't said whether the flaw has been used in real attacks.
Technical details
According to the NVD record, YOOtheme Pro 5.0.0 to 5.0.52 has a publicly accessible image transformation handler that does not fully bind image operations and the output location to its request signature. An unauthenticated attacker can reuse a signature from a legitimate public image URL, inject extra operations, traverse out of the cache directory and write a PNG/PHP polyglot file into an executable public media directory, leading to remote code execution (CWE-434). YOOtheme's changelog lists the fix in 5.0.53, released 21 October 2026; the CNA's CVSS 4.0 vector rates it 10.0 and sets exploit maturity to Attacked, but no exploitation details have been published by YOOtheme.
affected
YOOtheme Pro 5.0.0 to 5.0.52 (website builder theme for Joomla and WordPress; fixed in 5.0.53)
Amagi Media Labs, a Bengaluru-based company whose cloud software helps TV channels and streaming services run and deliver their broadcasts, says a criminal is trying to extort it. The attacker claims to have stolen technical data about how some of Amagi's systems and networks are set up and threatens to publish it unless paid. Amagi confirms the extortion attempt but says it is still checking whether the data theft claim is real; it says its services have not been disrupted.
What this means
Amagi says it is still validating the attacker's claim and working out which systems and data are involved and whether any customers are affected.
The company says there has been no disruption to its services and no evidence so far of impact on customer operations; it has notified the relevant authorities.
Amagi hasn't said how the attacker got in; it says it has added extra security measures as a precaution and will tell the exchanges about any material developments.
Leaked network configuration details can help attackers plan later break-ins, so Amagi customers may want to watch for updates from the company.
Technical details
In a Regulation 30 disclosure to BSE and NSE dated 22 October 2026, Amagi Media Labs says it has become aware of an extortion attempt by a threat actor who claims to have obtained operational and network configuration data relating to certain of its systems and threatens to publish it unless paid. The company says it is validating the claim, including samples shared by the actor, is investigating with external cyber security experts and legal counsel to determine the systems, data and any customers involved, and has notified the relevant authorities. It reports no disruption to its services and no evidence of impact on customer operations so far, has added precautionary security measures, and does not expect a material financial impact at this stage.
affected
Amagi Media Labs (operational and network configuration data relating to certain company systems, per the attacker's claim)
VeloCloud Orchestrator is the central management system companies use to control their SD-WAN, the equipment that links branch offices to each other and to the cloud. Arista says a flaw lets anyone with even a basic login take over full administrator powers on self-hosted (on-prem) installations, and that attackers are already using it. Arista has released fixed versions and says its own hosted service is already patched.
What this means
If you run VeloCloud Orchestrator on-prem, upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, as Arista's advisory says; Arista says no configuration prevents the exposure.
Arista lists attacker IP addresses 74.82.197.86 and 38.54.50.151 and advises blocking them and checking VCO logs for them.
Until patched, Arista advises restricting access to the VCO web interface to trusted admin networks and watching for unexpected outbound traffic, admin changes, backdoor daemons and webshells.
Patching does not undo an existing compromise; Arista advises preserving logs before remediation if compromise is suspected, and CISA added the flaw to its Known Exploited Vulnerabilities list on 23 October 2026 with a 26 October deadline for US federal agencies.
Technical details
Arista published Security Advisory 0199 on 22 October 2026 for CVE-2026-114625, an SQL injection flaw (CWE-89) in on-premises VeloCloud Orchestrator (VCO) that lets any authenticated user, down to the lowest built-in Enterprise Read Only role, gain operator privileges and masquerade as a local superuser operator. Arista says the issue was detected by Arista and is known to be actively exploited; hosted and dedicated VCO were also impacted and have already been patched. Arista rates it CVSS 3.1 9.9 and CVSS 4.0 9.4, and lists fixes in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on 23 October 2026 with a remediation due date of 26 October 2026.
affected
Arista VeloCloud Orchestrator On-Prem (VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12)
Burger King's operator in Japan says hackers got into the system holding its app members' details in early October and took information from about 11.18 million member records, including names, email addresses, phone numbers and birth dates. The company says credit card numbers weren't stored there and it hasn't found that passwords were taken. The breach is confirmed by the company.
What this means
BK Japan warns members to watch for fake emails, text messages and calls pretending to be from Burger King, and not to open links or attachments or enter member details or passwords in response.
The company says it will email affected members in turn; it has not said how the attackers got in, and the cause is still under investigation.
BK Japan says it has seen no misuse of the leaked data so far, and credit card numbers were not exposed because it does not hold them.
Technical details
BK Japan, which runs Burger King in Japan, said on 15 October 2026 that a third party accessed the system that manages its official app's member information between 2 and 7 October, and that it confirmed on 13 October that member data had leaked. About 11.18 million records were exposed, including member ID, email address, name (kanji and kana), date of birth, gender, phone number, prefecture, registration type, and whether the member had used mobile ordering or verified their email. The company says it does not hold credit card numbers, has not confirmed any leak of login passwords, has blocked the source of the access, reported the incident to Japan's Personal Information Protection Commission, and is investigating the cause with outside specialists.
affected
BK Japan (Burger King Japan official app members, about 11.18 million records)
TAKKT, a German company that sells business equipment such as packaging, industrial and restaurant supplies, says a cyber attack hit some of its computer systems in Europe and North America. It took some systems offline to limit the damage, so processing orders, customer service and deliveries are seriously slowed. Customers can still place orders, and the company says it doesn't yet know how much damage was done.
What this means
TAKKT says orders can still be placed online and through other channels, but their processing and delivery are restricted, so customers of its European Industrial & Packaging and North American Foodservices businesses should expect delays.
TAKKT has not said when systems will be fully back, whether any data was taken, or who was behind the attack.
Customers may get scam emails or calls that use the incident as a pretext; check any change to payment or order details with TAKKT through contact details you already have.
Technical details
In an ad-hoc disclosure under Article 17 of the EU Market Abuse Regulation on 21 October 2026, TAKKT AG said it was the target of a cyber attack on parts of its IT systems, affecting its Industrial & Packaging division in Europe and its Foodservices division in North America. Systems were partly taken offline as a precaution, and order processing, customer service and deliveries are significantly restricted, although orders can still be placed via the online shop and other channels. TAKKT says it cannot yet assess whether damage occurred, its extent, or when systems will be fully operational, and a task force is working with external cybersecurity and IT forensic specialists.
affected
TAKKT AG (Industrial & Packaging division in Europe, Foodservices division in North America)
TeamUpdraft, the company behind the popular UpdraftPlus backup plugin for WordPress websites, confirmed that attackers broke into its website and likely took its customer database, including the keys its UpdraftCentral service uses to remotely manage customers' sites. The company says attackers then used those keys to add hidden admin accounts and malicious plugins to some connected WordPress sites. How many sites were hit is not known.
What this means
TeamUpdraft says to make sure every site runs UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later, which disconnects old UpdraftCentral keys, and to delete the UpdraftCentral connection key from each site's own dashboard.
TeamUpdraft urges UpdraftPlus Premium users to check sites for unknown administrator accounts and unexpected plugins, including the Must-Use tab, even if they never used UpdraftCentral; updating the plugin does not remove a backdoor that was already installed.
Everyone with a teamupdraft.com account should change that password, and anywhere it was reused, and reset two-factor login; TeamUpdraft says it stores no card details and will never ask for passwords or keys by email.
TeamUpdraft says the number of sites accessed through UpdraftCentral is unknown and its investigation is ongoing.
Technical details
TeamUpdraft, maker of the UpdraftPlus WordPress backup plugin, says it identified unauthorized access to teamupdraft.com over the weekend of 17-18 October and believes its customer database was accessed, including names, email and billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says the attacker used the connection to customers' sites to create admin accounts and install malicious plugins, with the extent unknown. UpdraftPlus 1.26.13 and 2.26.13, published on 19 October, revoke UpdraftCentral connection keys; the company says the plugin and its downloads were not affected, self-hosted UpdraftCentral is not affected, and it has reported the incident to the UK ICO and police.
affected
TeamUpdraft (teamupdraft.com customers; WordPress sites connected to UpdraftCentral cloud via UpdraftPlus)
Signal, the private messaging app, had a flaw in the part that handles voice and video calls. A caller could flood the call with data so that pressing hang-up did not actually end it, possibly keeping your microphone or camera connected. It is fixed in newer versions of Signal's calling library; active exploitation is not confirmed.
What this means
Update Signal on every device to the latest version from your app store or signal.org; the NVD record says RingRTC 2.72.0 and later fix the issue.
According to the NVD record, the attacker has to be the other party on a call with you, so the risk is from calls with people you don't trust.
The NVD record does not say the flaw has been exploited in the wild, and Signal has not published its own advisory about it.
Technical details
According to the NVD record for CVE-2026-113380, in Signal's RingRTC calling library before 2.72.0 a call peer that saturates the call's finite-state-machine queue can interfere with a local hang-up tearing the call down, along with its audio and perhaps video track. The record scores it 9.3 under CVSS 4.0 and references the fix in RingRTC 2.72.0.
affected
Signal RingRTC calling library before 2.72.0 (used by Signal Android, iOS and Desktop)
Laravel, a popular toolkit for building PHP websites and web apps, has a serious login flaw. In apps that use its built-in token login for APIs (the way other programs connect to a web app) with a MySQL or MariaDB database, an attacker could log in as another user without their key. Fixes are out; active exploitation is not confirmed.
What this means
If your app uses laravel/framework with the built-in token API guard, update to 13.29.0 or 12.68.0 or later, the fixed versions listed in Laravel's advisory.
According to the advisory, the risk applies to the standard token-based API guard under certain MySQL or MariaDB configurations; apps that don't use that guard are not described as affected.
Laravel's advisory lists fixes only for the 12.x and 13.x lines, so apps on older versions need to move to a fixed release.
Italy's national CSIRT says a proof-of-concept exploit is public, which usually makes attacks easier; neither Laravel nor the NVD record says it has been exploited in the wild.
Technical details
Laravel's security advisory GHSA-f9x3-7vq9-cph6 (CVE-2026-114509) says the built-in TokenGuard, when configured as a standard token-based API guard, does not reject a crafted non-string credential. Under certain MySQL or MariaDB configurations the authentication lookup can match an unintended existing user, letting an unauthenticated attacker authenticate as that user and take over the account on routes protected by the guard. The advisory lists laravel/framework 13.29.0 and 12.68.0 as fixed versions.
affected
Laravel framework (laravel/framework) before 12.68.0 and 13.x before 13.29.0, apps using the built-in token API guard with MySQL/MariaDB
Fisher & Paykel Healthcare, a New Zealand maker of breathing-support and sleep-apnea medical equipment, says someone broke into two employee email accounts and some company files. Some of those files held personal information, and the company is contacting the people affected. The company confirms the incident and says its products, factories and patient-data system were not affected.
What this means
Fisher & Paykel Healthcare says it is notifying people whose personal information was in the accessed files; it hasn't said how many people that is or which details were involved.
The company says there is no evidence its system that holds patient data was compromised, and that supply of its products to customers and patients continues uninterrupted.
The company says it found no ransomware or malware and believes the incident is contained; it hasn't said how the attackers got into the email accounts.
Data taken from email accounts is often reused in convincing scam emails, so be wary of unexpected messages that appear to come from the company or its staff.
Technical details
In a statement to the NZX and ASX dated 22 October 2026, Fisher & Paykel Healthcare says it became aware of unauthorised and unlawful access to two employee email accounts and a subset of company files. Some of the accessed files contained personally identifiable information; the company is notifying those affected and has notified relevant authorities. It says there was no impact to products, manufacturing or supply chain, no evidence that its patient-data system was compromised, no evidence of ransomware or malware, and that it believes the incident is contained.
affected
Fisher & Paykel Healthcare (two employee email accounts and a subset of company files)
PingCAP, the company behind the TiDB database and its TiDB Cloud hosting service, says attackers used stolen login credentials for about a month to copy customer account details, business and billing records, and some of its source code. PingCAP confirms the breach but says it has found no evidence that the data customers store in their databases was touched.
What this means
PingCAP recommends that TiDB Cloud organization owners replace their active management API keys now as a precaution, update the apps that use them, and then revoke the old keys.
If you suspect a key is being misused, PingCAP says to revoke it immediately and contact security@pingcap.com.
PingCAP warns of targeted phishing because exported records included customer contacts and billing details; verify any unexpected request about passwords, codes or payment changes through a channel you already trust.
PingCAP says it is still working out which customers had which data exposed and will notify affected customers directly.
Technical details
PingCAP, maker of the TiDB database and TiDB Cloud, says that between 9 September and 7 October 2026 an unauthorized party used stolen service-account credentials to access certain internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names and email addresses, organization/project associations, SQL editor text and errors, customer contacts, contract, order, pricing and billing configuration data, and a table of encrypted TiDB Cloud API-key values. PingCAP says an external firm found no evidence the attacker ran commands or kept persistent access in the production systems reviewed and no evidence that data stored in TiDB was impacted; all identified compromised credentials were invalidated and four vulnerabilities fixed by 14 October.
Quest Diagnostics, one of the largest US medical lab-testing companies, says someone got unauthorized access to Quanum LSM, a system its clients (such as doctors' offices) use to order lab tests and look up results. Quest confirms the incident and believes some patient records were accessed, but it hasn't said how many people or what details are involved.
What this means
Quest says it believes an unauthorized party accessed certain patient records through Quanum LSM; it hasn't said how many patients are affected or which details were in those records.
Quest hasn't said how the attackers got in; it says it has notified federal law enforcement and brought in outside cybersecurity experts, and the investigation is ongoing.
Quest says the incident has not materially disrupted its business or its ability to serve patients, so lab testing continues.
Leaked health details are often used in targeted scam calls and emails, so be wary of unexpected messages about lab results or bills and contact Quest or your doctor through a number you already know.
Technical details
In an SEC Form 8-K (Item 8.01) filed 22 October 2026, Quest Diagnostics says it learned on 21 October 2026 of unauthorized access to its Quanum LSM system, which certain clients use to place test orders and receive and look up results. Quest says it activated its incident response procedures, notified federal law enforcement and engaged external cybersecurity experts. The full scope is still under investigation, but the company believes an unauthorized party accessed certain patient records; it says the incident has not materially disrupted its operations.
affected
Quest Diagnostics Quanum LSM (client system for placing lab test orders and receiving/looking up results); certain patient records
Node.js, the software that runs JavaScript on millions of web servers and developer tools, has released security updates fixing 10 problems. The worst lets an attacker who sends specially compressed data run their own code on the server, and two others can let a fake website certificate be accepted. Updates are out; active exploitation is not confirmed.
What this means
If you run Node.js 22.x, 24.x or 26.x, update to v22.23.4, v24.22.1 or v26.12.1, which the Node.js project says fix these issues.
The Node.js project says end-of-life versions are always affected when a security release happens and get no fix, so anything older than 22.x should be moved to a supported line.
Node.js is often bundled inside other software, containers and desktop tools, so check those too, not only the node binary installed on your servers.
The Node.js advisory rates the highest issue as high and does not say any of these flaws have been exploited in the wild.
Technical details
On 21 October 2026 the Node.js project released v26.12.1, v24.22.1 and v22.23.4 to fix 10 vulnerabilities, four rated high. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that the project says permits remote code execution; the other high-severity issues are a dns.resolve NUL-character truncation (CVE-2026-105482) and two TLS certificate hostname bypasses (CVE-2026-105483, CVE-2026-106069). The releases also update bundled dependencies including c-ares, OpenSSL, SQLite, Undici and the CA certificate store for the eMudhra intermediate CA compromise.
affected
Node.js 26.x, 24.x and 22.x before v26.12.1, v24.22.1 and v22.23.4 (and all end-of-life versions)
Capcom, the company behind Monster Hunter and Resident Evil, says hackers got into CAPCOM ID, the shared account people use for its online games and websites. About 11.77 million email addresses and basic login details leaked, and 196 accounts had their passwords changed by the attackers. Capcom confirms the breach and says credit card details were not exposed.
What this means
If you have a CAPCOM ID, Capcom says your email address and account details such as creation date, last login time and last-login IP address may have leaked; it says it will contact affected customers individually.
Capcom warns that the leaked details may be used to send fake emails pretending to be Capcom or its partners, so don't open links or attachments in unexpected messages about your account.
Capcom says it has reset the passwords of the 196 accounts that were changed by the attackers, found no leak of passwords set by users, and says credit card information was not included.
Capcom hasn't said how the attackers got in; it says it has finished emergency fixes, CAPCOM ID services and games keep working, and the investigation continues.
Technical details
Capcom says a third party gained unauthorized access to its CAPCOM ID online membership service, leaking 11,774,247 email addresses worldwide together with system identifiers (account creation time, last login time, login count and last-login client IP). For 43 of those accounts, date of birth, gender, country/region and nickname also leaked, and 196 accounts had their login password changed without authorization; Capcom says it has not confirmed any leak of user-set passwords and credit card information was not involved. Capcom found traces of suspicious access on 19 October 2026, confirmed the leak on 20 October and reported it to police and Japan's Personal Information Protection Commission on 21 October.
affected
Capcom CAPCOM ID (online membership account service), 11,774,247 accounts worldwide
Crime Stoppers lets people report crimes anonymously. Toronto Crime Stoppers says hackers stole more than 176,000 tips from the company that runs its tip software back in March, and those tips include about 15,000 names. It is not yet known whether the names belong to the people who sent tips, the people named in them, or both. Tip lines are paused.
What this means
Toronto Crime Stoppers is not accepting tips by phone, online or through the app for now; Toronto Police says people with information can contact the police directly, though that is not anonymous.
It hasn't been said whether the leaked names belong to tipsters, people named in tips, or both.
If you sent a tip to Toronto Crime Stoppers between 2022 and 2025, watch for official updates from Toronto Crime Stoppers and Toronto Police about who is affected.
Technical details
Toronto Crime Stoppers said on 21 October 2026 that hackers stole data in March from P3, the tip software it uses, including 176,859 tips submitted between 2022 and 2025 that contain 14,973 names. It has stopped accepting tips by phone, online or app. The Toronto Police Service said the same day that it has temporarily suspended its use of Crime Stoppers while it reviews the information about the third-party provider's breach.
affected
Toronto Crime Stoppers (P3 tip software operated by Navigate360); tips submitted 2022-2025
OVHcloud, a French cloud provider, says an attacker used a staff developer's hijacked GitHub account to swap the downloads of its command-line tool (a program admins use to manage their cloud services) for malware that hunts for passwords and keys. The bad files were up for about an hour and a half on 19 October and were downloaded about 250 times. OVHcloud has confirmed it and removed them.
What this means
Only people who installed or updated the OVHcloud CLI on 19 October 2026 between 14:47 and 16:21 (UTC+2) are affected, according to OVHcloud; earlier downloads of the same versions are not.
OVHcloud says to check whether you are affected by comparing your binary's hash with the list in its advisory, without running the binary, and to look for a temp folder named envchecker-xxxx.
If you were affected, treat every secret on that machine as exposed: change them, remove the tool and install v0.16.0, which OVHcloud says is clean.
Changing leaked keys stops future misuse but does not undo anything already done with them, so also review account activity.
Technical details
OVHcloud's GitHub advisory GHSA-862f-55f5-vmvw says a compromised OVHcloud developer GitHub account was used on 19 October 2026 to replace the release assets of ovhcloud-cli v0.11.0 to v0.15.0 with malicious binaries between 14:47 and 16:21 (UTC+2). OVHcloud says the source code and build chain were not affected, the malicious files were available for 1h33 and downloaded about 250 times, and the repository lacked release immutability, which it has now enabled. Versions v0.10.0 and earlier and v0.16.0 and later are not affected.
Zeabur is a service developers use to host their apps online. The company confirmed that an attacker got into its systems on 14-15 October and read customers' stored app settings, including passwords and access keys, plus details of 321,810 accounts. It was Zeabur's second incident since August, and the company has announced it is shutting down by 31 December.
What this means
Zeabur tells users to replace every password and key stored on Zeabur, even if they already replaced them after the August incident.
If you use zSend, create new API keys; Zeabur says the exposed zSend keys have been revoked. Google Cloud dedicated server users should change the root password and remove SSH keys they don't recognize, especially any labeled zeabur-pentest.
Zeabur is shutting down: services start pausing or expiring from 1 December 2026 and everything stops by 31 December, so move your apps and data off before then.
Zeabur says it is accepting compensation requests through support for losses caused by the incident, such as extra charges from third-party services.
Technical details
Cloud deployment platform Zeabur says that on 14-15 October 2026 (UTC) an attacker used leaked Zeabur internal credentials to access its shared cluster, some GCP Dedicated Servers and internal systems, and read the platform database. Its preliminary report lists 3,218,965 service environment-variable records, 321,810 account records and 566 plaintext zSend API keys as confirmed exposed, and says the root cause was long-lived admin credentials stored in plaintext and usable from the internet. Zeabur has revoked the credentials, signed out all users, revoked all platform Access Tokens, and separately announced it will shut down, with all dedicated servers and shared clusters stopping by 31 December 2026.
Onamae.com Desktop Cloud is a Japanese rental computer service from GMO Internet, popular for running automatic currency-trading programs. GMO now confirms attackers broke in and took customer information, and some customers saw trades in their accounts that they didn't make. GMO is paying every customer 5,000 yen, will cover confirmed losses from those fake trades, and says it won't pay the attackers' ransom demand.
What this means
GMO says every current Desktop Cloud customer gets 5,000 yen, and it will email payment details by 30 October 2026 23:59 JST.
If you see trades you didn't make, GMO says it will cover realized losses from trades it confirms as unauthorized, and asks you to also contact the broker or exchange about cancelling them; application details are due by 6 November.
GMO says the old platform won't restart; customers will be offered a separate replacement service free for six months, and nothing is moved without their consent.
GMO says the attacker threatened to publish customer and PC information and that anything posted may be inaccurate; change any passwords that were kept on or used from the servers, and expect phishing.
Technical details
GMO Internet says a third party gained unauthorized access to Onamae.com Desktop Cloud, its Windows VPS service; it confirmed on 20 October that a malicious program had been installed in some customers' server environments and began shutting down servers on all plans from 21 October 4:00 JST. In a 24 October disclosure, parent GMO Internet Group says the investigation confirmed a security problem in the service's systems and that customer information was taken out, and that some customers have reported trades they did not make in their trading accounts. GMO says it will pay every current customer 5,000 yen, compensate realized losses from trades it confirms were unauthorized, move customers to a separate replacement service free for six months rather than restart the old platform, and refuse a ransom demand from the apparent attacker, who threatened to keep tampering with trading accounts and to publish information.
affected
GMO Internet (Onamae.com Desktop Cloud VPS service, Japan)
Cisco Expressway is equipment companies use so staff and partners can join video calls and phone systems from outside the office network. Cisco found a serious flaw that could let an attacker take full control of these devices when they are set up in a group (cluster). Cisco has released a fix and says it is not aware of the flaw being used in attacks, so exploitation is not confirmed.
What this means
If you run clustered Cisco Expressway-C or Expressway-E on X15.5.3 or earlier, upgrade to X15.5.20, as Cisco's advisory says; X14 and earlier need to migrate to a fixed release.
Cisco says there are no workarounds, so updating is the only fix.
Cisco says its security team is not aware of public announcements or malicious use of this flaw at the time of publication.
Technical details
Cisco disclosed CVE-2026-76466 on 21 October 2026, a flaw in the database service of Cisco Expressway-C and Expressway-E (virtual and appliance) that could let an unauthenticated remote attacker with network access run operating-system commands as root. It stems from persistent cookies and from client certificates not being validated for clustering when TLS Verify Mode is enabled, and affects devices configured in a cluster. Cisco rates it CVSS 3.1 9.8, says there are no workarounds, and lists X15.5.20 as the fix for X15.5.3 and earlier; X14 and earlier must migrate to a fixed release.
affected
Cisco Expressway-C and Expressway-E (clustered; X15.5.3 and earlier, X14 and earlier)
Oracle has put out an emergency fix for Java, the software platform that runs many business and web applications. The flaw is in the part of Java that handles secure (encrypted) connections, and Oracle says attackers could use it over a network without needing a password. Oracle's alert does not say it is being exploited; active exploitation is not confirmed.
What this means
If you run Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 or 27.0.1, Oracle GraalVM for JDK 17.0.21 or 21.0.13, or GraalVM Enterprise Edition 21.3.20, apply the patch listed in Oracle's Security Alert.
Oracle says server software that passes data to the affected APIs, for example through a web service, can be attacked, as can sandboxed Java clients that run untrusted code.
Oracle says unsupported older releases are not tested but are likely also affected, and recommends upgrading to supported versions.
Oracle has not said whether the flaw has been exploited or who reported it.
Technical details
Oracle issued Security Alert CVE-2026-91403 on 21 October 2026, outside its regular patch schedule, for a flaw in the JSSE (TLS) component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. Oracle scores it CVSS 3.1 9.1 and says it is remotely exploitable without authentication over the network, with high impact to confidentiality and integrity. Affected supported versions include Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20.
affected
Oracle Java SE (8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1), Oracle GraalVM for JDK (17.0.21, 21.0.13), GraalVM Enterprise Edition 21.3.20
Railway is a cloud service where developers host their apps. The company says that on 21 October an outsider may have reached the stored settings of customers' apps, including secret passwords and access keys, and in some cases read them. Railway has confirmed the incident and says it may affect only some users, but it is telling everyone to change their keys.
What this means
Railway recommends that all users immediately change (rotate) every environment variable and API key stored in Railway, as well as any private registry credentials, and review logs for those services for unusual activity.
Railway has paused all deployments while it investigates, so new versions of apps cannot be rolled out until builds are restored.
Railway says it will email the customers it confirms were affected; it has not yet said how many accounts are involved.
Changing a leaked key stops future misuse but does not undo anything an attacker already did with it, which is why the log review matters.
Technical details
Railway detected anomalous activity on 21 October involving systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents, which can include API keys and database and registry credentials. Railway paused all deployments, has asked upstream AI inference providers to revoke keys, and recommends that all users rotate every variable and review logs.
Pillow, a widely used Python library that programs use to open and edit pictures, has a serious flaw. A specially crafted image file in certain formats can crash a program that opens it and, in some setups, let an attacker run commands. A fix is out in version 13.0.0; active exploitation is not confirmed.
What this means
If you use Pillow 11.0.0 or later but older than 13.0.0, upgrade to 13.0.0, which the NVD record says fixes the issue.
According to the NVD record, the risk comes from crafted PSD, MPO, DCX or MIC image files, so services that open images uploaded by users are the most exposed.
Pillow is often installed as a dependency of other Python software, so check your installed packages and container images, not only code that imports it directly.
The NVD record does not say the flaw has been exploited in the wild.
Technical details
CVE-2026-96639 affects the Python imaging library Pillow from 11.0.0 until 13.0.0. According to the NVD record, multi-frame image loaders can reuse a stale native memory allocation when a later frame changes to a wider pixel mode, so crafted PSD, MPO, DCX or MIC files can cause out-of-bounds writes and crashes; the MPO path can also cause an over-read and, in demonstrated runtime-specific profiles, command execution. The issue is fixed in Pillow 13.0.0.
GitLab, a widely used tool companies run to store and manage their software code, has fixed a critical flaw that could let an attacker with no account run their own commands on a company's GitLab server. It affects self-hosted GitLab going back to version 7.0. GitLab's advisory does not say it is being exploited; active exploitation is not confirmed.
What this means
If you run self-managed GitLab CE or EE, GitLab says to upgrade immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, matching your version line.
Servers updated in GitLab's 12 October patch release are still affected unless they are on one of the new versions listed in GitLab's advisory.
GitLab says GitLab.com is already patched and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action; it has not said whether the flaw has been exploited and lists no workaround.
Ruby says other Ruby applications that build regular expressions from untrusted input (for example with Regexp.new or /#{input}/) should upgrade to Ruby 4.0.9, 3.4.12 or 3.3.13; Regexp.timeout and pattern length limits do not protect against these bugs.
Technical details
GitLab released a critical patch on 21 October 2026 fixing CVE-2026-110264, an integer overflow when compiling a specially crafted regular expression that, under certain conditions, could let an unauthenticated user execute arbitrary code on a GitLab server. GitLab scores it CVSS 3.1 10.0 and says it affects GitLab CE/EE from 7.0 up to the fixed releases 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. GitLab.com is already patched, and GitLab also published two threat detections for self-managed customers. On 23 October 2026 the Ruby project released Ruby 4.0.9, 3.4.12 and 3.3.13, which fix the underlying bugs in Ruby's regular expression engine (Onigmo) behind this CVE and GitLab's earlier CVE-2026-89078, CVE-2026-93577 and CVE-2026-97229; Ruby says other applications are affected only if they compile regular expressions from attacker-controlled strings.
affected
GitLab CE/EE self-managed, all versions from 7.0 before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1
Cisco has fixed a batch of serious security flaws in its business phone and voicemail systems, such as Unified Communications Manager, the software that runs many companies' office phone networks. Cisco found the flaws itself, and the worst are rated 9.8 out of 10. Cisco says it is not aware of anyone exploiting them; active exploitation is not confirmed.
What this means
If you run Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, Emergency Responder or Prime Collaboration Deployment release 15, Cisco says to upgrade to 15SU5.
Cisco lists release 14 as needing a migration to a fixed release, and says there are no workarounds.
Cisco groups many flaws under each CVE ID and has not published details of the individual bugs, so the exact attack paths aren't public.
Technical details
Cisco published a security hardening release on 21 October 2026 for Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, covering vulnerabilities found in an internal review and grouped by weakness class into eight CVE IDs. The two highest, CVE-2026-76473 (CWE-74) and CVE-2026-76474 (improper authentication, CWE-287), carry a Cisco CVSS 3.1 score of 9.8, which Cisco says represents the most severe underlying flaw in each group. Release 15 is fixed in 15SU5, release 14 customers must migrate to a fixed release, there are no workarounds, and Cisco PSIRT is not aware of public announcements or malicious use.
affected
Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection releases 14 and 15 before 15SU5
ConnectWise, a company whose tools IT providers use to back up their clients' Microsoft 365 email and files, says attackers got hold of the login credentials its backup app uses to connect to those Microsoft 365 accounts. ConnectWise has confirmed the unauthorized access and switched off its Cloud Backup, SaaS Security and Cloud Management services while it fixes things. It says stored backups show no sign of being touched.
What this means
ConnectWise says each partner and customer Microsoft 365 tenant still needs its own review for unauthorized changes or lingering access, using its technical investigation and remediation guide.
ConnectWise says to keep the affected ConnectWise and SkyKick app connections disabled until it publishes formal reconnection instructions; disabling them does not undo changes already made inside a tenant.
Scheduled backups, restores, SaaS Security alerts and Cloud Management stay unavailable during the phased restoration, which ConnectWise expects to take several days, so organisations have a gap in backup coverage.
Microsoft says customers should review service principal sign-ins and investigate unexpected application credential or privilege changes while preserving evidence; neither company has said how many tenants had data accessed, and Microsoft notes a successful sign-in by the attacker does not by itself mean data was taken.
Technical details
ConnectWise says it identified unauthorized access to application identities and credentials associated with Cloud Backup, formerly SkyKick, which customers connect to their Microsoft 365 tenants. On 17 October it disabled seven ConnectWise application identities, revoked the shared Cloud Backup credentials and suspended Cloud Backup, SaaS Security and Cloud Management; as of its 22 October 00:45 UTC update, phased restoration is underway and expected to take several days. ConnectWise says existing backup archives remain encrypted and isolated with no indication of compromise, and in its 21 October update says that, based on evidence including threat intelligence shared by Microsoft, it appears a China state-aligned group was responsible. Microsoft Threat Intelligence says on 21 October that it assesses the China-state aligned actor Storm-0940 was responsible, using the agentic AI penetration testing framework ARTEX to authenticate to Microsoft 365 tenants through the compromised application without an interactive user sign-in, followed in multiple environments by Microsoft Graph reconnaissance, application credential changes and attempts to modify privileges; Microsoft says successful authentication does not necessarily mean customer data was accessed or exfiltrated.
affected
ConnectWise Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management; partner and customer Microsoft 365 tenants that consented to its apps
Splunk, a company whose software many organisations use to collect and search their security and IT logs, has fixed a batch of serious flaws it found itself in Splunk Enterprise and Splunk SOAR (its tool for automating security responses). The worst are rated 9.9 out of 10. Splunk's advisories don't say anyone is exploiting them; active exploitation is not confirmed.
What this means
If you run Splunk Enterprise 10.4, 10.2, 10.0 or 9.4, Splunk says to upgrade to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 or higher.
If you run Splunk SOAR, Splunk says to upgrade to version 8.7.0 or higher.
Splunk groups many findings under each CVE ID and has not published details of the individual bugs, so the exact attack paths aren't public.
Technical details
Splunk published two security hardening advisories on 21 October 2026 covering internally identified vulnerabilities, grouped by weakness class with one CVE ID per group and scored by the highest CVSS 3.1 finding in each group. SVD-2026-1008 covers Splunk Enterprise 10.4.0-10.4.3, 10.2.0-10.2.7, 10.0.0-10.0.10 and 9.4.0-9.4.15, including CVE-2026-76299 (improper access control, CWE-284) and CVE-2026-76302 (improper neutralization, CWE-707), both 9.9; fixes are in 10.4.4, 10.2.8, 10.0.11 and 9.4.16. SVD-2026-1011 covers Splunk SOAR below 8.7.0, including CVE-2026-76531 (files or directories accessible to external parties, CWE-552) at 9.9, fixed in 8.7.0.
NAVI, a well-known esports team, says a hacker copied order records from its online merch store, NAVI Shop, covering orders from 2020 to late August 2026. The stolen details include emails, phone numbers and order information, but not card numbers or passwords. NAVI confirms the breach; it found out when the data was put up for sale online.
What this means
If you ordered from shop.navi.gg between 2020 and the end of August 2026, NAVI says your email, phone number, delivery city and order details may be in the stolen data, and possibly your name.
NAVI says card details and passwords were not affected, so there is no need to change your password or replace your card.
Expect scam emails or texts pretending to be NAVI Shop or a delivery company; NAVI says it will never ask you to pay extra via a link or enter card details or an SMS code, and asks people to forward such messages to data.hotline@navi-gaming.com.
NAVI hasn't said how many customers are affected or named the analytics software involved; it says it fixed the vulnerability and will notify data protection authorities.
Technical details
Esports organization NAVI (Natus Vincere) says an attacker exploited a vulnerability in third-party sales-analytics software used by NAVI Shop in late August 2026 and copied the store's order table for 2020-2026. NAVI learned of it on 19 October when the data appeared for sale online. Confirmed exposed fields are email, phone number, delivery country and city, order number, date and amount, payment and delivery method, and promo code; NAVI cannot rule out names and order contents.
affected
NAVI (Natus Vincere) NAVI Shop customers, shop.navi.gg orders 2020 to August 2026
Bullhorn makes software that recruiting and staffing agencies use to track job candidates and placements. On 17 October it found a cyberattack on its platform and shut off access to contain it, which caused a widespread outage. Bullhorn has confirmed the incident; its status page does not say whether customer data was taken.
What this means
Bullhorn customers may be asked to set up multi-factor authentication (a second login step, such as a code on your phone) and change passwords; Bullhorn says the volume of these changes is causing slow or failed logins and password-reset loops for some users.
Bullhorn says it has taken Talent Platform, BBO and Target Recruit offline for a separate, unrelated reason: patching the critical PHP flaws disclosed on 21 October.
Bullhorn's status page does not say how the attackers got in or whether customer or candidate data was accessed.
Outages at a widely used vendor are a common lure for scammers, so treat unexpected calls or emails claiming to be Bullhorn support with care and never share passwords or login codes.
Technical details
Staffing and recruitment software company Bullhorn announced on 17 October 2026 that it had detected a cyber incident on the Bullhorn Platform and temporarily disabled access to its systems to contain it. In a 21 October status update, Bullhorn says the incident remains contained with no additional activity detected since its 17 October announcement, and that CrowdStrike and Kroll are monitoring its systems. Bullhorn says new security steps, including multi-factor authentication setup and password updates, caused separate login problems, and that some products are also offline for unrelated PHP patching.
affected
Bullhorn (staffing and recruitment software; Bullhorn Platform including ATS/CRM)
A testing company that runs California's statewide school exams, ETS, says someone used a stolen login to copy student records from a file-sharing server between May and September 2026. It covers students in California public schools over the past three school years, including names, birth dates, addresses and disability status. California's Department of Education has confirmed the breach and is sending notices to families.
What this means
ETS is offering two years of free Experian IdentityWorks identity protection; the notice says families must enroll by 19 March 2027, with separate options for students under 18 and for adults.
CDE says Social Security numbers, driver's license and passport numbers, financial and card details, passwords and parent or guardian information were not in the copied data.
The notice urges families to be cautious of unexpected emails, texts or calls and of fake identity-protection websites, since stolen personal details are often used in scams.
ETS says it has found no evidence so far that the data has been made public; the official notices do not give a total number of affected students.
Technical details
Educational Testing Service (ETS), the nonprofit that runs California's statewide student assessments (CAASPP and ELPAC) under state contract, identified unauthorized activity on 25 September 2026 on an SFTP site used to exchange assessment data with the California Department of Education (CDE). Its investigation found that an unauthorized party used a compromised login credential at various times from 22 May to 18 September 2026 to copy files with student information, including all students enrolled in the three previous school years. CDE says notices began going out on 16 October and will continue through early November; Social Security numbers, financial information, passwords and parent or guardian data were not involved.
affected
Educational Testing Service (ETS) SFTP site used for California statewide assessments; California public-school students enrolled in the three previous school years
Ivanti Connect Secure is a VPN gateway, the device employees use to connect to their company network from outside. A flaw in versions before 25.1.3.0 lets an attacker on the internet run commands on the device without a password. The US cybersecurity agency CISA confirms it is being exploited.
What this means
If you run Ivanti Connect Secure, update to 25.1.3.0 or later; according to the NVD record, version 22.7R2.14 and earlier are not affected.
Because exploitation is confirmed and CISA has flagged this flaw for forensic triage, admins should also check the device for signs of compromise, not just patch it.
Neither CISA nor the NVD record says how widely the flaw is being exploited; Ivanti's advisory has the vendor's full guidance.
Technical details
An authentication-bypass-by-spoofing flaw in Ivanti Connect Secure before 25.1.3.0 lets a remote, unauthenticated attacker run arbitrary commands. Version 22.7R2.14 and earlier are not affected. CISA added it to KEV on 13 October.
Palo Alto Networks makes widely used firewalls, the devices that guard company networks. A flaw in the firewall's admin web page lets an attacker who can reach that page and log in to it take complete control of the firewall. Palo Alto has released fixes and CISA confirms it is being exploited, though Palo Alto says it has seen only very limited attacks.
What this means
Update PAN-OS on PA-Series and VM-Series firewalls and Panorama to a fixed release listed in Palo Alto's advisory, such as 12.2.4 or later on the 12.2 branch.
Limit the management interface to trusted internal IP addresses or a single jump box; Palo Alto says the risk is highest when that interface is reachable from the internet.
Cloud NGFW and Prisma Access are not affected.
Technical details
A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. Palo Alto Networks says limiting management-interface access to trusted IPs greatly reduces the risk. CISA added it to KEV on 14 October.
Cisco Secure Email Gateway is a device companies use to filter incoming email for spam and malware. A flaw lets an outsider take full control of the device just by sending an email with a specially crafted attachment, if a malware-checking feature called file reputation is turned on. Cisco has released a fix, and the US cybersecurity agency CISA confirms it is being exploited.
What this means
Cisco says the fix is in Content Scanner Tools 25.3.0.5525 or later, which installs without a restart; appliances with automatic updates enabled receive it on their own.
Admins should run the check described in Cisco's advisory (search system_logs for "System Security") and contact Cisco TAC if it reports a compromise indicator; Cisco says there are no workarounds.
Cisco Secure Email Cloud Gateway customers don't need to act: Cisco says it has fixed the cloud service and contacted customers where it found malicious activity.
Because an attacker with full control can hide their tracks, Cisco advises also checking network and firewall logs for unusual traffic to or from the device.
Technical details
A path traversal bug in the Advanced Malware Protection feature of Cisco Secure Email Gateway lets an unauthenticated remote attacker write arbitrary files to the underlying OS with a crafted email attachment. It only applies when the file reputation service is enabled. CISA added it to KEV on 14 October.
BeyondTrust Remote Support is software that IT help desks use to control computers remotely. A flaw lets an attacker on the internet, without logging in, tamper with files on the server that runs it. BeyondTrust has released a fix, and the US cybersecurity agency CISA confirms the flaw is being exploited.
What this means
BeyondTrust says its cloud (SaaS) customers were patched on 9 October.
Self-hosted customers on version 26.2.3 or earlier should apply the BT26-05-RS patch if their appliance doesn't update automatically; anyone on a version older than 24.3.1 must upgrade first.
Mandiant says any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed, and that rebuilding is safer than cleaning.
Mandiant and CISA advise rotating every credential the appliance stored or brokered, but only after it has been patched or rebuilt.
Technical details
BeyondTrust Remote Support does not properly check where internal messages come from, which can let a remote attacker perform file operations on the appliance. BeyondTrust patched SaaS customers on 9 October, and self-hosted appliances need the BT26-05-RS patch (version 24.3.1 or later). CISA added the CVE to KEV on 16 October, and Google's Mandiant reports the flaw was exploited as a zero-day in late August 2026, with attackers gaining root, trying to dump the appliance's credential vault and deleting logs.
affected
BeyondTrust Remote Support (self-hosted, all versions <= 26.2.3; SaaS patched 9 Oct)
OpenCode, which makes an AI coding assistant, says its hosted Console service was breached on the night of 16 October. It says 1.4% of Console users were affected, all of them people who had connected outside AI providers. OpenCode confirmed the breach on its official X account and emailed those affected.
What this means
OpenCode says that if you did not get an email from it, you were not affected.
OpenCode hasn't publicly said what data was accessed.
If you were notified, a sensible precaution is to revoke and replace any AI provider API keys you saved in Console and check those provider accounts for usage you don't recognise.
Technical details
OpenCode says it had a security breach on the night of 16 October, which it links to a large-scale distillation attack, affecting 1.4% of OpenCode Console users. The affected users were a subset who had connected external AI providers. OpenCode emailed every affected user on 17 October and says users who got no email were not impacted. OpenCode's statement does not say what data was accessed.
Rank Math is a popular plugin that helps WordPress websites rank in search engines. For about 11 hours on 15-16 October, some downloads of its paid PRO version 3.0.123 contained malware that can take over a website once the plugin is turned on. The company confirms this; the free version from WordPress.org is not affected.
What this means
If you installed and activated Rank Math PRO 3.0.123 in that window, Rank Math says to treat your site as compromised and, ideally, restore it from a backup made before 15 October, 20:02 UTC.
Change every password and secret the site could reach, including WordPress, database, hosting, API and payment keys, even if you restored from a backup.
Then install the clean version 3.0.124 from your Rank Math account; if you only downloaded 3.0.123 and never installed it, Rank Math says there is no sign from this incident alone that your site was hacked.
Rank Math says it never sends login or download links by email, so treat such emails as suspicious.
Technical details
Rank Math says some Rank Math PRO 3.0.123 packages downloaded between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained malware that compromises the site once the plugin is activated. The malware can recreate its own backdoor, so the vendor recommends restoring from a clean backup, rotating all credentials, and installing the clean 3.0.124. The free WordPress.org version is not affected.
Ahold Delhaize, the company behind supermarket chains such as Albert Heijn, Food Lion, Stop & Shop and Giant, confirms that attackers caused the IT problems it first disclosed on 12 October. It took most of its brands' websites and apps offline as a precaution, but kept stores open. The company says it has no evidence so far that sensitive customer data was taken.
What this means
Online shopping and apps were disrupted for most brands in Europe and the US; Albert Heijn's website and app are back, with home deliveries expected from 23 October, and US e-commerce is expected back in the coming days.
Stores across all brands stayed open throughout the incident.
The investigation is ongoing, and the company hasn't said what kind of attack it was or how the attackers got in.
Ahold Delhaize notified the Dutch National Cyber Security Centre and filed a police report on 19 October.
Technical details
Ahold Delhaize says its investigation found that suspicious activity in its IT infrastructure, first disclosed on 12 October, was caused by malicious actors. It took websites, apps and other systems offline for most of its European and US brands as a precaution, but kept stores open. The company notified the Dutch NCSC, filed a police report on 19 October, and says it has no evidence so far that sensitive customer, associate or partner data was taken.
affected
Ahold Delhaize (Albert Heijn, Food Lion, Stop & Shop, Giant and other brands)
Nikkei, the Japanese media company behind the Nikkei newspaper, says someone used stolen login details on 7 October to get into a cloud service it uses for software development. About 1.83 million items of personal information leaked, of which about 150,000 can identify a person. Nikkei confirms the breach and says no credit card data was involved.
What this means
The identifying items include names, email addresses, postal addresses, phone numbers or dates of birth; about 120,000 of them contain an email address.
Nikkei says it will contact each person whose data is confirmed leaked, and as of 16 October it had found no misuse of the data.
People whose email addresses leaked may receive phishing emails made to look like they come from Nikkei, so treat unexpected messages asking you to click links or log in with care.
Nikkei is still reviewing the scope of the breach and hasn't said how the login details were stolen.
Technical details
Nikkei Inc. says someone used stolen credentials early on 7 October to access a cloud service it uses for system development, leaking about 1.83 million personal-information items. About 150,000 contain identifying details such as name, email, postal address, phone number or date of birth, and none include credit card data. The company reported the breach to Japan's Personal Information Protection Commission on 11 October.
Criminals are bundling a genuine, signed copy of Siemens Software Center (a program for installing Siemens software) with their own malicious files and spreading it outside Siemens' official channels. Older versions of the program load those files, so the malware runs on Windows PCs. Siemens and CISA confirm the abuse; Siemens says its own systems were not breached.
What this means
Update Siemens Software Center to 4.0.9.8 or later; Siemens says existing installs update automatically the next time the program starts.
Siemens links the campaign to "ClickFix" tricks, fake "I am not a robot" pages that ask you to paste a command into the Windows Run box or PowerShell; a real check never asks for this, so don't do it.
Warning signs Siemens lists include "Siemens Software Center" in the startup apps of a PC that never had it installed, or a folder named "SM Software Provisioning Service" under AppData\Local\Programs.
Only download Siemens software from official Siemens sources; if a PC shows signs of infection, Siemens advises isolating it, removing the startup entries and scheduled tasks, and resetting passwords.
Technical details
Siemens ProductCERT confirmed that attackers are abusing a DLL search-path flaw in Siemens Software Center. They bundle a genuine, signed copy of the program with malicious DLLs and distribute it outside official channels. Siemens says no Siemens system was breached, fixed the issue in version 4.0.9.8 (advisory SSA-580366), and CISA added the CVE to KEV on 20 October.
SiteGuard Server Edition is security software, widely used in Japan, that filters attacks on websites. A flaw in it lets someone who already has limited access to the server run commands with full control of the machine. Japan's JPCERT/CC and the US cybersecurity agency CISA confirm it is being exploited.
What this means
If you run SiteGuard Server Edition 2.20 or later, update to Ver8.00 Update 5 (Apache, Nginx, IIS) or Ver7.00 Update 6 (Apache and Nginx on FreeBSD), or apply the vendor's patch, which is also offered for end-of-life versions.
The flaw is in the statistics feature, which is on by default; for IIS, versions 3.10 to 4.00 Update 4 are not affected.
Because exploitation is confirmed and CISA has flagged this flaw for forensic triage, admins should also check affected servers for signs of compromise, not just patch them.
Technical details
EG Secure Solutions' SiteGuard Server Edition, a host-based WAF widely used in Japan, has an OS command injection flaw that lets an attacker run commands as root or SYSTEM. JPCERT/CC published it through JVN, and CISA added it to KEV on 20 October with a 23 October deadline for federal agencies.
Plex Media Server is popular software people run at home to stream their own movies, TV and music. Attackers are widely exploiting four bugs that, combined, let someone on the internet take over an out-of-date Plex server without logging in. Plex and the US cybersecurity agency CISA confirm the attacks; version 1.43.3.10861 or later is fixed.
What this means
Check your server version in Plex Web under Settings > General and update to 1.43.3.10861 or newer; NAS users may need to install the update manually.
Plex says that if your server was older than that and reachable from the internet, you should assume it may be compromised; hacked servers have been used to run cryptocurrency miners and proxy software.
Signs Plex lists include unfamiliar processes, unknown .so or .dll files in the Codecs folder, and high CPU use when nothing is playing; if you see them, rebuild from a clean install, sign out of all devices and change your Plex password.
If you don't need remote access, Plex suggests turning it off and not forwarding port 32400.
Technical details
CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog on 20 October: two SSRF bugs, an encoded-URI neutralization flaw and an arbitrary file write. Chained together, they lead to code execution on the server. Plex Media Server 1.43.3.10861 and later contain the fixes.
eMudhra, an Indian company that issues the digital certificates websites use to prove their identity (the padlock in your browser), created weak security keys for eight of its certificate-issuing authorities in 2025. After a researcher showed the keys could be cracked, Apple, Google, Microsoft and Mozilla stopped trusting them. eMudhra confirms this and says none of its systems or data were breached.
What this means
Most people don't need to do anything: eMudhra says the eight affected certificate authorities never issued a single website certificate, and Mozilla says Firefox blocked them automatically.
Websites whose certificates come from eMudhra's now-distrusted ECC root can show browser security warnings until they are replaced; eMudhra says this affects one customer ecosystem in the United States and it is issuing replacement certificates.
eMudhra says its Indian digital signature (DSC) and eSign services and its other products run on separate systems and need no action.
eMudhra says it knows of no evidence that anyone recovered or used the weak keys before disclosure; it has not yet confirmed the exact root cause.
Technical details
eMudhra says a flaw in its 30 April 2025 key-generation ceremony created weak keys for eight intermediate CAs under its ECC root, and those weak keys were the ones published to browser root stores. A researcher showed the keys could be recovered and reported it to the Apple, Google, Microsoft and Mozilla root programs, which then distrusted the affected CAs and one root. eMudhra says its infrastructure and data were not compromised and that its Indian DSC and eSign services are unaffected.
affected
eMudhra Ltd (global TLS business / emSign ECC hierarchy)
State Bank of India told stock exchanges on 21 October that some of its customer data had been found on the dark web (hidden websites often used to trade stolen data). A first check found personal details of 3,897 customers, such as names, phone numbers, birth dates and addresses. The bank confirms the incident, is investigating, and says its banking services are running normally.
What this means
SBI says the exposed records included names, registered mobile numbers, dates of birth, gender, email and home addresses, and customer and loan-lead IDs; its filing does not mention passwords or card numbers.
Customers may get scam calls, texts or emails that use these details to seem genuine; a bank will never ask for your PIN, OTP or password, so don't share them.
The 3,897 figure comes from a preliminary review of about 375,000 leaked records; SBI hasn't yet said whether more customers are affected.
SBI has hired an independent CERT-In-empanelled cybersecurity firm to investigate and says there is no material impact on its core operations.
Technical details
SBI told Indian stock exchanges on 21 October that its threat-intelligence provider, the Defence Cyber Agency and CERT-In had warned it on 16 October about customer data exposed on the dark web. In about 375,000 leaked records, a first review found 3,897 customer records with personal data, including names, mobile numbers, dates of birth, addresses and loan-lead metadata. The bank says it has hired an independent CERT-In-empanelled firm and that core operations are not materially affected.
LiteLLM is a popular open-source tool that developers use to connect their apps to AI models. On 21 October attackers hijacked its release process and published a fake version, 1.107.0, containing malware that steals passwords and access keys from any machine that installs it. LiteLLM has confirmed the incident and says the attackers got in using a secret key that was accidentally posted publicly in May and never cancelled.
What this means
If you installed litellm 1.107.0 from PyPI (11:39 to 13:23 UTC, 21 October) or ran the v1.107.0, latest, main-latest or main-stable Docker images in that period (until 14:20 UTC), LiteLLM says to treat that environment as compromised.
Rotate every secret the affected host could reach, including cloud roles, AI provider keys stored in the LiteLLM database, LiteLLM master and virtual keys, and database passwords.
Reinstall pinned to litellm 1.106.2, ideally by rebuilding from scratch; LiteLLM warns that starting Python on an infected machine, even to run pip, re-triggers the malware.
LiteLLM says earlier versions and its private enterprise registry were not affected, and that it is revoking every token for its internal systems and vendor platforms.
Technical details
Attackers used stolen GitHub credentials belonging to three LiteLLM developers to change the release pipeline. They published litellm 1.107.0, which steals credentials and loads remote code, to PyPI (11:39 to 13:23 UTC on 21 October) and to several Docker Hub and GHCR tags (until 14:20 UTC). LiteLLM's follow-up attack-chain report says the entry point was a LiteLLM Agent Platform master key accidentally committed to the public LiteLLM-Labs/lite-harness repository on May 27 and never revoked; on October 10 the attacker used it to pull an organization owner's GitHub CLI OAuth token and then exfiltrate CI secrets holding two maintainers' tokens. LiteLLM says to treat any environment that installed or ran it as compromised, pin 1.106.2, and rotate every secret the host could reach.
PHP, the programming language behind a large share of websites, released updates on 21 October that fix two serious flaws that can let someone with no login take control of a web server. Amazon's security team says attackers are now broadly trying these flaws against real internet-facing systems, with a first attempt seen on 17 October, four days before the fix came out. Active exploitation is confirmed by Amazon's own monitoring.
What this means
If you run PHP on a server, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution's patched package) and restart PHP services; PHP and Amazon both say updating is the only complete fix.
Amazon advises starting any investigation from at least 17 October, not the disclosure date: review web server logs, look for POST requests containing PHP_SESSION_UPLOAD_PROGRESS, and check for unexpected processes or changed files, because an update does not undo a break-in that already happened.
PHP 8.1 and older get no official fix. CISA, the NSA and the FBI say that if you can't update right away, or still run 8.1 or older, you should take PHP-based systems offline until they are patched; CISA adds that a web application firewall may give some protection in the meantime.
Amazon says it is not yet clear whether the attempts it saw succeeded on real systems, and no one has published how many servers were actually compromised.
Technical details
The PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two critical bugs in memory handling: corruption after out-of-memory errors and stale global state that survives between requests. Either can let an unauthenticated attacker run code on the server, and PHP rates Apache with mod_php as the highest-risk setup. Amazon Threat Intelligence says it saw an exploitation attempt against its MadPot honeypots on 17 October, four days before disclosure, more attempts from multiple actors on 21 October, and that PHP2Shell is now being broadly exploited in the wild; it says it is unclear whether the earliest attempts would have succeeded on real systems.