📰 DAILY THREAT BRIEFING
Friday, October 9, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 9, 2026.

  1. FBI Arrests Founder of Ransomware Negotiation Firm
    — Krebs on Security

    Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection wit…
  2. ASOS Breach Reveals the Risks in Customer-Facing SaaS
    — Dark Reading

    The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.
  3. Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
    — Bleeping Computer

    Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers tha…
  4. AI Scramble Drives Cybersecurity M&A Boom
    — Dark Reading

    Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Ma…
  5. Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
    — The Hacker News

    Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source m…
  6. FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
    — The Hacker News

    The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunte…
  7. What We Missed: FBI Strikes Back at ShinyHunters
    — Dark Reading

    In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected …
  8. Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
    — Bleeping Computer

    Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform t…
  9. FBI arrests another suspected ShinyHunters hacker after agency breach
    — Bleeping Computer

    The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI system…
  10. P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
    — The Hacker News

    Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compa…
  11. ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
    — SANS ISC

    We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new …

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14214 in last 30 days).
Critical: 5 · High: 6 · Medium: 8 · Low: 1. View full dashboard →

  1. CVE-2026-108474
    — CVSS 9.8 (CRITICAL)

    In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
  2. CVE-2026-92705
    — CVSS 7.8 (HIGH)

    Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the …
  3. CVE-2026-62376
    — CVSS 8.1 (HIGH)

    Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains …
  4. CVE-2026-57458
    — CVSS 8.1 (HIGH)

    Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code…
  5. CVE-2026-108264
    — CVSS 9.1 (CRITICAL)

    Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/…
  6. CVE-2026-108263
    — CVSS 9.9 (CRITICAL)

    Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in co…
  7. CVE-2026-108261
    — CVSS 9.3 (CRITICAL)

    Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into a…
  8. CVE-2026-108260
    — CVSS 7.6 (HIGH)

    Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without valid…
  9. CVE-2026-108259
    — CVSS 8.2 (HIGH)

    Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that UR…
  10. CVE-2026-107857
    — CVSS 4.4 (MEDIUM)

    Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr…
  11. CVE-2026-107856
    — CVSS 4.5 (MEDIUM)

    CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester i…
  12. CVE-2026-107854
    — CVSS 5.4 (MEDIUM)

    Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricti…
  13. CVE-2026-107851
    — CVSS 4.3 (MEDIUM)

    Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHa…
  14. CVE-2026-107850
    — CVSS 4.3 (MEDIUM)

    Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as ContaoCoreBundleSecurityVoterDataContainerPreviewAccessVoter although the shipped…
  15. CVE-2026-107848
    — CVSS 3.5 (LOW)

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. B…
  16. CVE-2026-107845
    — CVSS 9.3 (CRITICAL)

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listC…
  17. CVE-2026-107844
    — CVSS 5.3 (MEDIUM)

    Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBa…
  18. CVE-2026-107843
    — CVSS 5.3 (MEDIUM)

    Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying …
  19. CVE-2026-107842
    — CVSS 5.3 (MEDIUM)

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected…
  20. CVE-2026-75351
    — CVSS 7.5 (HIGH)

    OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 9, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com