A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 3 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 24 October 2026 · 7 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CVSS 9.8 CRITICAL The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace rout…
Read at source →CVSS 9.4 CRITICAL A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argum…
Read at source →Lower-severity or unconfirmed-exploitation vulnerabilities.
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111…
Read at source →Malware, campaigns and adversary tradecraft.
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and…
Read at source →Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machi…
Read at source →Ransomware, data breaches and supply-chain events.
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2…
Read at source →Industry, executive and AI-security perspective.
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google s…
Read at source →