A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 12 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 29 October 2026 · 34 items.
Urgent Vulnerabilities 9
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CISA Current Activity29 Oct
KEV · exploited
- Exploited
- Yes — CISA KEV
- Product
- GitLab Community Edition and Enterprise Edition
- Impact
- Integer overflow
- Audience
- DevOps/CI admins
- Action
- Patch per vendor / CISA KEV
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerabi…
Read at source →
Palo Alto Unit 4229 Oct
KEV · exploited
- Exploited
- Yes — CISA KEV
- Product
- PHP Group PHP
- Impact
- Use-after-free
- Audience
- Linux/server admins
- Action
- Patch per vendor / CISA KEV
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated…
Read at source →
CVEDatabase - Critical CVEs29 Oct
CriticalCVSS 9.8
CVSS 9.8 CRITICAL · Vendor: IBM IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Read at source →
CVEDatabase - Critical CVEs29 Oct
CriticalCVSS 9.9
CVSS 9.9 CRITICAL · Vendor: IBM IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
Read at source →
CVEDatabase - Critical CVEs29 Oct
CriticalCVSS 9.9
CVSS 9.9 CRITICAL · Vendor: IBM IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
Read at source →
CVEDatabase - Recent CVEs29 Oct
HighCVSS 8.8
- Impact
- Remote code execution
- Audience
- Windows admins
- Action
- Patch when a fix is available; monitor exposure
CVSS 8.8 HIGH · Vendor: Microsoft A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collecto…
Read at source →
CVEDatabase - Recent CVEs29 Oct
HighCVSS 8.7
- Impact
- Remote code execution
- Audience
- Windows admins
- Action
- Patch when a fix is available; monitor exposure
CVSS 8.7 HIGH · Vendor: Microsoft A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector se…
Read at source →
CVEDatabase - Recent CVEs29 Oct
HighCVSS 8.7
CVSS 8.7 HIGH Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
Read at source →
CVEDatabase - Critical CVEs29 Oct
CriticalCVSS 9.8
CVSS 9.8 CRITICAL · Vendor: IBM IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.
Read at source →
Threat Activity 17
Malware, campaigns and adversary tradecraft.
CISA Cybersecurity Advisories29 Oct
KEV · exploited
View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attac…
Read at source →
Cisco Talos29 Oct
Exploited
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
Read at source →
CISA Cybersecurity Advisories29 Oct
KEV · exploited
View CSAF Summary Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confi…
Read at source →
CISA Cybersecurity Advisories29 Oct
View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows.…
Read at source →
BleepingComputer29 Oct
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. [...]
Read at source →
Dark Reading29 Oct
An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.
Read at source →
Microsoft Security Blog29 Oct
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption.…
Read at source →
Microsoft Security Blog29 Oct
IDC has named Microsoft a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The post IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor As…
Read at source →
The Hacker News29 Oct
Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabili…
Read at source →
BleepingComputer29 Oct
OpenAI says it won't reduce usage limits for the $100, $200, and $500 ChatGPT Pro plans, as well as Business Premium, and it also promised to keep Dots usage independent. [...]
Read at source →
BleepingComputer29 Oct
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to…
Read at source →
Dark Reading29 Oct
Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products.
Read at source →
Dark Reading29 Oct
This installment of the Reporters' Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for better training to educating next-generation workforces on modern risks and emerging thr…
Read at source →
The Hacker News29 Oct
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks an…
Read at source →
Dark Reading29 Oct
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.
Read at source →
The Hacker News29 Oct
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves…
Read at source →
Cisco Talos29 Oct
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work.
Read at source →