weekly digest / 2026-W43

Weekly digest 2026-W43: 19-25 Oct 2026

in progress this week is not over yet; counts will change · Monday-Sunday, Pacific time (America/Los_Angeles), counted by the date each incident was first seen · updated

35incidents
23confirmed
12CVSS 9+
10supply chain

breach 14 · actively-exploited vuln 5 · critical vuln 12 · outage-incident 4

Actively exploited

  1. actively-exploited vuln confirmed CVSS 9.9

    Arista VeloCloud Orchestrator on-prem: actively exploited SQL injection, CVE-2026-114625 (CVSS 9.9)

    VeloCloud Orchestrator is the central management system companies use to control their SD-WAN, the equipment that links branch offices to each other and to the cloud. Arista says a flaw lets anyone with even a basic login take over full administrator powers on self-hosted (on-prem) installations, and that attackers are already using it. Arista has released fixed versions and says its own hosted service is already patched.

  2. actively-exploited vuln confirmed CVSS 9.2 runtime flaw PHP

    PHP2Shell: critical unauthenticated PHP RCE flaws now exploited in the wild (CVE-2026-109618, CVE-2026-109619)

    PHP, the programming language behind a large share of websites, released updates on 21 October that fix two serious flaws that can let someone with no login take control of a web server. Amazon's security team says attackers are now broadly trying these flaws against real internet-facing systems, with a first attempt seen on 17 October, four days before the fix came out. Active exploitation is confirmed by Amazon's own monitoring.

  3. actively-exploited vuln confirmed CVSS 8.6

    Plex Media Server 'Plex2Shell' chain added to CISA KEV (4 CVEs)

    Plex Media Server is popular software people run at home to stream their own movies, TV and music. Attackers are widely exploiting four bugs that, combined, let someone on the internet take over an out-of-date Plex server without logging in. Plex and the US cybersecurity agency CISA confirm the attacks; version 1.43.3.10861 or later is fixed.

  4. actively-exploited vuln confirmed CVSS 8.5

    SiteGuard Server Edition OS command injection exploited (CVE-2026-106931)

    SiteGuard Server Edition is security software, widely used in Japan, that filters attacks on websites. A flaw in it lets someone who already has limited access to the server run commands with full control of the machine. Japan's JPCERT/CC and the US cybersecurity agency CISA confirm it is being exploited.

  5. actively-exploited vuln confirmed CVSS 8.4

    Siemens Software Center DLL side-loading abused by ClickFix campaign (CVE-2026-110936)

    Criminals are bundling a genuine, signed copy of Siemens Software Center (a program for installing Siemens software) with their own malicious files and spreading it outside Siemens' official channels. Older versions of the program load those files, so the malware runs on Windows PCs. Siemens and CISA confirm the abuse; Siemens says its own systems were not breached.

Highest CVSS (9.0+)

  1. critical vuln not confirmed CVSS 10.0 library / plugin flaw WordPress Joomla

    YOOtheme Pro 5 image handler flaw allows unauthenticated remote code execution (CVE-2026-102785, CVSS 10.0)

    YOOtheme Pro, a popular theme and page builder used to design Joomla and WordPress websites, had a serious flaw in how it resizes images. An attacker with no login could abuse it to plant their own code on the website and take it over. YOOtheme fixed it in version 5.0.53 on 21 October. The official record's score marks it as attacked, but no details of real-world attacks have been published, so active exploitation is not confirmed.

  2. critical vuln not confirmed CVSS 10.0

    GitLab critical patch for unauthenticated code-execution flaw CVE-2026-110264 (CVSS 10.0)

    GitLab, a widely used tool companies run to store and manage their software code, has fixed a critical flaw that could let an attacker with no account run their own commands on a company's GitLab server. It affects self-hosted GitLab going back to version 7.0. GitLab's advisory does not say it is being exploited; active exploitation is not confirmed.

  3. critical vuln not confirmed CVSS 9.9

    LiteLLM proxy privilege escalation to admin and command execution CVE-2026-114612 (CVSS 9.9)

    LiteLLM, a popular gateway that companies run to route their apps' requests to AI services, has a serious flaw. Someone who already has an ordinary user account on a company's LiteLLM server could make themselves an administrator and run commands on that server. Fixes are out; active exploitation is not confirmed.

  4. critical vuln not confirmed CVSS 9.9

    Splunk Enterprise and Splunk SOAR: October 2026 hardening releases fix critical CVE-2026-76299, CVE-2026-76302 and CVE-2026-76531 (CVSS 9.9)

    Splunk, a company whose software many organisations use to collect and search their security and IT logs, has fixed a batch of serious flaws it found itself in Splunk Enterprise and Splunk SOAR (its tool for automating security responses). The worst are rated 9.9 out of 10. Splunk's advisories don't say anyone is exploiting them; active exploitation is not confirmed.

  5. critical vuln not confirmed CVSS 9.8 library / plugin flaw PyPI

    Pillow image library flaw CVE-2026-96639 (CVSS 9.8) fixed in 13.0.0

    Pillow, a widely used Python library that programs use to open and edit pictures, has a serious flaw. A specially crafted image file in certain formats can crash a program that opens it and, in some setups, let an attacker run commands. A fix is out in version 13.0.0; active exploitation is not confirmed.

Confirmed breaches & ransomware

  1. breach confirmed CVSS n/a

    Quest Diagnostics discloses unauthorized access to Quanum LSM patient system

    Quest Diagnostics, one of the largest US medical lab-testing companies, says someone got unauthorized access to Quanum LSM, a system its clients (such as doctors' offices) use to order lab tests and look up results. Quest confirms the incident and believes some patient records were accessed, but it hasn't said how many people or what details are involved.

  2. breach confirmed CVSS n/a

    Fisher & Paykel Healthcare discloses unauthorised access to employee email accounts and company files

    Fisher & Paykel Healthcare, a New Zealand maker of breathing-support and sleep-apnea medical equipment, says someone broke into two employee email accounts and some company files. Some of those files held personal information, and the company is contacting the people affected. The company confirms the incident and says its products, factories and patient-data system were not affected.

  3. breach confirmed CVSS n/a

    Capcom confirms CAPCOM ID breach exposing 11,774,247 email addresses

    Capcom, the company behind Monster Hunter and Resident Evil, says hackers got into CAPCOM ID, the shared account people use for its online games and websites. About 11.77 million email addresses and basic login details leaked, and 196 accounts had their passwords changed by the attackers. Capcom confirms the breach and says credit card details were not exposed.

  4. breach confirmed CVSS n/a

    Amagi Media Labs discloses extortion attempt over claimed theft of network configuration data

    Amagi Media Labs, a Bengaluru-based company whose cloud software helps TV channels and streaming services run and deliver their broadcasts, says a criminal is trying to extort it. The attacker claims to have stolen technical data about how some of Amagi's systems and networks are set up and threatens to publish it unless paid. Amagi confirms the extortion attempt but says it is still checking whether the data theft claim is real; it says its services have not been disrupted.

  5. breach confirmed CVSS n/a

    Toronto Crime Stoppers pauses tips after 176,859 tips stolen from P3 tip software

    Crime Stoppers lets people report crimes anonymously. Toronto Crime Stoppers says hackers stole more than 176,000 tips from the company that runs its tip software back in March, and those tips include about 15,000 names. It is not yet known whether the names belong to the people who sent tips, the people named in them, or both. Tip lines are paused.

Supply chain

  1. critical vuln not confirmed CVSS 9.1 runtime flaw Java

    Oracle out-of-band Security Alert for Java SE / GraalVM JSSE flaw CVE-2026-91403 (CVSS 9.1)

    Oracle has put out an emergency fix for Java, the software platform that runs many business and web applications. The flaw is in the part of Java that handles secure (encrypted) connections, and Oracle says attackers could use it over a network without needing a password. Oracle's alert does not say it is being exploited; active exploitation is not confirmed.

  2. breach confirmed CVSS n/a malicious release PyPI Docker

    LiteLLM 1.107.0 on PyPI and Docker was malicious (release pipeline compromise)

    LiteLLM is a popular open-source tool that developers use to connect their apps to AI models. On 21 October attackers hijacked its release process and published a fake version, 1.107.0, containing malware that steals passwords and access keys from any machine that installs it. LiteLLM has confirmed the incident and removed the bad version.

  3. critical vuln not confirmed CVSS n/a runtime flaw Node.js

    Node.js security releases fix 10 flaws, including Brotli decoder RCE CVE-2026-111497

    Node.js, the software that runs JavaScript on millions of web servers and developer tools, has released security updates fixing 10 problems. The worst lets an attacker who sends specially compressed data run their own code on the server, and two others can let a fake website certificate be accepted. Updates are out; active exploitation is not confirmed.

  4. critical vuln not confirmed CVSS 9.3 library / plugin flaw source library

    Signal RingRTC flaw CVE-2026-113380 (CVSS 9.3) could keep a call running after hang-up

    Signal, the private messaging app, had a flaw in the part that handles voice and video calls. A caller could flood the call with data so that pressing hang-up did not actually end it, possibly keeping your microphone or camera connected. It is fixed in newer versions of Signal's calling library; active exploitation is not confirmed.

  5. breach confirmed CVSS n/a malicious release GitHub Releases

    OVHcloud CLI releases v0.11.0-v0.15.0 replaced with secret-stealing binaries

    OVHcloud, a French cloud provider, says an attacker used a staff developer's hijacked GitHub account to swap the downloads of its command-line tool (a program admins use to manage their cloud services) for malware that hunts for passwords and keys. The bad files were up for about an hour and a half on 19 October and were downloaded about 250 times. OVHcloud has confirmed it and removed them.

  6. critical vuln not confirmed CVSS 9.2 library / plugin flaw Composer

    Laravel TokenGuard authentication bypass CVE-2026-114509 (CVSS 9.2) fixed in 12.68.0 and 13.29.0

    Laravel, a popular toolkit for building PHP websites and web apps, has a serious login flaw. In apps that use its built-in token login for APIs (the way other programs connect to a web app) with a MySQL or MariaDB database, an attacker could log in as another user without their key. Fixes are out; active exploitation is not confirmed.

  7. breach confirmed CVSS n/a vendor compromise WordPress

    TeamUpdraft breach exposes UpdraftCentral keys used to push backdoor plugins to WordPress sites

    TeamUpdraft, the company behind the popular UpdraftPlus backup plugin for WordPress websites, confirmed that attackers broke into its website and likely took its customer database, including the keys its UpdraftCentral service uses to remotely manage customers' sites. The company says attackers then used those keys to add hidden admin accounts and malicious plugins to some connected WordPress sites. How many sites were hit is not known.

Every incident this week (35)

  1. critical vuln LiteLLM proxy privilege escalation to admin and command execution CVE-2026-114612 (CVSS 9.9)
  2. actively-exploited vuln Arista VeloCloud Orchestrator on-prem: actively exploited SQL injection, CVE-2026-114625 (CVSS 9.9)
  3. critical vuln YOOtheme Pro 5 image handler flaw allows unauthenticated remote code execution (CVE-2026-102785, CVSS 10.0)
  4. breach Quest Diagnostics discloses unauthorized access to Quanum LSM patient system
  5. breach Fisher & Paykel Healthcare discloses unauthorised access to employee email accounts and company files
  6. breach Capcom confirms CAPCOM ID breach exposing 11,774,247 email addresses
  7. breach Amagi Media Labs discloses extortion attempt over claimed theft of network configuration data
  8. breach Toronto Crime Stoppers pauses tips after 176,859 tips stolen from P3 tip software
  9. breach NAVI confirms NAVI Shop order data from 2020-2026 was stolen
  10. critical vuln Splunk Enterprise and Splunk SOAR: October 2026 hardening releases fix critical CVE-2026-76299, CVE-2026-76302 and CVE-2026-76531 (CVSS 9.9)
  11. critical vuln Pillow image library flaw CVE-2026-96639 (CVSS 9.8) fixed in 13.0.0
  12. breach Railway says attackers may have accessed customer environment variables and secrets
  13. critical vuln Oracle out-of-band Security Alert for Java SE / GraalVM JSSE flaw CVE-2026-91403 (CVSS 9.1)
  14. critical vuln GitLab critical patch for unauthenticated code-execution flaw CVE-2026-110264 (CVSS 10.0)
  15. critical vuln Cisco Unified CM and other voice products: hardening release fixes critical CVE-2026-76473 and CVE-2026-76474 (CVSS 9.8)
  16. outage-incident TAKKT AG cyber attack restricts orders and deliveries in European and North American divisions
  17. critical vuln Cisco Expressway clustered devices: unauthenticated root command execution, CVE-2026-76466 (CVSS 9.8)
  18. breach LiteLLM 1.107.0 on PyPI and Docker was malicious (release pipeline compromise)
  19. critical vuln Node.js security releases fix 10 flaws, including Brotli decoder RCE CVE-2026-111497
  20. critical vuln ISC BIND 9 fixes four high-severity flaws, including GSS-TSIG memory corruption with possible remote code execution (CVE-2026-94300, CVSS 8.1)
  21. breach State Bank of India discloses customer data found on the dark web
  22. outage-incident eMudhra: weak private keys in 8 global TLS intermediate CAs lead to browser distrust
  23. critical vuln Signal RingRTC flaw CVE-2026-113380 (CVSS 9.3) could keep a call running after hang-up
  24. actively-exploited vuln Plex Media Server 'Plex2Shell' chain added to CISA KEV (4 CVEs)
  25. breach GMO Internet confirms unauthorized access to Onamae.com Desktop Cloud, suspends all plans
  26. actively-exploited vuln PHP2Shell: critical unauthenticated PHP RCE flaws now exploited in the wild (CVE-2026-109618, CVE-2026-109619)
  27. breach Nikkei: 1.83 million personal-information records leaked from development cloud
  28. breach OVHcloud CLI releases v0.11.0-v0.15.0 replaced with secret-stealing binaries
  29. critical vuln Laravel TokenGuard authentication bypass CVE-2026-114509 (CVSS 9.2) fixed in 12.68.0 and 13.29.0
  30. actively-exploited vuln Siemens Software Center DLL side-loading abused by ClickFix campaign (CVE-2026-110936)
  31. outage-incident Ahold Delhaize confirms malicious activity behind outage of brand websites and apps
  32. breach PingCAP confirms stolen credentials were used to copy TiDB Cloud customer and billing data
  33. breach TeamUpdraft breach exposes UpdraftCentral keys used to push backdoor plugins to WordPress sites
  34. outage-incident Bullhorn takes staffing platform offline after cyber incident
  35. actively-exploited vuln SiteGuard Server Edition OS command injection exploited (CVE-2026-106931)

· all weeks