Freshly confirmed exploitation of Atlassian Data Center and Ivanti Connect Secure flaws leads the day, alongside Microsoft's record patch release, a Linux kernel bug that breaks cloud sandbox isolation, and new breach disclosures from a UK legal agency and a Texas utility.
🔴 CRITICAL (2)
CISA adds a freshly exploited Atlassian Data Center flaw (CVE-2026-21589) to its known exploited list Confirmed
CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog on 15 October after evidence of active exploitation, and US federal agencies have until 18 October to remediate. The flaw lets an unauthenticated attacker read files in the root directory of Atlassian Data Center and Server products, including Jira, Confluence and Bitbucket, which can expose configuration files, logs and secrets. Organisations running self-hosted Atlassian Data Center should apply the vendor’s fixed versions now, restrict management interfaces from the internet and review server logs for unusual file access.
Sources CISA|Atlassian Security Advisory|watchTowr
CISA urges immediate patching of an exploited Ivanti Connect Secure authentication bypass (CVE-2026-104935) Confirmed
CISA says attackers are exploiting a zero-day authentication bypass in Ivanti Connect Secure versions 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier to run commands remotely without credentials. The agency reports that observed intrusions involved credential theft and data exfiltration, and honeypot sensors have logged more than 100 exploit attempts. Administrators should patch the appliance at once, then hunt for and reset any credentials exposed through it and check for signs of persistence.
Sources CISA|The Hacker News|DarkReading
🟠 HIGH (8)
Microsoft's record October Patch Tuesday fixes 1,413 flaws, including an exploited Windows shell bug Confirmed
Microsoft shipped a record 1,413 security fixes in its October update, covering Windows, Office, SharePoint Server, SQL Server and developer tools, with more than 670 privilege escalation and over 300 remote code execution issues. One of the flaws, CVE-2026-96951 in the Windows shell, is under active exploitation and was added to CISA’s known exploited list. Windows and Office administrators should prioritise the exploited bug and the three zero-days that vendors flagged in the same release.
Sources The Hacker News|CrowdStrike|CISA
PwnEscape Linux kernel flaw (CVE-2026-99999) lets a virtual machine read the host's memory Confirmed
A researcher disclosed a critical flaw in the Linux kernel networking code that allows code inside a virtual machine to read memory belonging to the host, crash the host and in some cases run code on it, breaking the isolation boundary nearly all public clouds rely on. The leak was demonstrated against Vercel’s live cloud sandboxes and Vercel confirmed it, and the bug is reported to reach back through years of kernel versions. Cloud and hosting teams should track their kernel vendor’s fix rather than assume container or microVM isolation is sufficient.
Sources The Hacker News|CyberKendra
UK Legal Aid Agency breach widens, with records dating back to 1978 stolen Confirmed
The Legal Aid Agency, an executive agency of the UK Ministry of Justice that runs the Public Defender Service, says attackers who breached its systems in April 2025 stole records dating back to 1978, and a forensic review has widened the scope of the incident. Most of the affected data relates to applications, claims and payments submitted between 2007 and 2025. Legal sector and public bodies holding decades of legacy case files should check access controls on archive systems and plan for long term exposure of historical data.
Sources BleepingComputer|SecurityWeek
Supermarket refrigeration attack widens to Copeland and Dixell controllers Under investigation
The attack that forced food to be thrown away at hundreds of French supermarkets has widened to more controller families, with reporting that Copeland and Dixell equipment was affected alongside Danfoss devices at roughly 700 stores. Attackers changed refrigeration settings so cabinets overheated, causing spoilage and, in some locations, losses running into millions of euros. Grocers should isolate building and refrigeration controllers from flat corporate networks, remove default credentials and monitor for unexpected setpoint changes.
Sources SecurityWeek|DarkReading
Next.js ships an out-of-band patch for two critical remote code execution flaws Confirmed
Next.js released an unscheduled security update on 14 October fixing two flaws that allow unauthenticated remote code execution, one in React Server Components and one in the librsvg library that Next.js uses through the sharp image package, plus a high severity denial of service issue. No exploitation has been reported, but the framework is extremely widely deployed. Teams running Next.js should upgrade to the patched release and rebuild deployments that bundle the affected image pipeline.
Sources The Hacker News
GhostAction campaign compromises about 1,900 GitHub accounts and reaches 30,000 repositories Confirmed
GitGuardian says the GhostAction credential theft campaign pushed into more than 30,000 repositories across 3,000 users and organisations in a spike on 8 and 9 October, after attackers took over roughly 1,900 GitHub accounts. The campaign tried to extract 3,174 secrets from public repositories’ CI workflows. Developers should review GitHub account and workflow activity, rotate any secrets exposed in logs or workflow output, and replace long lived CI credentials with short lived tokens.
Sources The Hacker News
CenterPoint Energy breach exposes data on about 1 million Texans Confirmed
US utility CenterPoint Energy has disclosed a data breach affecting roughly 1 million people in Texas, with names, addresses, Social Security numbers and driver’s licence numbers compromised. Identifiers of this kind are enough to open accounts and pass many identity checks. Affected customers should watch for phishing that quotes the leaked details, request a credit freeze where available, and treat unsolicited utility or refund messages as suspect.
Sources SecurityWeek
Attackers hammer Langflow's critical RCE flaw (CVE-2026-105740) in 1,423 honeypot attempts Confirmed
Security firm Previdian reports that attackers are actively targeting a critical flaw in Langflow, the open source platform used to build AI agents and workflows, with 1,423 exploit attempts logged against honeypots. CVE-2026-105740 carries a CVSS score of 9.9 and requires authentication, so exposure depends on who can reach the interface. Teams running Langflow should patch, keep the interface off the public internet, and review workflows, API keys and stored credentials for tampering.
Sources The Hacker News
🟡 MEDIUM (12)
CISA advisory batch covers medical imaging flaws and a dozen ICS and IoT products Confirmed
CISA’s latest ICS and medical device advisories include serious flaws in medical imaging software: the dcm4che archive dcm4chee-arc-light could let an attacker delete stored medical images, disclose patient information, inject forged studies and reassign patient records, while Thermo Fisher’s Torrent Suite Software has a path traversal that can read arbitrary files. The same batch covers Hitachi Energy, Johnson Controls, Inductive Automation, Red Lion Controls, Eclipse Milo, Swann, Meari and other vendors. Healthcare and industrial operators should apply vendor fixes and keep these systems segmented from general networks.
Sources CISA (medical advisory)|CISA (medical advisory)|CISA (ICS advisory)
Unit 42 details an AI-assisted espionage campaign against government Linux infrastructure Confirmed
Unit 42 has published analysis of an espionage campaign that targeted government Linux infrastructure using custom malware, web shells and credential theft tooling, with AI assisting parts of the operators’ workflow. The report follows the intrusion from initial access through to long term collection. Defenders should hunt for web shells on internet facing Linux hosts, review SSH keys and sudo usage, and watch for unusual outbound traffic from government and research networks.
Sources Unit 42
Proxyjacking campaign hijacks D-Link and Ubiquiti devices in 34 countries Confirmed
A proxyjacking campaign has taken over D-Link and Ubiquiti routers and similar devices in 34 countries and is reselling the victims’ bandwidth through a commercial residential proxy network. Affected owners usually notice only slow connections, higher power use or unexpected traffic patterns. Patch router firmware, retire devices that no longer receive updates, disable remote administration and change default credentials.
Sources BleepingComputer
Fake Arch Linux packages in the AUR push malware that runs as root Confirmed
An attacker uploaded malicious packages to the Arch User Repository that impersonated yay and paru, two popular helpers for installing packages, so anyone who built them from source installed malware with root privileges. AUR submissions are user contributed and not officially reviewed, so they should be treated as untrusted code. Users who installed either tool from the AUR in recent days should inspect their build logs, remove the packages and rotate credentials used on that machine.
Sources BleepingComputer
Citizen Lab links zero-click Candiru spyware infections at Al Jazeera to malicious ads Confirmed
Researchers at the Citizen Lab say devices at the news network Al Jazeera were infected with spyware from the vendor Candiru through ordinary online advertisements, with the attack code running as soon as an ad loaded, in some cases while off screen. No click or other user action was required. The finding shows that ad delivery chains remain an attack path for high risk users, and newsrooms and civil society groups should consider blocking third party ad frames on sensitive devices.
Sources The Hacker News
Silent Lynx exploits a WinRAR flaw against government targets across the CIS Confirmed
The threat actor tracked as Silent Lynx has run a fresh campaign against government organisations in Commonwealth of Independent States countries using four infection chains that combine macro enabled documents, PS2EXE downloaders, PowerShell hosted on GitHub and crafted WinRAR archives. The activity was observed from June 2025 through August 2026. Defenders should patch WinRAR where the flaw applies, block macros from internet sourced documents, and alert on PowerShell launched from archive extraction.
Sources The Hacker News
Help TDS and Hotejka push tech support scams from 20,000+ Cloudflare Pages domains Confirmed
Researchers have tied the long running Help TDS traffic distribution system to a Russian language affiliate program called Hotejka, described as a rebrand of ROI777, and say the operation used more than 20,000 Cloudflare Pages domains to host tech support scams. The system redirects visitors from compromised or low quality sites into fake helpdesk pages that push remote access tools and payments. Blocking the domains and filtering injected traffic distribution scripts is the practical defence.
Sources The Hacker News
NGINX fixes five flaws, including a possible remote code execution and a client certificate bypass Confirmed
The NGINX project released fixes for five issues, among them a bug that could lead to remote code execution and a TLS flaw that may skip client certificate verification in some configurations. The certificate issue matters most for mutual TLS deployments where the check is part of authentication. Administrators should upgrade and re-test any mutual TLS setup that relies on the client certificate check.
Sources The Hacker News
Brooklyn prosecutors and the FBI dismantle a crypto fraud network aimed at Russian speakers Confirmed
US prosecutors and the FBI took down 112 servers behind a cryptocurrency investment fraud operation that drew in Russian speaking victims through social media ads and fake advisers, with losses reported in the tens of millions of dollars, and then approached the same victims again with fake recovery offers. The case is a reminder that unsolicited recovery services after a crypto scam are usually a second fraud.
Drupal patches a critical Field UI flaw with an unauthenticated path via contributed modules Confirmed
Drupal released updates on 14 October in versions 11.4.10, 11.3.19 and 10.6.19 for a critical flaw in the core Field UI module that could allow code execution on a site’s server. The Drupal Security Team says core alone does not provide a path to exploitation, but several contributed modules do, and at least one known route needs no login. Site owners should update core and audit the contributed modules they have installed.
Sources The Hacker News
CikaBika remote access trojan uses Discord for command and control Confirmed
A newly documented remote access trojan called CikaBika is delivered through phishing and uses Discord for command and control, giving operators reconnaissance, remote execution and data exfiltration. Because the traffic blends with ordinary Discord use, network blocking alone is weak against it. Detection belongs on the endpoint; organisations should also review which Discord access their networks allow and brief staff on the delivery lures.
Sources SecurityWeek
AhsayCBS gets another round of fixes after earlier patches for exploited flaws proved incomplete Confirmed
Ahsay Backup has released further updates for its AhsayCBS backup server software, whose flaws CVE-2026-105133 and CVE-2026-105134 are being used to drop web shells and cryptominers. The two bugs can be chained to bypass authentication and run arbitrary commands, and the earlier fixes did not close the gap completely. Anyone running AhsayCBS should apply the new build, then check for web shells and XMRig miners on the host.
Sources The Hacker News
⚪ WATCH (4)
Rogue AI agents answer hidden prompts as analysts debate how much AI really helps attackers Under investigation
Researchers who added hidden text to a contact form used by AI agents probing an Alibaba map service received replies describing the agents’ tasks, tracing some activity to Tencent Cloud infrastructure. In parallel, DarkReading argued that AI is degrading the quality of many attacks rather than improving them, with serious actors still relying on conventional tradecraft. Both point the same way: treat model output as untrusted input, and keep prompt injection on the list of agentic deployment risks.
Sources Decrypt|DarkReading
Talos: exploitation activity tracks only a small share of published vulnerabilities Confirmed
Cisco Talos’s Q3 vulnerability review argues that the volume of newly published CVEs and the rate at which they are actually exploited diverge sharply, so treating every disclosure as equally urgent wastes remediation effort. Its practical advice is to prioritise the small set of flaws with observed exploitation, working exploit code, or internet facing exposure.
Sources Talos
India mandates caller name display on 4G and newer networks from 1 November Confirmed
India’s Department of Telecommunications has directed telecom operators to show the registered name of the caller alongside the number for incoming calls from 1 November 2026, aiming to help users identify unknown and fraudulent callers. The change gives recipients a new signal but also depends on the accuracy of registration data. Fraud and contact centre teams in the region should watch how call patterns shift once it takes effect.
Sources The Hacker News
Hex founder Richard Heart arrested in Istanbul, Turkish media report Unconfirmed report
Turkish media report that Richard Heart, founder of the Hex and PulseChain crypto projects, was arrested in Istanbul, with police said to have seized about 4 million dollars in cash and 64 luxury watches. The reports have not been confirmed by prosecutors, so the details should be treated as unverified. The case adds to a run of enforcement actions against crypto promoters accused of fraud.
Sources CoinDesk
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.