Security News — 27 October 2026

Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Exploited

Yes — CISA KEV

Product

Google Chromium WebP

Impact

Out-of-bounds write

Action

Patch per vendor / CISA KEV

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-1643…

CISA Adds Two Known Exploited Vulnerabilities to Catalog

Exploited

Yes — CISA KEV

Product

Adobe Commerce and Magento

Impact

Unrestricted file upload

Action

Patch per vendor / CISA KEV

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability…

CVE-2026-117532 — CRITICAL (CVSS 9.3)

Impact

Authentication bypass

Action

Patch when a fix is available; monitor exposure

CVSS 9.3 CRITICAL REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-t…

EPICS Base

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following version…

Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines

Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding syst…

OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests

OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]

3 Frameworks to Protect CISOs & Orgs Against AI Liability

Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.

Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills

Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.

Scalable Vector Grief

I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.

CISA Publishes Significant Updates to ScubaGear and ScubaGoggles

Japan's GMO urges customers to shut down PCs amid ransomware threat

The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today. [...]

External Teams Chats Anchor 15-Minute Malware Delivery

Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.

SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack

A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.

Apple Patches for October 2026, (Mon, Oct 26th)

Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.

From federal SOCs to Talos: Ryan Fetterman on practical security research

What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.

What is CUI? A Contractor’s Perspective

<p>Three questions every government contractor should be able to answer about CUI—how to identify it, when to mark it, and how to handle it correctly. In this blog, we answer all three from a contractor’s perspective.</p>

ISC Stormcast For Tuesday, October 27th, 2026 https://isc.sans.edu/podcastdetail/10152, (Tue, Oct 27th)

Hiding Capabilities in AI Models

Interesting research: “ AI Models Can Provably Hide Arbitrary Capabilities ” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilit…