A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 5 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 18 October 2026 · 8 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CVSS 9.3 CRITICAL Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer toke…
Read at source →Lower-severity or unconfirmed-exploitation vulnerabilities.
CVSS 5.1 MEDIUM The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value…
Read at source →CVSS 2.3 LOW An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation p…
Read at source →CVSS 1.1 LOW A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password…
Read at source →CVSS 5.5 MEDIUM A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.c…
Read at source →Malware, campaigns and adversary tradecraft.
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]
Read at source →Ransomware, data breaches and supply-chain events.
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromi…
Read at source →Detection engineering, tooling and defensive analysis.
Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".
Read at source →