📰 DAILY THREAT BRIEFING
Wednesday, October 7, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 7, 2026.

  1. Ransomware recovery CEO charged over secret ransom payments
    — Bleeping Computer

    The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying th…
  2. Evolution of Web3 in Cloud Supply Chain Attacks
    — Unit 42

    Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments …
  3. Australian Gov't Weighs Mandatory AI Incident Reporting
    — Dark Reading

    In the wake of an agentic attack against its own Medicare systems, Australia's government is feeling out what regulations might look like fo…
  4. FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
    — Bleeping Computer

    The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and lockin…
  5. Citizen Lab Slams Trump Administration, 'Techno-Fascist' Executives
    — Dark Reading

    The Citizen Lab's Ron Deibert warns the US government is pushing for pervasive surveillance and says certain technology executives are all t…
  6. Anthropic Gives Vetted Defenders Fewer Claude Guardrails
    — Dark Reading

    Anthropic has merged Project Glasswing into a tiered access program for its advanced cyber LLMs, including Opus, Sonnet, and Mythos.
  7. Hackers hijack Google domains after breaching ccTLD registries
    — Bleeping Computer

    Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTL…
  8. Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
    — The Hacker News

    Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains,…
  9. Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
    — The Hacker News

    Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and re…
  10. SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
    — The Hacker News

    SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's networ…
  11. Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
    — SANS ISC

    On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access"…
  12. ShinyHunters Extorted Boeing Spin-off Prior to Arrests
    — Krebs on Security

    A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reporte…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (15616 in last 30 days).
Critical: 0 · High: 4 · Medium: 14 · Low: 2. View full dashboard →

  1. CVE-2026-94154
    — CVSS 6.1 (MEDIUM)

    The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. Thi…
  2. CVE-2026-17538
    — CVSS 5.4 (MEDIUM)

    The LatePoint – Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using …
  3. CVE-2026-107315
    — CVSS 5.3 (MEDIUM)

    pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of …
  4. CVE-2026-89322
    — CVSS 7.2 (HIGH)

    Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny re…
  5. CVE-2026-107314
    — CVSS 5.9 (MEDIUM)

    pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!pass…
  6. CVE-2026-107285
    — CVSS 5.9 (MEDIUM)

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but Netty…
  7. CVE-2026-107284
    — CVSS 3.7 (LOW)

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebS…
  8. CVE-2026-107283
    — CVSS 3.7 (LOW)

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with…
  9. CVE-2026-107232
    — CVSS 7.5 (HIGH)

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel …
  10. CVE-2026-107230
    — CVSS 7.4 (HIGH)

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fi…
  11. CVE-2026-105820
    — CVSS 5.4 (MEDIUM)

    Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in ot…
  12. CVE-2026-105818
    — CVSS 5.9 (MEDIUM)

    Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a …
  13. CVE-2026-105816
    — CVSS 8.0 (HIGH)

    Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory confi…
  14. CVE-2026-76286
    — CVSS 5.3 (MEDIUM)

    In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that too…
  15. CVE-2026-76280
    — CVSS 6.3 (MEDIUM)

    In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "sc_admin" Splunk role…
  16. CVE-2026-76279
    — CVSS 4.3 (MEDIUM)

    In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal…
  17. CVE-2026-76278
    — CVSS 4.3 (MEDIUM)

    In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permi…
  18. CVE-2026-76277
    — CVSS 4.1 (MEDIUM)

    In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible…
  19. CVE-2026-76276
    — CVSS 4.3 (MEDIUM)

    In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Clou…
  20. CVE-2026-76275
    — CVSS 4.3 (MEDIUM)

    In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, i…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 7, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com