The double colon
CISA adds exploited Atlassian Data Center flaw to must-patch list
Oct 16, 2026
CVE-2026-21589 is a critical arbitrary file access flaw (CVSS 9.3) in Atlassian Data Center products — Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye — that threat actors started exploiting in early October (Security Affairs). watchTowr’s analysis found the trick: double-colon sequences treated as path separators, so ..::..::WEB-INF::web.xml becomes a directory traversal — in one Crowd deployment researchers read crowd.properties and minted themselves a Jira admin. Federal agencies must patch by October 18.
Oct 18CISA deadline
9.3CVSS v4.0
The hosted one got hit first
China-nexus crew exploited BeyondTrust zero-day since August
Oct 15, 2026
BeyondTrust disclosed CVE-2026-102764 (CVSS 9.3), an improper origin validation flaw in Remote Support’s internal messaging that lets unauthenticated attackers perform file operations — exploited as a zero-day since August 29 by ARMORY CASTLE, the suspected China-nexus group formerly tracked as UNC5221 (SOCRadar). Mandiant saw the crew escalate to root, drop a PHP webshell (SAWFLY), harvest credentials through the bt-secrets CLI, and systematically delete logs; the BT26-05 patch shipped October 8.
9.3 (Critical)CVSS v4.0
Aug 29Exploitation began
The firewall needs a firewall
Palo Alto patches actively exploited PAN-OS management zero-day
Oct 15, 2026
CVE-2026-0322 (CVSS 8.6) lets an authenticated attacker with network access to the PAN-OS management interface execute code as root on PA-Series, VM-Series, Panorama and M-Series appliances — Palo Alto confirms very limited exploitation in the wild (brief). CISA added it to the known-exploited catalog with an October 17 federal deadline; the vendor’s real advice is the oldest one in the book — get the management interface off the internet.
A million meters
CenterPoint Energy breach hits 1.06 million Texans
Oct 15, 2026
CenterPoint told the Texas Attorney General that 1,062,060 residents had names, addresses, Social Security numbers and driver’s license numbers exposed after an unauthorized third party pulled customer data through an external-facing system (Security Affairs). The company learned of it in September when a forum actor claimed 7.49 million stolen records; electric and gas delivery was never disrupted.
Patch the patch
AhsayCBS backup flaws chained in the wild as first fixes fall short
Oct 14, 2026
CVE-2026-105133 (authentication bypass) chains with CVE-2026-105134 (command injection through the Replication Receiver's UpdateReceivers.do endpoint) to give remote attackers OS commands on backup servers — both hit CISA's exploited catalog today with an October 17 patch deadline (threat brief). Ahsay's own October 12 advisory admits the earlier patches (v9.15.2.59, v10.3.4.0) didn't fully close the holes: the real hotfixes are v10.3.4.45 and v9.15.2.70, plus a reboot.
The gate is open
Cisco Secure Email Gateway flaw lets unauthenticated attackers write files
Oct 14, 2026
CVE-2026-76519 is a relative path traversal in Cisco Secure Email Gateway that lets an unauthenticated remote attacker write arbitrary files to the appliance's underlying OS — added to CISA's known-exploited catalog today (brief). An email security gateway that hands out filesystem writes to strangers is about as bad as perimeter bugs get; restrict management access and patch now.
Office suite, shell access
OS command injection in Collabora Online's CODE server
Oct 14, 2026
New today: CVE-2026-110447 is an OS command injection flaw in Collabora Online's CODE server — the built-in office suite many Nextcloud installs ship with (CVE feed). The Nextcloud forum is urging admins to update ASAP; a document editor that runs shell commands is a short path from a shared spreadsheet to a compromised server.
The familiar prompt
ICMacOS goes from infostealer to persistent RAT
Oct 14, 2026
The fake System Preferences dialog asks for your password and checks it against your login Keychain. SOCRadar's teardown says the newer build turns that foothold into a persistent RAT, holding on through a LaunchAgent with a live WebSocket shell.
Busy Tuesday
Microsoft patches a record 1,413 flaws, one already exploited
Oct 14, 2026
October's zero-day is CVE-2026-96951, a Windows Shell flaw already being exploited that strips the Mark of the Web tag so a malicious file opens with no warning. CISA added it to its known-exploited catalog on Tuesday, ordering federal agencies to patch by October 16.
fewer than 1,413All of 2025
past 4,0002026 so far
The font did it
WhatsApp hardens PDF fonts in fallout from Apple's CoreGraphics zero-day
Oct 13, 2026
WhatsApp 26.38.74 adds extra checks on embedded fonts inside PDF attachments — hardening tied to CVE-2026-86950, the CoreGraphics zero-day Apple patched September 28 after 'extremely sophisticated' targeted attacks first flagged by Meta's own Product Security team (analysis). A public PoC is now circulating (crash-only so far), so anything still below iOS 26.7.1, Tahoe 26.7.1, or Sequoia 15.8.1 should move.
Active exploit
macOS screen sharing flaw exploited to mine Monero
Oct 13, 2026
The Netherlands' national cyber security centre reported active abuse of CVE-2026-65400 on Macs with port 5900 reachable from the internet, where attackers gained root and dropped a Monero miner. Apple patched the flaw back in August in Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but the fix ships as a point release, so it takes a manual update rather than the automatic security-update setting.
When backups bite back
Commvault CVFS flaw could run unwanted commands
Oct 13, 2026
The flaw is CWE-78 OS command injection in Commvault's CVFS component — the file system both Commvault Cloud and Grid run on — scored a critical 9.3 and published today (CVE-2026-77099). The fix is a maintenance-release upgrade, Cloud to 11.46.30 and Grid's CVFS to 5.0.14.5, which Canada's Cyber Centre is also urging today.
Known exploited
CVE-2026-104935 in Ivanti Connect Secure under active exploitation
Oct 13, 2026
CISA has added CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog today. The flaw hands a remote attacker arbitrary command execution without ever logging in.
Session hijack
GhostProfile clones Chrome profiles to browse unseen on macOS
Oct 13, 2026
Moonlock Lab disclosed GhostProfile on October 12, a macOS hidden-VNC implant that clones the victim's Chrome or Firefox profile and drives the disposable copy through Chrome DevTools Protocol and WebDriver BiDi, with no delivery vector or attribution known yet. The ghost browser carries the victim's cookies, so the operator browses their live logins with nothing appearing in the victim's own window.