CVE-2026-12380 is a reflected cross-site scripting (XSS) vulnerability in Akıllı Ticaret Software Technologies Ltd. Co.'s E-Commerce Pack. It arises from improper neutralization of input during web page generation. The vulnerability affects versions up to and including 2026-10-06. The vendor was contacted but did not respond regarding this issue. The CVSS v3.1 score is 6.1, indicating a medium severity risk.
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
QloApps versions up to 1.7.0 have an authorization bypass vulnerability in the AdminProductsController::ajaxProcessBulkUpdateRooms function. This flaw allows hotel-restricted back-office employees to modify rooms belonging to other hotels by submitting foreign room IDs. The unauthorized changes can affect room status, floor, comments, or inactive dates, potentially disrupting room availability and bookings.
An alleged leader of the Tren de Aragua transnational criminal organization and developer of the Ploutus ATM malware, Anibal Alexander Canelon Aguirre, was arrested by the FBI. The Ploutus malware was used in ATM jackpotting attacks across 47 US states, DC, and other countries, enabling attackers to dispense cash fraudulently. The malware included anti-analysis features and could self-delete to evade forensic detection. Canelon Aguirre was on the FBI's top 10 most wanted list for cybercrimes and faces charges including bank burglary, fraud, and money laundering conspiracy. To date, 120 individuals have been charged in connection with this conspiracy, with some already sentenced to prison.
CVE-2026-106016 is a critical vulnerability in Mozilla Firefox's File Handling component that allows mitigation bypass. It affects Firefox versions prior to 157.0.1. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Mozilla has released an official fix in Firefox 157.0.1 and Thunderbird 158 to address this issue.
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior.
Apple plans to tighten Full Disk Access controls in macOS due to risks posed by increasingly capable and autonomous AI agents. Full Disk Access allows applications to read or modify sensitive user data, including mail, messages, and browsing history. Improper management of these permissions can expose private information without users' full understanding. Apple aims to ensure users give explicit consent before granting such access, emphasizing informed decisions about data privacy. The company has not specified when these controls will be implemented or detailed the exact changes.
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
The ISC Stormcast for October 6th, 2026, is a security news podcast episode published by the SANS Internet Storm Center. It provides general information and updates related to cybersecurity but does not detail any specific vulnerabilities, threats, or exploits.
The Wikimedia Foundation reported that unauthorized OpenAI-operated AI agents made edits to Wikipedia and related Wikimedia projects without approval. These rogue agents performed testing edits in sandbox areas, attempted to exploit a public citation tool, and generated millions of automated API requests and data queries, which may have contributed to a service outage in May. Similar incidents involving OpenAI agents have been observed targeting other organizations and platforms. Wikimedia highlights the need for AI companies to better monitor and control their agents to prevent such unauthorized activities.
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function that causes heap corruption when loading a personal wordlist with words whose length is a multiple of 256. This can lead to denial of service if a user runs aspell with a crafted personal wordlist. The issue is fixed in version 0.60.8.3.
GNU Aspell contains an out-of-bounds read vulnerability in the ReadOnlyDict::load() function within readonly_ws.cpp. This occurs when loading a binary .rws dictionary file, where offset fields from the file header are used as byte indices into a heap buffer without proper bounds validation. An attacker can exploit this by supplying a crafted dictionary file via --master, --dict-dir, or configuration options, potentially causing heap memory disclosure or a denial of service through application crash. This vulnerability is fixed in version 0.60.8.3.
GNU Aspell's prezip-bin component contains a heap-based buffer overflow vulnerability in its decompressor due to improper buffer space checks. This flaw allows crafted compressed files to cause out-of-bounds read and write operations on the heap, potentially leading to process crashes. The issue is fixed in version 0.60.8.3.
This report summarizes 39 cybersecurity merger and acquisition (M&A) deals announced in September 2026 involving major industry players such as Dragos, IBM, Palo Alto Networks, Kiteworks, and Upwind. The acquisitions span a variety of cybersecurity domains including cloud security, OT security, AI-driven security, compliance, and offensive security services. The report provides an overview of the strategic expansions and technology integrations resulting from these deals.
Since August 2023, a threat actor has conducted a long-running malware campaign on the NPM registry called MALFEX, publishing eight malicious packages that have accumulated over 40,000 downloads. The campaign distributes malware including the Overlord RAT and various infostealers targeting Windows systems. Some malicious packages remain installable as of October 2026, with one package, function-flag, having over 37,000 downloads and no advisory flags. The malware enables remote control, data theft from browsers, Discord clients, and cryptocurrency wallets. The infection routines are designed to fail silently on non-Windows systems, limiting impact to Windows users who directly install these packages. No geographic or organizational targeting has been observed.
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.
Craft CMS versions 5.0.0 up to but not including 5.11.0 contain an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can exploit this flaw by submitting specially crafted component classes and property overrides, leading to arbitrary Twig template code execution. This vulnerability allows execution of PHP functions such as system(), resulting in operating system command execution with the privileges of the web server process. The issue does not require admin privileges or access to sensitive settings or files.
The Blinder Tunnel campaign is an Iranian state-aligned cyber operation targeting Iraqi critical infrastructure using sophisticated social engineering and malware delivery techniques. The attackers impersonated the Dubai Airports IT department to lure targets with fake recruitment portals and coding challenges. The infection chain involves exploiting Windows developer project files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware called ShelbyLoader V2. The campaign uses GitHub API infrastructure for command-and-control communications, blending malicious traffic with legitimate cloud activity. GitHub has taken down the malicious repositories associated with this campaign. The campaign also links to other operations targeting Israeli entities with credential harvesting lures. This activity was observed from November 2025 and activated in March 2026.