📰 DAILY THREAT BRIEFING
Friday, October 2, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 2, 2026.

  1. RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail
    — Dark Reading

    The offensive cyber operations startup looks to evolve red teaming beyond traditional methods to simulate attackers' increasingly advanced c…
  2. Frontline Education breach exposes school district employee data
    — Bleeping Computer

    Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain…
  3. Warlock ransomware breach SharePoint in water, telecom operator attacks
    — Bleeping Computer

    The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by expl…
  4. GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
    — The Hacker News

    A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain c…
  5. Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
    — The Hacker News

    Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The act…
  6. Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
    — The Hacker News

    Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploit…
  7. Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response
    — Dark Reading

    One company told customers to power down its data-protection platform during a nine-hour window, while the other remained mum on reported at…
  8. SWIFT Banking & Government Middleware Enables RCE
    — Dark Reading

    Patch middleware vulnerabilities now to avoid hardware-based MFA exploits in ultra-sensitive environments.
  9. GitLab warns of critical RCE vulnerability in AI Gateway service
    — Bleeping Computer

    GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vu…
  10. ISC Stormcast For Friday, October 2nd, 2026 https://isc.sans.edu/podcastdetail/10120, (Fri, Oct 2nd)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  11. ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
    — SANS ISC

    Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existin…
  12. ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (15074 in last 30 days).
Critical: 3 · High: 5 · Medium: 10 · Low: 2. View full dashboard →

  1. CVE-2026-105083
    — CVSS 3.9 (LOW)

    ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' …
  2. CVE-2026-105080
    — CVSS 9.9 (CRITICAL)

    In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.
  3. CVE-2026-105030
    — CVSS 5.3 (MEDIUM)

    Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. A…
  4. CVE-2026-105029
    — CVSS 4.3 (MEDIUM)

    UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' ticket…
  5. CVE-2026-104479
    — CVSS 5.4 (MEDIUM)

    Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can sub…
  6. CVE-2026-104478
    — CVSS 7.1 (HIGH)

    Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a…
  7. CVE-2026-104477
    — CVSS 6.1 (MEDIUM)

    Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can cr…
  8. CVE-2026-104476
    — CVSS 5.9 (MEDIUM)

    Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compre…
  9. CVE-2026-104475
    — CVSS 5.4 (MEDIUM)

    IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the p…
  10. CVE-2026-104474
    — CVSS 6.7 (MEDIUM)

    OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web pro…
  11. CVE-2026-104433
    — CVSS 7.5 (HIGH)

    Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length hands…
  12. CVE-2026-84411
    — CVSS 9.8 (CRITICAL)

    The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attack…
  13. CVE-2026-105051
    — CVSS 1.9 (LOW)

    Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).
  14. CVE-2026-105049
    — CVSS 5.8 (MEDIUM)

    Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.
  15. CVE-2026-105048
    — CVSS 4.0 (MEDIUM)

    The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).
  16. CVE-2026-97363
    — CVSS 7.5 (HIGH)

    The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks…
  17. CVE-2026-97212
    — CVSS 7.3 (HIGH)

    The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identi…
  18. CVE-2026-95102
    — CVSS 9.4 (CRITICAL)

    WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform un…
  19. CVE-2026-94594
    — CVSS 4.0 (MEDIUM)

    Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes i…
  20. CVE-2026-94593
    — CVSS 7.8 (HIGH)

    Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to acce…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 2, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com