12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com
📰 Cybersecurity News Headlines
Top stories from leading cybersecurity publications as of October 12, 2026.
-
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
— Bleeping Computer
Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully … -
Prominent Ransomware Negotiator Faces Extortion Charges
— Dark Reading
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money. -
Yandex confirms service outage as users lose access to cloud files
— Bleeping Computer
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two faciliti… -
Anthropic takes risky AI tests offline after models breach govt sites
— Bleeping Computer
Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access followin… -
No Identity, No Recovery: Cyber Resilience Starts With IAM
— Dark Reading
The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink. -
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
— The Hacker News
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testi… -
Passing the Baton: Dark Reading Names New Editor-in-Chief
— Dark Reading
Fahmida Y Rashid will keep the momentum going as she leads Dark Reading. -
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
— The Hacker News
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a… -
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
— The Hacker News
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked t… -
ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132, (Mon, Oct 12th)
— SANS ISC
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. -
Why TLP should not replace your internal information classification, (Sat, Oct 10th)
— SANS ISC
The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate … -
FBI Arrests Executive at Ransomware Negotiation Firm
— Krebs on Security
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection wit…
🪲 NVD — Last 20 Scored Vulnerabilities
Latest scored CVEs from the National Vulnerability Database (14156 in last 30 days).
Critical: 3 · High: 4 · Medium: 12 · Low: 1. View full dashboard →
-
CVE-2026-96012
— CVSS 9.9 (CRITICAL)
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malic… -
CVE-2026-95837
— CVSS 7.8 (HIGH)
containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instea… -
CVE-2026-41510
— CVSS 7.2 (HIGH)
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/b… -
CVE-2026-109575
— CVSS 9.8 (CRITICAL)
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transpo… -
CVE-2026-109425
— CVSS 5.3 (MEDIUM)
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle… -
CVE-2026-109424
— CVSS 5.9 (MEDIUM)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly docume… -
CVE-2026-109423
— CVSS 7.4 (HIGH)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic… -
CVE-2026-109422
— CVSS 8.1 (HIGH)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplie… -
CVE-2026-108926
— CVSS 6.3 (MEDIUM)
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The atta… -
CVE-2026-108924
— CVSS 4.3 (MEDIUM)
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The man… -
CVE-2026-108923
— CVSS 6.3 (MEDIUM)
A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a ma… -
CVE-2026-104774
— CVSS 5.8 (MEDIUM)
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the oct… -
CVE-2026-104364
— CVSS 3.3 (LOW)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation. -
CVE-2026-104332
— CVSS 5.5 (MEDIUM)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table -
CVE-2025-27902
— CVSS 6.1 (MEDIUM)
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform u… -
CVE-2025-27897
— CVSS 6.1 (MEDIUM)
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the… -
CVE-2025-27896
— CVSS 6.1 (MEDIUM)
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the… -
CVE-2025-27895
— CVSS 6.1 (MEDIUM)
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering … -
CVE-2026-87744
— CVSS 9.1 (CRITICAL)
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodPropert… -
CVE-2026-85471
— CVSS 6.4 (MEDIUM)
A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay applic…
Source: NVD CVE API 2.0
Generated by CryptXNet.ai Threat Intelligence Platform · October 12, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com
Leave a Comment