📰 DAILY THREAT BRIEFING
Saturday, October 10, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 10, 2026.

  1. Cyber exec arrested in case allegedly tied to ShinyHunters hackers
    — Bleeping Computer

    Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multi…
  2. ARTEX AI, Claude agents used in cyberattacks on South Korean banks
    — Bleeping Computer

    The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetr…
  3. Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
    — Bleeping Computer

    Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Cr…
  4. The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
    — The Hacker News

    In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit …
  5. Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
    — The Hacker News

    Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in …
  6. Why TLP should not replace your internal information classification, (Sat, Oct 10th)
    — SANS ISC

    The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate …
  7. FBI Arrests Executive at Ransomware Negotiation Firm
    — Krebs on Security

    Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection wit…
  8. ASOS Breach Reveals the Risks in Customer-Facing SaaS
    — Dark Reading

    The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.
  9. AI Scramble Drives Cybersecurity M&A Boom
    — Dark Reading

    Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Ma…
  10. Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
    — The Hacker News

    Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source m…
  11. What We Missed: FBI Strikes Back at ShinyHunters
    — Dark Reading

    In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected …
  12. ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14239 in last 30 days).
Critical: 0 · High: 0 · Medium: 20 · Low: 0. View full dashboard →

  1. CVE-2026-108680
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can sup…
  2. CVE-2026-108679
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. …
  3. CVE-2026-108678
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET …
  4. CVE-2026-108677
    — CVSS 6.5 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the …
  5. CVE-2026-108676
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers…
  6. CVE-2026-108675
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can se…
  7. CVE-2026-108674
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. At…
  8. CVE-2026-108673
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /ai…
  9. CVE-2026-108672
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Lo…
  10. CVE-2026-108671
    — CVSS 6.5 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain re…
  11. CVE-2026-108670
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers c…
  12. CVE-2026-108669
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply…
  13. CVE-2026-108668
    — CVSS 5.4 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can …
  14. CVE-2026-108667
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PU…
  15. CVE-2026-108666
    — CVSS 5.4 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can o…
  16. CVE-2026-108665
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or…
  17. CVE-2026-108664
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerat…
  18. CVE-2026-108663
    — CVSS 4.3 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attacke…
  19. CVE-2026-108662
    — CVSS 5.4 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supp…
  20. CVE-2026-108661
    — CVSS 6.5 (MEDIUM)

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 10, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com