Vulnerabilities
CVE-2026-61500: Rejetto HFS Predictable Session Key Gives Unauthenticated Admin and RCE, Probed Within a Day
Rejetto HFS 3.x signs sessions with a key derived from Math.random() and leaks its outputs at login, letting unauthenticated attackers forge admin sessions and run server-side JavaScript; scanning from China began October 1.
Atlassian CVE-2026-21589: Unauthenticated File Read Hits Eight Data Center Products
Atlassian's emergency advisory for CVE-2026-21589, a CVSS 9.3 pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center.
DirtyAH6, TUNderflow, PPPoEject, DiagSpill: Four Public Linux Kernel Root Exploits Land in the Networking Stack
Researcher Asim Manizada published working local-root exploits for four Linux kernel networking-stack flaws, three reachable via unprivileged user namespaces, one via SCTP diag with no special privileges.
CVE-2026-72018: AI Agent Turns a 16-Byte Linux Kernel Zero-Write Into Local Root
XBOW's autonomous agent found and weaponized a missing bounds check in the Linux kernel's DIBS loopback driver (SMC-D), escalating a constrained out-of-bounds write to root via cred structure corruption.
SubQuery's @subql/common Hijacked on npm: Credential Stealer and Reverse Shell in 5.8.3
A malicious @subql/[email protected] on npm steals cloud, SSH, GitHub and Kubernetes credentials, opens a reverse shell, and persists by injecting a rogue GitHub Actions workflow with stolen tokens.
CVE-2026-88779: NetScaler SAML Memory Overflow Zero-Day Crashes Auth, Hits Freshly Patched Appliances
Citrix confirms exploitation of a NetScaler ADC/Gateway SAML memory overflow (CVSS 8.7) that crashes authentication services; honeypot data suggests appliances patched for the previous batch are also being hit.
AhsayCBS CVE-2026-105134: Unauthenticated OS Command Injection (CVSS 10) in Backup Server
A CVSS 10 OS command injection in the AhsayCBS Replication Receiver endpoint allows unauthenticated remote code execution on backup servers up to 10.3.2. Upgrade to 10.3.4.
Zammad CVE-2026-102489 and CVE-2026-102490: Session Hijack to Root Chain Exploited in DIVD Breach
Two Zammad zero-days chain a session hijack into RCE and local root; DIVD says an autonomous AI agent used them to breach its network, CISA added both to KEV, and the root flaw reportedly has no patch.
GitLab AI Gateway CVE-2026-90970: Prompt Template Sandbox Escape Gives Command Execution
GitLab patches CVE-2026-90970, a CVSS 9.9 Jinja2 prompt-template sandbox escape in self-hosted AI Gateway that lets an authenticated Duo Agent Platform user run arbitrary commands on the host.
Dell Container Storage Modules: Two CVSS 10 Missing-Authentication Flaws Expose Kubernetes Storage Admin Credentials
Dell's DSA-2026-448 fixes two maximum-severity missing-authentication bugs in the CSM Authorization module that let unauthenticated attackers take over storage arrays behind Kubernetes clusters.
MikroTik RouterOS CVE-2026-84411: Pre-Auth Integer Underflow in Web Management Gives Root RCE
CISA's ICS advisory ICSA-26-272-06 flags a CVSS 9.8 pre-authentication integer underflow in the RouterOS web management service that a single crafted HTTP request can turn into root code execution or a crash.
Warlock Ransomware Crew Keeps Breaking In Through SharePoint, Hits Water and Telecom Operators
Symantec ties the China-linked Storm-2603 (Longlegs) crew to new Warlock ransomware intrusions at a water utility and a telecom, using SharePoint access, a vulnerable K7 driver, VS Code tunnels and SYSVOL deployment.
FortiMail CVE-2026-104286: Unauthenticated Path Traversal Exploited as Zero-Day
Fortinet confirms in-the-wild exploitation of CVE-2026-104286, a CVSS 9.8 path traversal in FortiMail that lets unauthenticated attackers write arbitrary files. Patches are not yet released; CISA set a October 4 deadline.
TeamViewer Patches Five High-Severity Flaws, Including Remote Session Access Control Bypass to RCE
TeamViewer bulletin TV-2026-1010 fixes five high-severity client and host flaws, led by CVE-2026-92370, a remote-session access control bypass that can lead to code execution. Update to 15.82.
Cisco Catalyst SD-WAN Manager CVE-2026-76504: Unauthenticated Admin API Access Exploited
Cisco confirms in-the-wild exploitation of CVE-2026-76504, a CVSS 9.8 URL-encoding auth bypass that hands unauthenticated attackers admin API access on Catalyst SD-WAN Manager. No workaround; CISA added it to KEV.
CVE-2026-89775: KVM/arm64 Nested-Virtualization Bug Gives Guests Read-Write Access to Host Kernel Memory
A type-truncation bug in KVM/arm64's stage-1 page-table walk lets a guest keep a writable mapping to a freed host kernel page, enabling guest-to-host escape on ARM64 hosts with nested virtualization enabled.
Branch Target Reuse: New Spectre v2 Variant Leaks Linux Root Password Hash Through the cBPF JIT
VUSec's Branch Target Reuse abuses stale indirect-branch predictions over freed JIT memory to leak a root password hash from Linux in 3-5 minutes; kernel fixes for CVE-2026-64507 and CVE-2026-64508 are merged.
MemTensor MemOS Packages Backdoored with sckit, a Go Credential-Stealing Worm, on npm and PyPI
Malicious releases of MemTensor's MemOS OpenClaw plugin (npm) and MemoryOS (PyPI) deliver sckit, a cross-platform Go implant that steals 13 credential types and carries worm templates for npm, PyPI and GitHub Actions.
Cloudflare Containers Bug Let One Tenant Read Another Tenant's Disk Data
A misconfigured Linux dm-thin storage pool let any Cloudflare Workers Paid customer recover unzeroed residual disk blocks from other tenants' Containers, Sandboxes, and Browser Rendering instances — exposing SQLite databases, .env files, and credentials.
CVE-2026-88771 & CVE-2026-88772: Unauthenticated RCE Zero-Days Hit Every NetScaler Deployment
Citrix confirms two NetScaler ADC/Gateway zero-days under active exploitation — one an unauthenticated command-execution bug present in every default configuration, the other a DTLS memory overflow enabled by default on VPN virtual servers.