GnuTLS version 3.8.13 has an incomplete X.509 implementation that allows attackers who control a subordinate Certificate Authority to bypass cross-domain Public Key Infrastructure (PKI) restrictions and issue unauthorized certificates. The vulnerability has a low severity with a CVSS score of 3.7. No affected versions are explicitly stated beyond version 3.8.13, and no patch or remediation information is provided.
A vulnerability in GnuTLS version 3.8.13 causes legitimate Certificate Authority (CA) certificates to be incorrectly rejected, resulting in a Denial of Service (DoS) condition. This issue does not impact confidentiality or integrity but can disrupt availability by preventing valid certificate validation.
CVE-2026-95116 is a denial of service vulnerability in libming versions up to 0.4.8. It is caused by an issue in the readtag_file() function in src/blocks/fromswf.c, which allows a remote attacker to crash the application. The vulnerability has a high severity with a CVSS score of 7.5.
CVE-2026-95210 is a vulnerability in GnuTLS version 3.8.13 where improper certificate validation causes the application to accept certificates containing invalid extensions. This flaw can lead to partial compromise of confidentiality and integrity. The vulnerability has a medium severity rating with a CVSS score of 4.8. No patch or remediation information is currently provided.
CVE-2026-95184 is a vulnerability in GnuTLS version 3.8.13 where improper certificate validation causes legitimate certificates to be rejected, resulting in a Denial of Service (DoS). This flaw does not impact confidentiality or integrity but disrupts availability by preventing valid users from authenticating.
A hostname verification bypass vulnerability exists in GnuTLS version prior to 3.8.13. This flaw allows attackers to circumvent the Common Name fallback mechanism, potentially enabling eavesdropping on communications when a crafted certificate is used. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-95208 is a vulnerability in wolfSSL versions 5.9.1 and 5.9.2 affecting the ConfirmNameConstraints() function. It allows attackers to cause a Denial of Service (DoS) by providing crafted Certificate Authority certificates. This leads to valid certificates without Subject Alternative Names (SAN) being incorrectly rejected by wolfSSL-based TLS clients. The vulnerability has a high severity with a CVSS score of 7.5.
libming versions through 0.4.8 have a heap buffer overflow vulnerability in the r_readc() function within src/blocks/fromswf.c. This flaw can be triggered by a crafted SWF file containing a malformed or truncated RECT header, leading to a denial of service condition. The vulnerability does not impact confidentiality or integrity but causes service disruption.
On 6 October 2026, attackers sent an unauthorized ransom note via ASOS's own app notification system, claiming to have compromised ASOS's Snowflake data platform and threatening to leak data unless paid. ASOS confirmed the unauthorized notification and restricted access to its messaging platforms, acknowledging that names and contact details may have been accessed, but payment information was not affected. The attackers used third-party platforms ASOS employs for customer communication. The incident follows a similar prior attack on Betterment, where rogue messages led to data leaks. ASOS is investigating the breach, but no proof of Snowflake compromise has been provided, and Snowflake denies platform compromise. Customers are advised to assume they are affected and be cautious of follow-on fraud and phishing attempts.
A vulnerability in Apache Geode Web Management allows insertion of sensitive information into log files. This affects versions from 2.0.0 up to but not including 2.0.3. The issue is resolved by upgrading to version 2.0.3.
FortiBleed is an ongoing global campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. Attackers gain access by scanning for exposed SSL VPN portals, performing credential stuffing and password spraying, and cracking stolen password hashes offline. Once inside, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Organizations may experience account lockouts due to attacker actions. The campaign acts as an initial-access broker with links to ransomware affiliates INC/Lynx and Payload, representing a significant medium-severity threat requiring immediate defensive measures.
A phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools. Attackers sent phishing emails with links redirecting victims to fake reference documents hosted on Power BI infrastructure. Clicking the download link led to attacker-controlled sites that fingerprinted victims' systems before downloading malicious ScreenConnect installers. Multiple ScreenConnect instances were deployed for persistent remote access, with scheduled tasks created to maintain persistence. The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, leveraging trusted Microsoft domains to bypass email security and increase credibility.
The npm package tailwindcss-animatecss-keyframes version 1.0.0 contains malicious code or depends on a malicious package. Installation or use of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
A heap buffer over-read vulnerability exists in libexpat before commit 13c5f63 in the xmlparse.c component. The vulnerability occurs because XML_ParseBuffer advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer size, allowing out-of-bounds reads of adjacent heap memory. This can disclose sensitive memory contents such as heap pointers and code pointers, potentially aiding in bypassing ASLR. The vulnerability affects specific versions of the coin3 product and related Ubuntu packages. A security update is available from Red Hat for Hardened Images RPMs addressing this issue.
The npm package 'waie-crash-baileys' contains malicious code or depends on a malicious package. Installing or running this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different machine is strongly advised.
OpenSSH versions before 10.6 contain a vulnerability where the ssh client allows special characters '$' or '\' in command-line usernames, which can lead to command injection. This flaw enables an attacker to inject arbitrary commands via specially crafted usernames. The vulnerability has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability. Ubuntu has released patches fixing this issue in OpenSSH client and server packages for multiple LTS releases. Users are advised to update to the fixed package versions to mitigate the risk.
Multiple security issues affecting the traefik package were addressed in the traefik-3.7.13-1.1 update for openSUSE Tumbleweed. These vulnerabilities have been fixed in this package version. No specific technical details or CVSS scores are provided. The overall severity is assessed as medium based on the available information.
This entry provides indicators of compromise (IOCs) related to ThreatFox for the date 2026-10-07. It is categorized as OSINT related to network activity and payload delivery. No specific malware details, vulnerabilities, or exploits are described.
A user on Reddit announced the creation of a Scripts Hub website for Roblox exploits, allowing users to post and share exploit scripts with moderator review. The announcement is a request for advice and reviews rather than a report of a specific vulnerability or active threat.
A protection mechanism failure in Google Chrome on iOS versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and impacts the integrity of web content isolation.