📰 DAILY THREAT BRIEFING
Thursday, October 8, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 8, 2026.

  1. FBI disrupts Chinese hacking tools used to breach critical infrastructure
    — Bleeping Computer

    The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and F…
  2. 'AgentCorruption' Puts AWS Environments At Risk With Single Prompt
    — Dark Reading

    A now-patched vulnerability in AWS Bedrock AgentCore could allow an attacker to use one AI chatbot to take over an organization's entire fle…
  3. Ransomware attack disrupts Japan's IDCF Cloud used by govt clients
    — Bleeping Computer

    IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware …
  4. Low-cost Android phones ship with residential proxy malware
    — Bleeping Computer

    A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded i…
  5. Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting
    — Dark Reading

    The first cybercriminal to ever make the FBI's "10 Most Wanted Fugitives" list allegedly infused Tren de Aragua's violent criminal operation…
  6. FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
    — The Hacker News

    Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and…
  7. Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
    — Dark Reading

    Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.
  8. ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
    — The Hacker News

    The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a…
  9. Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
    — SANS ISC

    We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new …
  10. Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
    — The Hacker News

    Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaw…
  11. ISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Evolution of Web3 in Cloud Supply Chain Attacks
    — Unit 42

    Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments …

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14555 in last 30 days).
Critical: 6 · High: 7 · Medium: 5 · Low: 2. View full dashboard →

  1. CVE-2026-96207
    — CVSS 10.0 (CRITICAL)

    Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
  2. CVE-2026-94510
    — CVSS 9.9 (CRITICAL)

    Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
  3. CVE-2026-88131
    — CVSS 9.8 (CRITICAL)

    Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
  4. CVE-2026-83947
    — CVSS 7.7 (HIGH)

    Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
  5. CVE-2026-83943
    — CVSS 8.7 (HIGH)

    Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
  6. CVE-2026-77900
    — CVSS 9.8 (CRITICAL)

    Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
  7. CVE-2026-69435
    — CVSS 9.6 (CRITICAL)

    Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
  8. CVE-2026-107731
    — CVSS 5.5 (MEDIUM)

    SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or…
  9. CVE-2026-107730
    — CVSS 5.5 (MEDIUM)

    SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating …
  10. CVE-2026-107729
    — CVSS 5.5 (MEDIUM)

    SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the…
  11. CVE-2026-107728
    — CVSS 7.5 (HIGH)

    Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom …
  12. CVE-2026-107727
    — CVSS 3.7 (LOW)

    Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally com…
  13. CVE-2026-107651
    — CVSS 5.5 (MEDIUM)

    A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by entic…
  14. CVE-2026-89091
    — CVSS 8.8 (HIGH)

    A flaw was found in ansible-core. When installing a collection with
    `ansible-galaxy collection install`, the archive extractor validates member
    paths using lexical path normalisation (os.path.abspath) instead of resolvin…
  15. CVE-2026-87980
    — CVSS 3.1 (LOW)

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.
  16. CVE-2026-84891
    — CVSS 5.9 (MEDIUM)

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.
  17. CVE-2026-84875
    — CVSS 7.5 (HIGH)

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
  18. CVE-2026-84249
    — CVSS 9.8 (CRITICAL)

    IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
  19. CVE-2026-84247
    — CVSS 8.1 (HIGH)

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
  20. CVE-2026-84246
    — CVSS 8.1 (HIGH)

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 8, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com