Imiel Visser

Finally, the correct week to post this meme... #BlackOctober https://t.co/iNzQAfqEfN

Views

62

Likes

0

Replies

0

Reposts

0

My new sport is watching new CVE's being announced.

Views

34

Likes

1

Replies

0

Reposts

0

BLACK OCTOBER 2026 SOFTWARE & INTERNET STACK SECURITY ROUNDUP (as of 22 Oct 2026) Severity key: "CVSS x.x" = published score. "Assessed" = no single CVSS score applies (supply-chain or platform compromise) or none confirmed; rating is based on impact and whether attacks are already happening. === A. VULNERABILITIES (PATCH) === 1. GitLab (CVE-2026-110264) Severity: CVSS 10.0 - Critical Unauthenticated remote code execution, caused by a bug in GitLab's regular-expression engine. Affects every self-managed version since 7.0 (2014). Fixed in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1. https://t.co/ZuO36eiHsT already patched. No confirmed exploitation yet. Action: update self-managed instances now. Ref: https://t.co/3hvX3N1d2y 2. Apache Traffic Server (15 CVEs) Severity: up to CVSS 10.0 - Apache rates 2 Critical, 8 Important, 5 Moderate Request smuggling, TLS client-certificate identity confusion, access-control bypasses, denial of service. The two Criticals are in experimental plugins (magick, wasm). Fixed in 9.2.16 / 10.1.5 / 10.2.1. Action: upgrade if you run Traffic Server. Ref: https://t.co/dmZvu3fI6M 3. FortiMail (CVE-2026-104286) - ACTIVELY EXPLOITED Severity: CVSS 9.8 - Critical Unauthenticated attackers can write arbitrary files; exploited as a zero-day. On CISA's exploited-vulnerabilities list since 1 Oct. Fixed in 8.0.2 / 7.6.7 / 7.4.9; 7.2 users must move to 7.4 or later. Action: patch, or disable the identity-based encryption (IBE) feature and restrict access to the management interface. Ref: https://t.co/Mb01CYrtWJ 4. BeyondTrust Remote Support (CVE-2026-102764) - ACTIVELY EXPLOITED Severity: CVSS 9.3 - Critical Exploited as a zero-day by a China-linked group since 29 Aug. On CISA's exploited-vulnerabilities list since 16 Oct. Cloud (SaaS) customers patched 8-9 Oct. Action: patch self-hosted appliances. Ref: https://t.co/AXKMHQr9ni 5. Signal RingRTC (CVE-2026-113380) Severity: CVSS 9.3 (CVSS 4.0) - Critical A malicious caller can stop a call from ending, so audio (and possibly video) keeps running after the user hangs up. Fixed in RingRTC 2.72.0 (4 Sep). No known exploitation. Action: update Signal on all devices. Ref: https://t.co/ptRxhLoSwc 6. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Severity: CVSS 9.2 - Critical Unauthenticated remote code execution in PHP itself. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct). Governments took sites offline as a precaution; the NSA advised taking systems offline if they can't be patched immediately. Action: patch now. Ref: https://t.co/YpUJbNmtjR Ref: https://t.co/pKySZgWkpx 7. Plex2Shell (CVE-2026-96652/96654/96655/96656) - ACTIVELY EXPLOITED Severity: Assessed Critical (the four flaws chain into unauthenticated remote code execution; individual scores start at 5.3) Exploited a day after technical details went public on 16 Oct; attackers install crypto miners and proxy software. On CISA's exploited-vulnerabilities list since 20 Oct. Action: update Plex Media Server to 1.43.3.10861 or later. Ref: https://t.co/pQbrNT1Fx1 Ref: https://t.co/mTNSlMTY3v 8. Palo Alto GlobalProtect (CVE-2026-0257) - ACTIVELY EXPLOITED Severity: Assessed Critical (CVSS not confirmed; exploited by ransomware groups) Authentication bypass that lets attackers open unauthorized VPN sessions. Patched in May; exploited by the Qilin, Inc and Settra ransomware groups. Action: apply the May patches and hunt for suspicious VPN sessions. Ref: https://t.co/L1fp5VpUA1 9. Edge-device zero-day wave - ACTIVELY EXPLOITED Severity: Assessed Critical (scores vary by CVE) Exploited flaws in Citrix NetScaler, PAN-OS (CVE-2026-0322), Ivanti Connect Secure (CVE-2026-104935), Cisco Secure Email Gateway (CVE-2026-76519) and Fortinet FortiOS, all added to CISA's exploited-vulnerabilities list 27 Sep-16 Oct. Action: patch all edge devices. Ref: https://t.co/2pLgdSTynw Ref: https://t.co/bwaW2rltw0 10. eMudhra certificate authority key compromise (includes pip / uv / developer tools) Severity: Assessed Critical (no CVSS for the incident itself; Mozilla's Firefox fix CVE-2026-113470 is rated High; no exploitation reported) Eight intermediate certificate keys were generated so weakly they could be recovered instantly, so anyone could forge trusted HTTPS certificates. Browsers blocked them 17-20 Oct. Mozilla has removed the root (emSign ECC Root CA - G3); Chrome removes it on 27 Oct. The bigger risk is outside the browser: tools that carry their own certificate list and don't check revocation keep trusting forged certificates until updated. Someone on the same network could then impersonate a site such as https://t.co/5AbiSYfOd6 and serve a tampered package. pip always uses its own bundled certificate list, so updating the operating system does not fix it; each virtual environment has its own pip. Fixed versions: - pip 26.2.2 - certifi 2026.10.19 - uv 0.13.4 - sigstore 4.5.1 - Python 3.15.1 / 3.14.9 / 3.13.17 - Node.js 22.23.4 / 24.22.1 / 26.12.1 - Go 1.27.3 / 1.26.10 (rebuild binaries) - Rust webpki-roots 1.0.10 - NSS 3.131.1 - Composer ca-bundle 1.6.0 - OS ca-certificates packages (Debian, Ubuntu, Fedora, Alpine) Still pending at last check: Bun, FreeBSD. Java (JDK) not confirmed. Action: in every venv run python -m pip install --upgrade pip (and upgrade certifi); run uv self update; update OS ca-certificates; rebuild Docker images and Go binaries; replace any site certificates chaining to the emSign G3 root before 27 Oct. Because an old pip upgrades over the same channel, Python developers advise getting the new pip through an updated browser and checking its published SHA-256 checksum. Ref: https://t.co/oahrB7aKhl Ref: https://t.co/PSan4MdgdT Ref: https://t.co/59gTbmVNpg Ref: https://t.co/ASxhF89Qu6 Ref: https://t.co/dP0wSZDMhn 11. Windows Shell (CVE-2026-96951) - ACTIVELY EXPLOITED Severity: CVSS 8.8 - High Bypasses Mark of the Web, the Windows warning on downloaded files. Part of a record Patch Tuesday of about 1,410 fixes (13 Oct). Action: apply October Windows updates. Ref: https://t.co/Ea3EexNUA1 12. Siemens Software Center (CVE-2026-110936) - ACTIVELY EXPLOITED Severity: CVSS 8.4 (v4) / 6.7 (v3.1) - High A DLL side-loading flaw, abused in ClickFix malware campaigns that bundle the genuine signed program with malicious DLLs. Siemens' own update channels were not tampered with. Action: update, and download only from official sources. Ref: https://t.co/LrZVsejrSp 13. ISC BIND 9 (CVE-2026-94300) Severity: CVSS 8.1 - High Replayed GSS-TSIG-signed messages can corrupt memory, possibly leading to remote code execution. Mainly relevant where GSS-TSIG is used (e.g. Active Directory dynamic DNS). No known exploitation. Fixed in 9.20.30 / 9.21.27; 9.18 has no listed fix, so users must move to 9.20. Action: upgrade. Ref: https://t.co/aZvGTwJpPE 14. NGINX (CVE-2026-15176 / 93479 / 97205 + 2 more) Severity: CVSS 8.1 - High (per F5, for the top three) A remote attacker with no credentials can crash worker processes in certain configurations. Fixed in 1.30.6 (stable) / 1.31.7 (mainline), 14 Oct. Not known to be exploited. Action: upgrade. Ref: https://t.co/JScHmBhXSx 15. HTTP/3 QPACK denial-of-service (FoxIO) Severity: Assessed High (remote denial-of-service only, up to ~4,000x memory amplification) 7 of 10 tested HTTP/3 implementations affected. Fixed in quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark. Unpatched at disclosure: Bun, h3 (Rust), aioquic. Action: update affected libraries. Ref: https://t.co/TRR7ZoBT8M 16. Flax Typhoon batch (CISA exploited-vulnerabilities list, 8 Oct) Severity: Assessed High (old flaws, scores vary; e.g. ONLYOFFICE CVE-2021-3199 is 9.8) Five old flaws (BIND, ProFTPD, Apache Struts, Strapi, ONLYOFFICE) exploited by a China-linked group, with a seven-country joint advisory. Action: find and patch forgotten legacy installs. Ref: https://t.co/j5b6R5Q0P0 17. Meta Muse share links Severity: Assessed Medium (data exposure, feature now suspended) Shared chat links could be found through public DNS records; 6,800+ were found, some containing sensitive data. Meta paused sharing. Ref: https://t.co/RkcmEMOOga === B. SUPPLY-CHAIN COMPROMISES === 18. LiteLLM 1.107.0 (PyPI + Docker) Severity: Assessed Critical (credential stealer + backdoor that runs every time Python starts) The release pipeline was compromised. The package was live on PyPI for about 2 hours on 21 Oct. Last safe version is 1.106.2. Action: if 1.107.0 was ever installed, rotate all secrets and rebuild. Ref: https://t.co/Fairw594Sg 19. WordPress UpdraftCentral keys Severity: Assessed Critical (signed backdoor plugins installed on connected sites) Stolen UpdraftCentral dashboard keys were used 18-19 Oct to install backdoor plugins on connected WordPress sites. Action: delete all UpdraftCentral keys and check for unknown plugins and users. Ref: https://t.co/ikgM7PfSGB 20. OVHcloud CLI Severity: Assessed High A developer's GitHub account was hijacked; release binaries v0.11.0-v0.15.0 were replaced with a secrets stealer (19 Oct). Action: if you installed one of those, rotate all secrets on that machine. Ref: https://t.co/RCuafJdI0C 21. AOMEI Backupper / AnyViewer (UNC7017) Severity: Assessed High Update files on AOMEI's servers were swapped in 5-10 minute windows (Apr-Jul 2026), delivering a downloader and backdoor. Infected machines stay compromised even though the servers are fixed. Action: hunt for persistence on any machine running these products. Ref: https://t.co/oU7xrlEmw3 Ref: https://t.co/49ctkJFmo3 22. npm worms (tensorlake / Shai-Hulud, Miasma variant) Severity: Assessed High Self-spreading credential-stealing worms in npm packages; the Miasma variant adds a wiper that triggers if the victim revokes the stolen GitHub token. Action: pin dependency versions and audit recent installs. Ref: https://t.co/tVI3H3J84j Ref: https://t.co/1hMoH3XZrm === C. PLATFORM / INFRASTRUCTURE COMPROMISES === 23. Railway (PaaS) Severity: Assessed Critical Attackers decrypted some customer environment-variable secrets (21 Oct). Deployments paused; all Railway API tokens invalidated. Action: rotate every secret stored on Railway. Ref: https://t.co/MeBpbLW2R5 24. Zeabur (PaaS) Severity: Assessed Critical The attacker read 3,218,965 environment-variable records and gained root on 101 dedicated servers (14-15 Oct). The platform is shutting down; final date 31 Dec. Action: rotate all secrets and migrate off now. Ref: https://t.co/cSW7yMmPi1 Ref (incident report, Spanish version): https://t.co/WfxOsVTCvr 25. ConnectWise Cloud Backup (Microsoft 365) Severity: Assessed Critical A compromised vendor app credential was used to sign in to 173 Microsoft 365 tenants. Cloud Backup, SaaS Security and Cloud Management are suspended, so scheduled backups are not running. Action: review sign-ins back to at least 13 Oct. Ref: https://t.co/XWfwSWvRpL 26. IDC Frontier / IDCF Cloud (Japan) Severity: Assessed Critical Ransomware on 7 Oct hit 495 organizations; data in four zones is unlikely to be recoverable. Ref: https://t.co/rWttDn1Zyd 27. https://t.co/ufRwRyrq2P Desktop Cloud (Japan, VPS) Severity: Assessed High Malicious programs were installed on up to 26,739 customer servers. All plans shut down from 21 Oct, with no restart date. Action: rotate any secrets stored on these servers. Ref: https://t.co/X2XgZmi3eX 28. TiDB Cloud / PingCAP (managed database) Severity: Assessed High Attackers had access 9 Sep-7 Oct and took internal operational data, SQL editor text and an encrypted API-key table. PingCAP says customer databases were not affected. Action: rotate TiDB Cloud credentials. Ref: https://t.co/oVTjkaqsig Ref: https://t.co/DwLNhNELA0 29. Tor exit relays Severity: Assessed Medium (incident over) 333 compromised exit relays intercepted SSH logins and tried to install the Ebury backdoor (2-5 Oct). All were removed by 5 Oct. Action: if you logged in to SSH with a password over Tor in that window, rotate it; prefer key-based SSH. Ref: https://t.co/vnuLieUmIm

Views

437

Likes

0

Replies

0

Reposts

0

Doomsday still coming... when all your CLI, desktop coding apps and API keys get taken over and infiltrate the networks they are on.. Think I can talk to my Uber driver about this doomsday threat?

Views

57

Likes

2

Replies

1

Reposts

0

Damn, this is the coolest game site I've seen this year! https://t.co/9XXoDat1od

Views

73

Likes

1

Replies

0

Reposts

0