📰 DAILY THREAT BRIEFING
Sunday, October 11, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 11, 2026.

  1. Nippon Columbia malware incident exposes 8.6 million karaoke fan records
    — Bleeping Computer

    Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed m…
  2. P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
    — The Hacker News

    Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compa…
  3. Cyber exec arrested in case allegedly tied to ShinyHunters hackers
    — Bleeping Computer

    Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multi…
  4. ARTEX AI, Claude agents used in cyberattacks on South Korean banks
    — Bleeping Computer

    The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetr…
  5. The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
    — The Hacker News

    In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit …
  6. Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
    — The Hacker News

    Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in …
  7. Why TLP should not replace your internal information classification, (Sat, Oct 10th)
    — SANS ISC

    The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate …
  8. FBI Arrests Executive at Ransomware Negotiation Firm
    — Krebs on Security

    Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection wit…
  9. ASOS Breach Reveals the Risks in Customer-Facing SaaS
    — Dark Reading

    The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.
  10. AI Scramble Drives Cybersecurity M&A Boom
    — Dark Reading

    Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Ma…
  11. What We Missed: FBI Strikes Back at ShinyHunters
    — Dark Reading

    In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected …
  12. ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (13770 in last 30 days).
Critical: 0 · High: 4 · Medium: 16 · Low: 0. View full dashboard →

  1. CVE-2026-108778
    — CVSS 6.3 (MEDIUM)

    A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound…
  2. CVE-2026-108777
    — CVSS 6.3 (MEDIUM)

    A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argumen…
  3. CVE-2026-108775
    — CVSS 6.3 (MEDIUM)

    A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Searc…
  4. CVE-2026-108774
    — CVSS 6.3 (MEDIUM)

    A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulatio…
  5. CVE-2026-108773
    — CVSS 6.3 (MEDIUM)

    A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argu…
  6. CVE-2026-108772
    — CVSS 5.3 (MEDIUM)

    A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation…
  7. CVE-2026-108770
    — CVSS 5.3 (MEDIUM)

    A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screensho…
  8. CVE-2026-108978
    — CVSS 5.5 (MEDIUM)

    Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.

    This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

  9. CVE-2026-108769
    — CVSS 4.3 (MEDIUM)

    A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possib…
  10. CVE-2026-108976
    — CVSS 7.8 (HIGH)

    GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for C…
  11. CVE-2026-108963
    — CVSS 8.8 (HIGH)

    databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, –result-file=/app/public/in…
  12. CVE-2026-108925
    — CVSS 6.1 (MEDIUM)

  13. CVE-2026-108768
    — CVSS 4.3 (MEDIUM)

    A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources.…
  14. CVE-2026-59508
    — CVSS 5.9 (MEDIUM)

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos.

    This issue affects i-Bos: 3.0.

  15. CVE-2026-19935
    — CVSS 7.5 (HIGH)

    The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever th…
  16. CVE-2026-19740
    — CVSS 6.5 (MEDIUM)

    The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notifi…
  17. CVE-2026-19739
    — CVSS 6.5 (MEDIUM)

    The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so t…
  18. CVE-2026-19738
    — CVSS 6.5 (MEDIUM)

    The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host not…
  19. CVE-2026-19737
    — CVSS 5.5 (MEDIUM)

    i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured withou…
  20. CVE-2026-19736
    — CVSS 7.8 (HIGH)

    The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_H…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 11, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com