weekly digest / 2026-W44

Weekly digest 2026-W44: 26 Oct - 1 Nov 2026

in progress this week is not over yet; counts will change · Monday-Sunday, Pacific time (America/Los_Angeles), counted by the date each incident was first seen · updated

4incidents
2confirmed
1CVSS 9+
0supply chain

breach 2 · critical vuln 1 · outage-incident 1

Highest CVSS (9.0+)

  1. critical vuln not confirmed CVSS 9.8

    Oracle E-Business Suite: unauthenticated takeover flaw in Application Object Library (CVE-2026-101767, CVSS 9.8)

    Oracle E-Business Suite is business software many large companies use for finance, HR and supply chains. Oracle fixed a near-maximum severity flaw (9.8 out of 10) in one of its core parts that lets an attacker with network access take it over without a password. Oracle has not said it is being exploited; active exploitation is not confirmed.

Confirmed breaches & ransomware

  1. breach confirmed CVSS n/a

    Gyazo breach: final forensics confirm about 23.62 million user records and 432 private images taken

    Gyazo, a popular screenshot and image-sharing service run by Japan's Helpfeel, was hacked in September. Its final investigation report confirms hackers took account details for about 23.6 million accounts (emails, scrambled passwords and login data) plus information about hundreds of millions of uploaded images, and actually viewed or copied 432 private images of 133 users. Helpfeel says no card details were taken.

  2. breach confirmed CVSS n/a

    DNP's honto bookstore: newsletter subscribers' names and emails possibly leaked via mail vendor Yumirlink

    honto is a Japanese online and in-store bookstore run by printing giant DNP. A company that sends honto's newsletters was hacked, and the names and email addresses of people who signed up for the newsletter may have been stolen. DNP says passwords, card numbers and purchase history were not in that system, and it doesn't yet know how many people are affected.

Every incident this week (4)

  1. breach Gyazo breach: final forensics confirm about 23.62 million user records and 432 private images taken
  2. breach DNP's honto bookstore: newsletter subscribers' names and emails possibly leaked via mail vendor Yumirlink
  3. critical vuln Oracle E-Business Suite: unauthenticated takeover flaw in Application Object Library (CVE-2026-101767, CVSS 9.8)
  4. outage-incident Tokio Marine X small-amount insurer halts portal and new sign-ups after possible intrusion into contract system

· all weeks