A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.
A use-after-free vulnerability exists in librsvg when XML includes contain duplicated entities. This issue affects the glycin-loaders package used in Red Hat Enterprise Linux 10.0 Extended Update Support. The vulnerability has been rated as important by Red Hat Product Security and is addressed by an update to glycin-loaders.
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update. These include sandbox escapes, use-after-free bugs, privilege escalations, information disclosures, and other memory safety issues across various components such as Graphics, DOM, JavaScript WebAssembly, Networking, and Audio/Video. The update is rated as important by Red Hat Product Security and targets Red Hat Enterprise Linux 8.6 variants.
CVE-2026-41216 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::ExecuteInformation function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported.
CVE-2026-42057 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::vtkPNGReaderUpdate2 function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported. There is no indication of public exploits or active exploitation in the wild. No patch information is provided in the available data.
CVE-2026-8822 is a high-severity memory corruption vulnerability in the vtkDEMReader ReadProfiles functionality of vtk version 9.6.1. It arises from an out-of-bounds write triggered by processing a specially crafted USGS DEM file, potentially causing a buffer overflow. This flaw allows an attacker to cause a denial of service by crashing the application. No public exploit or known active exploitation is reported. No patch or remediation information is currently available.
CVE-2026-8824 is a high-severity memory corruption vulnerability in vtk version 9.6.1. It affects the vtkBMPReader component's ExecuteDataWithInformation function, where processing a specially crafted BMP file can cause a buffer overflow. This vulnerability could lead to denial of service due to application crash or instability.
CVE-2026-9535 is an out-of-bounds read vulnerability in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted chaco file, potentially leading to a read outside the intended memory bounds. The vulnerability has a high severity rating with a CVSS score of 8.2.
CVE-2026-9536 is a heap-based buffer overflow vulnerability in the vtkWindBladeReader FindVariableOffsets functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted .wind file, potentially causing a buffer overflow condition. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.
A vulnerability in the hapijs joi JavaScript data validator affects versions from 16.0.0 up to 17.1.1 and 18.0.0 up to but not including 18.3.1. The Joi.string().email({ multiple: true }) rule uses a regular expression with inefficient complexity, causing the Node.js event loop to be blocked for seconds when processing attacker-controlled input with long whitespace runs. This can lead to denial of service by blocking other operations. The issue is fixed in version 18.3.1.
HashiCorp Nomad and Nomad Enterprise contain a vulnerability (CVE-2026-119168) involving symlink following during same-client allocation data migration. This flaw allows a malicious workload to alter permissions and ownership of host directories, potentially enabling unauthorized access or modification of host files and privilege escalation. The issue is fixed in Nomad versions 2.1.0, 1.11.12, and 1.10.18.
HashiCorp Nomad and Nomad Enterprise contain a vulnerability (CVE-2026-107347) involving improper symlink resolution during dispatch payload and executor log writes. This flaw allows a malicious workload to modify files outside its allocation directory. If the Nomad client agent runs with root privileges, exploitation could lead to root code execution on the host. The issue is fixed in Nomad versions 2.1.0, 1.11.12, and 1.10.18.
A sophisticated SEO poisoning campaign targets users searching for DeepSeek AI tools by using malicious lookalike domains on first-page search results. The attack uses a multi-stage infection chain starting with weaponized MSI files disguised as legitimate DeepSeek software, progressing through shellcode execution and DLL side-loading via legitimate Cyglaunch software, and culminating in the deployment of Kong RAT. The final payload includes keylogger functionality and persistence through registry modifications. Attribution suggests a Chinese threat actor linked to previous campaigns targeting Chinese developer tools.
The Coruna iOS exploit framework, evolving over seven months, uses two exploit chains targeting different iOS versions. It delivers malicious code through over 600 domains embedded in web pages without requiring app installation or user consent. The framework includes advanced native modules capable of kernel memory manipulation, Apple Mobile File Integrity state changes, process memory reads, encrypted command-and-control communication, and artifact deletion. A supply-chain compromise via the npm package art-template enables delivery through legitimate application infrastructure, bypassing domain-based defenses.
CVE-2026-111497 is a critical out-of-bounds write vulnerability in Google's Brotli decompression library that allows specially crafted compressed data to corrupt application memory and potentially enable remote code execution. It affects Brotli versions 1.0.3 through 1.2.0 and multiple platforms including Node.js, Bun, Python, and .NET frameworks. Exploitation attempts were observed shortly after patches were released, with proof-of-concept code demonstrating remote code execution via malicious HTTP requests and responses. The vulnerability can be triggered through various vectors such as HTTP requests with Brotli-compressed bodies, malicious server responses, and file processing workflows. Enterprise products from Palo Alto Networks and VMware are also impacted, broadening the attack surface. CISA added this vulnerability to its KEV catalog on October 27, 2026.
This investigation reveals a tech-support scam leveraging legitimate remote-access software UltraViewer and bulk-mailing software UltraMailer. A QuickBooks phishing campaign uses over 350 lookalike domains and tracking domains to direct victims to scammers attempting credential theft. UltraMailer is abused as a spamming tool with no abuse-reporting mechanism and is promoted on criminal forums. Trojanized installers containing authentic UltraViewer and UltraMailer copies, including one with njRAT malware, were found. The campaign briefly switched to another mailing service but resumed using UltraMailer after suspension. There is no evidence of developer involvement, but the findings highlight widespread criminal misuse of legitimate applications.
HashiCorp Nomad and Nomad Enterprise contain an authorization bypass vulnerability (CVE-2026-102260) affecting several read-only API endpoints. This flaw allows an authenticated user with read permissions in one namespace to access information about objects in other namespaces. The issue is fixed in Nomad Community Edition 2.1.0 and Nomad Enterprise versions 2.1.0, 1.11.12, and 1.10.18.
Critical9.2KEVMirageEPSS 99%Palo Alto Unit 42CVE-2026-109618
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP. These flaws involve improper memory handling during fatal error processing with longjmp(), allowing attackers to execute arbitrary code remotely. CVE-2026-109618 arises from uninitialized request memory after out-of-memory errors, while CVE-2026-109619 involves global memory pointing to freed regions exploitable in subsequent requests. Over 22.6 million exposed instances have been identified. Palo Alto Networks provides protections via multiple security products and recommends immediate patching. At least one European government took precautionary measures by taking its website offline. Users should consult the PHP Group’s security advisory for patching guidance.
Cisco Talos has identified a new Windows-based command-and-control (C2) framework named NIK C2 that integrates AI directly into its attack chain. This Go-based implant enables adversaries to dump credentials, capture keystrokes, and deploy screen-locking ransomware. It uses an embedded OpenAI model to analyze harvested data in real time, funding API requests by hijacking the victim's own OpenAI API keys. This integration allows continuous data collection and exploitation without offline delays, turning compromised hosts into active operational assets. The use of victim API keys also masks attacker infrastructure, complicating detection and incident response. Defenders are advised to implement continuous behavioral monitoring and update endpoint defenses accordingly.