📰 DAILY THREAT BRIEFING
Monday, October 5, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 5, 2026.

  1. OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU
    — Bleeping Computer

    OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union. […]
  2. ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
    — Dark Reading

    The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.
  3. Rejetto HFS servers now actively scanned for critical RCE flaw
    — Bleeping Computer

    Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, acco…
  4. IQVIA fined $7.8 million for failing to properly anonymize health data
    — Bleeping Computer

    Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the agency says could…
  5. Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
    — The Hacker News

    Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacke…
  6. Chinese Hackers Impersonate US Officials for AI Cyber Espionage
    — Dark Reading

    An emerging threat group known as TA419 established seemingly legitimate professional relationships with AI policy experts working for US th…
  7. ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
    — The Hacker News

    A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This wee…
  8. Need for Speed: AI-Driven Attacks Are Changing Security Strategies
    — Dark Reading

    AI-powered attacks are fast, relentless, and automated. How security teams can keep up is top of mind, according to the latest Dark Reading …
  9. The Credential Layer Is Expanding Faster Than Security Teams Can See It
    — The Hacker News

    Every modern enterprise depends on credentials. This is how humans, systems, and now AI, all connect to data, services, and each other secur…
  10. ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  11. TTY Logs and the Data it Captures, (Sun, Oct 4th)
    — SANS ISC

    For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands…
  12. User Agent Strings Curiosities, (Sun, Oct 4th)
    — SANS ISC

    Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14617 in last 30 days).
Critical: 1 · High: 5 · Medium: 14 · Low: 0. View full dashboard →

  1. CVE-2026-92821
    — CVSS 6.8 (MEDIUM)

    A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule…
  2. CVE-2026-105472
    — CVSS 6.3 (MEDIUM)

    A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Ha…
  3. CVE-2026-104038
    — CVSS 5.9 (MEDIUM)

    A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate…
  4. CVE-2026-104037
    — CVSS 5.5 (MEDIUM)

    A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-b…
  5. CVE-2026-104036
    — CVSS 5.8 (MEDIUM)

    A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can tri…
  6. CVE-2026-104035
    — CVSS 5.5 (MEDIUM)

    A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying cr…
  7. CVE-2026-104034
    — CVSS 4.7 (MEDIUM)

    A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has …
  8. CVE-2026-104033
    — CVSS 5.4 (MEDIUM)

    A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user …
  9. CVE-2026-104032
    — CVSS 5.5 (MEDIUM)

    A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and force…
  10. CVE-2026-104031
    — CVSS 5.5 (MEDIUM)

    A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker ca…
  11. CVE-2026-105785
    — CVSS 4.8 (MEDIUM)

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-ch…
  12. CVE-2026-105784
    — CVSS 4.6 (MEDIUM)

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node component…
  13. CVE-2026-105783
    — CVSS 8.0 (HIGH)

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages…
  14. CVE-2026-105782
    — CVSS 7.5 (HIGH)

    Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Py…
  15. CVE-2026-105763
    — CVSS 9.6 (CRITICAL)

    Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected…
  16. CVE-2026-105762
    — CVSS 8.3 (HIGH)

    Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and ca…
  17. CVE-2026-105471
    — CVSS 7.3 (HIGH)

    A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Ha…
  18. CVE-2026-105761
    — CVSS 7.1 (HIGH)

    Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an…
  19. CVE-2026-105760
    — CVSS 5.3 (MEDIUM)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_f…
  20. CVE-2026-105759
    — CVSS 5.9 (MEDIUM)

    vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching register…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 5, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com