https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html22ceb67654e8ee2dSun, 01 Nov 2026 12:55:40 +0530Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $ [reported · The Hacker News]vulnshttps://thehackernews.com/2026/11/netamloader-malware-targets-government.htmled75cce192b3d6fcSun, 01 Nov 2026 12:32:58 +0530Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government ent [reported · The Hacker News]vulnshttps://github.com/advisories/GHSA-4xm8-rg9h-jhq2cd2cf80431be7755Fri, 30 Oct 2026 22:57:22 +0000Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading /security.json discloses the JWT signing secret, enabling admin token forgery and remote code ex — What to do: Upgrade signalk-server to 2.34.0 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories/GHSA-hff9-5pqw-6w9fe1698c89ebba49c9Fri, 30 Oct 2026 22:57:00 +0000Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original de — What to do: Upgrade github.com/imgproxy/imgproxy/v3 to 4.0.16 or later. [confirmed · GitHub Advisory Database]govulnshttps://github.com/advisories/GHSA-5xjx-3w67-w9x9b8daa8711c1dd7cfFri, 30 Oct 2026 20:24:24 +0000Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://git — What to do: Upgrade pypa/gh-action-pypi-publish to 1.14.3 or later. [confirmed · GitHub Advisory Database]ci-cdvulnshttps://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments222bb1cb62f7d340Fri, 30 Oct 2026 17:00:00 +0000This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them. [confirmed · ReversingLabs]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-118527d2279e40591fcdfcFri, 30 Oct 2026 12:00:00 +0000Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-111357dbc092ac98830251Fri, 30 Oct 2026 12:00:00 +0000Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.htmle8ad629591f0f245Fri, 30 Oct 2026 12:57:05 +0530The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (C [reported · The Hacker News]vulnshttps://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/866051d5fbe61a61Thu, 29 Oct 2026 14:38:26 -0400A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...] [reported · BleepingComputer]vulnshttps://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/7447e5f3d2cb5ceeThu, 29 Oct 2026 12:10:31 -0400A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...] [reported · BleepingComputer]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-972296a6b9dc45f9e8cb7Thu, 29 Oct 2026 12:00:00 +0000GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-76418d70528cb55377fb4Thu, 29 Oct 2026 12:00:00 +0000Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) co — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/2813eb71c29272d4Thu, 29 Oct 2026 07:10:13 -0400Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...] [reported · BleepingComputer]vulnshttps://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html72e13e190054f7a9Thu, 29 Oct 2026 16:14:46 +0530Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html430f7914607482b3Thu, 29 Oct 2026 13:54:22 +0530Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for l [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html7ab67924bae5bc4aThu, 29 Oct 2026 11:52:33 +0530The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Wa [reported · The Hacker News]vulnshttps://socket.dev/blog/searchjacked?utm_medium=feedaf5cad61947e0a6aThu, 29 Oct 2026 02:01:54 +0000319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing. [confirmed · Socket]vulnshttps://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder/0248309e4dc5c583Thu, 29 Oct 2026 00:00:00 +0000We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it. [confirmed · Datadog Security Labs]npmvulnshttps://github.com/advisories/GHSA-6jp4-8v48-cc5vdb6440d0114c0792Wed, 28 Oct 2026 21:23:44 +0000Summary The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented design. [0] However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, — What to do: Upgrade electrum to 4.8.3 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-mghf-wjfp-p5xm9b6feff8c4ed6b6fWed, 28 Oct 2026 21:14:14 +0000Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one br_table instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to a — What to do: Upgrade wasmtime to 36.0.19 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://github.com/advisories/GHSA-m665-v7pm-7grjfb59cb7f9aa5190eWed, 28 Oct 2026 21:09:50 +0000Summary A critical architectural parser differential exists in the zip crate ( (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare_path(&self.outpath, &mut outpath, None:: bool)>)?; let mut outfile = fs::File::create(&outpath)?; io::copy(file, &mut outfile)?; Ok(()) — What to do: Upgrade zip to 9.0.5 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html786b77ad2418a32fWed, 28 Oct 2026 23:38:33 +0530The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.htmla3232c7a99347bd1Wed, 28 Oct 2026 22:38:09 +0530Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every [reported · The Hacker News]vulnshttps://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/8ff41c680a1efbd3Wed, 28 Oct 2026 12:00:00 -0400Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...] [reported · BleepingComputer]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-41709cb116937801ebf97Wed, 28 Oct 2026 12:00:00 +0000Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-46300b318c5e919de6962Wed, 28 Oct 2026 12:00:00 +0000Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fra — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://thehackernews.com/2026/10/shinyhunters-exploited-oracle.htmle844a788d9dbb27eWed, 28 Oct 2026 11:34:58 +0530The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request [reported · The Hacker News]vulnshttps://github.com/advisories/GHSA-26p8-2jq9-3vq96e6fe438e5786007Tue, 27 Oct 2026 21:26:32 +0000Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a — What to do: Upgrade mlflow to 3.17.0 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/4835c3a6eab4506fTue, 27 Oct 2026 16:57:25 -0400A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...] [reported · BleepingComputer]vulnshttps://github.com/advisories/GHSA-965c-763c-88jmd108bfb74ace1ff9Tue, 27 Oct 2026 15:32:05 +0000Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with — What to do: Upgrade better-auth to 1.7.7 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories/GHSA-6v38-4h7w-rj9h8dfecbe7bc8ba1caTue, 27 Oct 2026 14:50:18 +0000Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a crypto — What to do: Upgrade authlib to 1.9.0 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-m4w4-3r8h-jw98adf8b8bb6efab933Tue, 27 Oct 2026 13:30:41 +0000Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute a — What to do: Upgrade agno to 2.3.24 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-6hp3-vr39-rqw8d38040e0ef4b6cc2Tue, 27 Oct 2026 13:30:10 +0000Summary An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String — What to do: Upgrade monai to 1.6.1 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-48356cce5d2da15c38203Tue, 27 Oct 2026 12:00:00 +0000Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-111497530c9bb270879ff2Tue, 27 Oct 2026 12:00:00 +0000Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compr — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html7ad038240c5a22daTue, 27 Oct 2026 17:02:46 +0530Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond s [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.htmld506c1a201741da2Tue, 27 Oct 2026 17:02:31 +0530The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russia [reported · The Hacker News]vulnshttps://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/de5769c04b886d25Tue, 27 Oct 2026 06:36:12 -0400​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...] [reported · BleepingComputer]vulnshttps://thehackernews.com/2026/10/australia-gets-into-amadey-malware.htmla5fedcd17b8e7de4Tue, 27 Oct 2026 15:03:06 +0530A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut [reported · The Hacker News]vulnshttps://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/3dce457a2dc2b80aTue, 27 Oct 2026 04:20:54 -0400The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...] [reported · BleepingComputer]vulnshttps://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html201c3cf322505c5fTue, 27 Oct 2026 12:04:47 +0530The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration a [reported · The Hacker News]vulnshttps://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-imagesc9dfe8552bd65f7fMon, 26 Oct 2026 22:15:00 +0000Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes. Category: Product Updates [confirmed · Aikido]vulnshttps://socket.dev/blog/threat-intel-campaign-impact?utm_medium=feed45e1feb1e77b1c31Mon, 26 Oct 2026 22:14:49 +0000Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events. [confirmed · Socket]vulnshttps://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html39585b9bd73373a9Mon, 26 Oct 2026 21:22:40 +0530Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pat [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/weekly-recap-this2shell-that2shell.htmlf04c03a3543f6bbeMon, 26 Oct 2026 19:36:13 +0530This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent p [reported · The Hacker News]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-109618a46ae7f35048f835Mon, 26 Oct 2026 12:00:00 +0000PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-10961999f82d9c47d49a27Mon, 26 Oct 2026 12:00:00 +0000PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html56b2abf328629d15Mon, 26 Oct 2026 15:24:02 +0530A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who r [reported · The Hacker News]vulnshttps://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-jsc2e94c57293554e3Sun, 25 Oct 2026 14:46:53 +0000Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution. [confirmed · Wiz]vulnshttps://www.stepsecurity.io/blog/ovhcloud-cli-github-release-swap-glassworm141f2b09d37cce25Sat, 24 Oct 2026 16:21:08 +0000An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an orphaned commit, and detonated the full chain in an isolated chamber. The replay shows [confirmed · StepSecurity]vulnshttps://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html1096e92c65aad859Sat, 24 Oct 2026 11:55:57 +0530The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the [reported · The Hacker News]vulnshttps://github.com/advisories/GHSA-897f-g5gm-fmxm53ba0e8cdeceaeaaFri, 23 Oct 2026 22:02:20 +0000Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function bod — What to do: Upgrade wasmtime to 36.0.19 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://github.com/advisories/GHSA-5x8w-8jj5-q52h81e2bf714d0eb6ceFri, 23 Oct 2026 21:55:21 +0000Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized — What to do: Upgrade pillow to 13.0.0 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-f9x3-7vq9-cph6e5e69230f8396214Fri, 23 Oct 2026 21:50:27 +0000Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially — What to do: Upgrade laravel/framework to 13.29.0 or later. [confirmed · GitHub Advisory Database]vulnshttps://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/f80b9c9527fb867aFri, 23 Oct 2026 16:55:05 -0400Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...] [reported · BleepingComputer]vulnshttps://github.com/advisories/GHSA-cxf3-9h37-7rr844a9dce2c41f3986Fri, 23 Oct 2026 20:49:37 +0000Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that co — What to do: Upgrade github.com/labstack/echo/v4 to 4.16.1 or later. [confirmed · GitHub Advisory Database]govulnshttps://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497185b8cbaff59aecbFri, 23 Oct 2026 20:45:00 +0000The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats [confirmed · Aikido]vulnshttps://github.com/advisories/GHSA-pqh8-4pj7-32xxf3f0f8bf6aa215f9Fri, 23 Oct 2026 18:29:02 +0000Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive — What to do: Upgrade obsidian-tc to 1.3.1 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories/GHSA-84c9-qqpq-2pq5e2c9516ba8106464Fri, 23 Oct 2026 17:29:17 +0000Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by pas — What to do: Upgrade obsidian-tc to 1.3.1 or later. [confirmed · GitHub Advisory Database]npmvulns