https://zarguell.github.io/tia-n-list/ Stories scoring 5.0+ on the hot ranking. en-us Wed, 14 Oct 2026 03:12:03 +0000 https://zarguell.github.io/tia-n-list/stories/ivanti-connect-secure-cve-2026-104935-active-exploitation/ https://zarguell.github.io/tia-n-list/stories/ivanti-connect-secure-cve-2026-104935-active-exploitation/ Wed, 14 Oct 2026 02:32:09 +0000 Ivanti has patched CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure with a CVSS score of 8.6 that lets a remote unauthenticated attacker run arbitrary commands. Volexity researchers discovered in-the-wild exploitation earlier this month and attribute the activity to a threat actor it tracks as UTA0576. CISA confirmed exploitation and added the CVE to its Known Exploited Vulnerabilities catalog the same day Ivanti disclosed. The exploitation picture is messier than a single CVE. https://zarguell.github.io/tia-n-list/stories/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-da/ https://zarguell.github.io/tia-n-list/stories/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-da/ Wed, 14 Oct 2026 02:55:41 +0000 Microsoft's October 2026 Patch Tuesday fixes 1,411 flaws, including CVE-2026-96951, a security feature bypass in Windows Shell already exploited in the wild. The batch dwarfs September's record of nearly 1,000 fixes; at least 78 flaws are rated critical and allow remote code execution. CVE-2026-108398 (.NET Framework security feature bypass) was publicly disclosed ahead of the patch, giving attackers advance notice. Microsoft also quietly extended Windows 10 free updates until October 2027. https://zarguell.github.io/tia-n-list/stories/fortinet-october-2026-advisories-patch-fortisandbox-and-fortisie/ https://zarguell.github.io/tia-n-list/stories/fortinet-october-2026-advisories-patch-fortisandbox-and-fortisie/ Tue, 13 Oct 2026 20:30:44 +0000 Fortinet's October 13, 2026 advisory batch closes thirteen vulnerabilities across FortiAnalyzer, FortiManager, FortiMail, FortiSIEM, and FortiSandbox, and two of them are critical and pre-authenticated. CVE-2026-106173, tracked as FG-IR-26-180, is a CWE-22 path traversal in FortiSIEM that lets an unauthenticated attacker execute unauthorized code or commands via specially crafted packets; Fortinet scores it 9.4, lists FortiSIEM 7.5.0 as the only affected release, and fixes it in 7.5.1. https://zarguell.github.io/tia-n-list/stories/september-2026-cve-landscape/ https://zarguell.github.io/tia-n-list/stories/september-2026-cve-landscape/ Tue, 13 Oct 2026 20:21:19 +0000 Recorded Future's Insikt Group counted 94 high-impact vulnerabilities for September 2026, 59 of them Very Critical on its risk scale, a 29% rise over August, with public PoCs or scanners already available for 75 of the 94. The sourcing split is the mechanism: 43 arrived through CISA's KEV catalog, 37 through open-source validation, and 14 only through honeypot data, so a majority of the month entered the record as observed exploitation rather than advisory text. https://zarguell.github.io/tia-n-list/stories/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/ https://zarguell.github.io/tia-n-list/stories/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/ Tue, 13 Oct 2026 13:44:43 +0000 SonicWall SMA1000 appliances face two zero-day flaws with CVSS 10.0, confirmed actively exploited and added to CISA KEV. The vulnerabilities allow unauthenticated remote code execution. Organizations using SMA1000 should apply emergency patches immediately, audit for indicators of compromise, and restrict management interface exposure. https://zarguell.github.io/tia-n-list/stories/adobe-releases-september-2026-patches-for-multiple-products-adob/ https://zarguell.github.io/tia-n-list/stories/adobe-releases-september-2026-patches-for-multiple-products-adob/ Tue, 13 Oct 2026 17:14:42 +0000 Adobe's September 2026 release patched roughly 140 vulnerabilities across ten advisories, but the urgent item landed a day earlier. CVE-2026-75650 is an unauthenticated remote code execution flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, named StyleSmuggler by Sansec, whose forensics team published research on September 5 after finding exploited stores. Adobe shipped Hotfix VULN-39341 on September 7, and Tenable's Research Special Operations team confirmed exploitation began September 4, three days before any fix existed, with victims confirmed across multiple campaigns. https://zarguell.github.io/tia-n-list/stories/gitlab-cve-2026-97229-critical-unauthenticated-arbitrary-code-ex/ https://zarguell.github.io/tia-n-list/stories/gitlab-cve-2026-97229-critical-unauthenticated-arbitrary-code-ex/ Tue, 13 Oct 2026 21:47:15 +0000 GitLab has released emergency updates for CVE-2026-97229, a critical integer overflow in its CI/CD Regular Expression Compiler rated CVSS 10.0. An unauthenticated attacker can execute arbitrary code on the server with a specially crafted regular expression embedded in a project's pipeline configuration file, due to insufficient regex validation. The flaw affects both Community Edition and Enterprise Edition. Researcher joaxcar reported it through GitLab's HackerOne bounty program. https://zarguell.github.io/tia-n-list/stories/cve-2026-85097-bricksforge-wordpress-plugin-critical-rce-2/ https://zarguell.github.io/tia-n-list/stories/cve-2026-85097-bricksforge-wordpress-plugin-critical-rce-2/ Tue, 13 Oct 2026 11:07:46 +0000 CVE-2026-85097 is a critical unauthenticated file upload leading to remote code execution in the Bricksforge WordPress plugin (CVSS 10.0 per Patchstack). Exploitation has been observed since October 7 from 63 IPs. The vulnerability allows unauthenticated attackers to upload arbitrary files. Administrators using Bricksforge should patch immediately and review access logs for indicators of exploitation. https://zarguell.github.io/tia-n-list/stories/citrix-netscaler-unpatched-rce-zero-days/ https://zarguell.github.io/tia-n-list/stories/citrix-netscaler-unpatched-rce-zero-days/ Tue, 13 Oct 2026 17:16:34 +0000 Citrix NetScaler ADC and Gateway appliances spent late September under active exploitation with no patches available. On September 25, 2026, a reddit thread on r/Citrix carried shutdown advice attributed to the Dutch national cyber security center, and by September 26 researchers at watchTowr and Kevin Beaumont had confirmed reports of two unpatched zero-day RCE flaws being exploited in the wild. Tenable's Research Special Operations team set up an FAQ while details were still thin, and some organizations simply took NetScalers offline rather than run them exposed. https://zarguell.github.io/tia-n-list/stories/unprecedented-cyberattack-cripples-supermarket-fridges-across-eu/ https://zarguell.github.io/tia-n-list/stories/unprecedented-cyberattack-cripples-supermarket-fridges-across-eu/ Tue, 13 Oct 2026 23:06:50 +0000 On the night of October 11, attackers hijacked Danfoss refrigeration controllers at hundreds of European supermarkets and used the controllers' built-in defrost function to push fridge and freezer temperatures to 50C. French outlets count 250 to 350 affected stores, BFM TV reports more than 300, and the damage lands hardest in France: Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, Auchan, and Super U all confirmed or were named as victims. Food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also hit. https://zarguell.github.io/tia-n-list/stories/qilin-ransomware-core-member-extradited-from-japan-to-germany/ https://zarguell.github.io/tia-n-list/stories/qilin-ransomware-core-member-extradited-from-japan-to-germany/ Tue, 13 Oct 2026 09:28:16 +0000 A Qilin ransomware core member, an alleged Russian national, was extradited from Japan to Germany after detention in Osaka. International cooperation spans Japan, Germany, and other partners investigating the Ransomware-as-a-Service operation. The extradition follows sustained Qilin activity linked to CVE-2026-50751. Watch for further legal proceedings and any operational impact on the group's attack tempo. https://zarguell.github.io/tia-n-list/stories/nvidia-aistore-vulnerabilities-include-cvss-10-0-remote-code-exe/ https://zarguell.github.io/tia-n-list/stories/nvidia-aistore-vulnerabilities-include-cvss-10-0-remote-code-exe/ Tue, 13 Oct 2026 23:56:06 +0000 NVIDIA AIStore vulnerabilities include a CVSS 10.0 remote code execution flaw tracked as CVE-2026-65162, part of a broader 18-fix release across NVIDIA AI tools. The event notes remote code execution potential via AIStore. Organizations deploying NVIDIA AI infrastructure should upgrade to the patched release immediately. The CVSS 10.0 score indicates unauthenticated remote exploitation potential; treat as urgent. https://zarguell.github.io/tia-n-list/stories/sap-cloud-sdk-cve-2026-89111-oauth2-ssrf-critical-vulnerability/ https://zarguell.github.io/tia-n-list/stories/sap-cloud-sdk-cve-2026-89111-oauth2-ssrf-critical-vulnerability/ Wed, 14 Oct 2026 00:29:54 +0000 SAP Cloud SDK for Python carries a critical server-side request forgery tracked as CVE-2026-89111 with CVSS 10.0. In multi-tenant SAP BTP applications, an attacker controlling a tenant can exploit the OAuth2 flow to perform SSRF. The advisory comes from SAP via GitHub (GHSA-4mv3-jxxm-9cx2). Multi-tenant deployments should upgrade immediately; single-tenant environments should still apply the patch because the flaw is unauthenticated in scope. https://zarguell.github.io/tia-n-list/stories/sap-security-patch-day-october-2026-fixes-four-critical-vulnerab/ https://zarguell.github.io/tia-n-list/stories/sap-security-patch-day-october-2026-fixes-four-critical-vulnerab/ Tue, 13 Oct 2026 13:14:43 +0000 SAP released its October 2026 Patch Day bulletin on October 13, closing six CVEs with peak CVSS 9.9 and one Cloud SDK flaw at CVSS 10.0. CVE-2026-89107 (9.9) is a scripting injection in S/4HANA that enables full system compromise; CVE-2026-89110 and CVE-2026-89108 (both 9.9) hit Visual Compose, while CVE-2026-58249, CVE-2026-89113, and CVE-2026-89120 fill out the critical tier. The bulletin carries 16 new security notes, four GitHub security advisories, two updates to prior notes, and covers 22 CVEs total. Four of those are rated Critical. https://zarguell.github.io/tia-n-list/stories/openai-engineer-arrested-for-allegedly-planting-spy-device-in-of/ https://zarguell.github.io/tia-n-list/stories/openai-engineer-arrested-for-allegedly-planting-spy-device-in-of/ Tue, 13 Oct 2026 23:07:00 +0000 An OpenAI engineer, 35-year-old Saudi national Abdulrahman Alfozan, was charged with planting a hidden audio recording device in a company conference room to capture sensitive technology conversations. The device was discovered by OpenAI, which used its own models to trace it to the employee, fired him, referred the case to the FBI, and made an arrest within a week. The company states there is no indication of model weights, source code, or customer data being accessed. The complaint does not specify what Alfozan intended to do with captured audio. https://zarguell.github.io/tia-n-list/stories/anthropic-warns-ai-models-could-soon-self-replicate-across-smart/ https://zarguell.github.io/tia-n-list/stories/anthropic-warns-ai-models-could-soon-self-replicate-across-smart/ Tue, 13 Oct 2026 21:16:34 +0000 Anthropic's Frontier Red Team reported on October 12, 2026 that small AI models are months away from self-replicating across commercial IoT hardware with no data center involved. Authors William Zhou and Daniel Freeman split the 26-billion-parameter Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each, reaching 0.39 tokens per second, and got a 9-billion-parameter model running inference on 8 of 9 unfamiliar hardware types. https://zarguell.github.io/tia-n-list/stories/progress-fixes-31-marklogic-server-vulnerabilities-including-cvs/ https://zarguell.github.io/tia-n-list/stories/progress-fixes-31-marklogic-server-vulnerabilities-including-cvs/ Tue, 13 Oct 2026 10:15:18 +0000 Progress disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026, with the most severe carrying a CVSS 9.9 score. The bulletin covers privilege escalation that lets delegated accounts reach full admin persistence, server-side code execution, authentication bypass, credential exposure, and data compromise. Updates are MarkLogic 12.1 and 11.3.7. The vendor explicitly warns that affected instances may run normally without any prior signs of exploitation, which removes the usual pre-breach indicators defenders rely on. This is not a routine patch cycle. https://zarguell.github.io/tia-n-list/stories/chrome-155-update-patches-247-vulnerabilities/ https://zarguell.github.io/tia-n-list/stories/chrome-155-update-patches-247-vulnerabilities/ Wed, 14 Oct 2026 00:55:25 +0000 Chrome 155.0.8059.39 for Linux and 154.0.8037.39/.40 for Windows and Mac patches 247 vulnerabilities, with four critical use-after-free bugs tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347 affecting the Chromecast, Browser, Navigation, and Track components. All four critical flaws are use-after-free; one was found by Google and the other three were reported by researcher Xinyang Ge, who used AI to discover two of them. https://zarguell.github.io/tia-n-list/stories/cyberattack-prompts-ahold-delhaize-to-disconnect-systems/ https://zarguell.github.io/tia-n-list/stories/cyberattack-prompts-ahold-delhaize-to-disconnect-systems/ Tue, 13 Oct 2026 17:22:55 +0000 Ahold Delhaize, the Dutch-Belgian retail giant with more than 9,400 stores across Europe, the US, and Indonesia, disconnected some systems after identifying a security issue in its network. The company runs about 400,000 employees, serves around 60 million customers weekly, and reported over $104 billion in net sales for 2024. Disruption is visible at the brand level. Preventive measures hit deliveries and online orders at Albert Heijn and Delhaize in Belgium and the Netherlands, US operations appear affected too, and Stop & Shop employees reported trouble accessing schedules and pay stubs. https://zarguell.github.io/tia-n-list/stories/fbi-disrupts-north-korean-laptop-farm-used-to-infiltrate-us-comp/ https://zarguell.github.io/tia-n-list/stories/fbi-disrupts-north-korean-laptop-farm-used-to-infiltrate-us-comp/ Tue, 13 Oct 2026 22:00:15 +0000 Federal authorities in Texas have charged 14 people and seized 187 laptops in Operation Lonestar Roundup, the latest strike against North Korea's remote IT worker scheme. More than 40 Texas residences suspected of operating as laptop farms were searched. The farms housed employer-issued computers so North Korean engineers working abroad could access U.S. corporate networks under false identities, with U.S.-based facilitators configuring the devices and routing pay to regime-controlled accounts. An indictment unsealed in the Northern District of Ohio charges two U.S. https://zarguell.github.io/tia-n-list/stories/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-imag/ https://zarguell.github.io/tia-n-list/stories/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-imag/ Tue, 13 Oct 2026 23:58:02 +0000 CVE-2026-105445 was a flaw in Docker Hub's account-to-organization conversion. From August 26, 2024, converting a personal account also reassigned its personal access tokens to whatever existing user the converter named as the new organization's owner: the token's owner record changed, the secret never rotated, and no consent or notification was requested. An attacker could create an account, mint a PAT, convert, and name a victim, ending up with a live credential that authenticated to the registry as that victim and carried the victim's org memberships. https://zarguell.github.io/tia-n-list/stories/wazuh-4-14-8-fixes-15-vulnerabilities-including-root-rce/ https://zarguell.github.io/tia-n-list/stories/wazuh-4-14-8-fixes-15-vulnerabilities-including-root-rce/ Tue, 13 Oct 2026 18:17:45 +0000 Wazuh 4.14.8 addresses fifteen vulnerabilities, including two CVSS 9.4 flaws that enable remote code execution as root. The event points to a securityonline.info advisory. No CVEs are listed in the event, but the severity claims are explicit. A root-level RCE in a security monitoring platform is serious. Organizations running Wazuh managers should treat the 4.14.8 upgrade as urgent. Confirm whether the two critical flaws are accessible remotely or require prior authentication before assessing exposure.