In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them.
The XCPE botnet was a large-scale malware operation involving over 1.3 million set-top boxes infected with a backdoor developed and operated by Videostrong Technology Co., an Android device manufacturer. The backdoor enabled criminal affiliates to conduct ad-fraud, create residential proxy networks, and install additional malware. The botnet infrastructure spanned multiple years and device models. Google and industry partners dismantled the botnet, banned Videostrong from Android certification, and improved firmware integrity reviews for Android TV devices to prevent recurrence.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.
In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.
This report summarizes 37 cybersecurity mergers and acquisitions (M&A) deals announced in October 2026 involving companies such as Absolute Security, Aikido Security, Anthropic, Cohere, Hex-Rays, IonQ, and Proofpoint. The deals focus on expanding capabilities in endpoint security, AI-powered attack simulations, firmware security, confidential AI, quantum computing security, and data protection platforms. No specific vulnerabilities or active threats are detailed in this roundup.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
A vulnerability (CVE-2026-98432) has been identified in the Linux implementation of Multipath TCP (MPTCP), a TCP extension introduced in 2020 to allow multiple network paths for a single TCP connection. MPTCP enables seamless switching between network interfaces and better bandwidth utilization. The vulnerability concerns the Linux MPTCP implementation as specified in RFC 8684. No specific exploit details or impact scenarios are provided. MPTCP is primarily observed in iOS/iPadOS and is detectable by inspecting TCP option 30 in network traffic.
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
The Florida Department of Education's student financial aid website was breached, potentially exposing personal data of approximately 4.9 million individuals. The compromised data may include names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, and gender codes. The breach was discovered on October 19, 2026, and has since been contained. The department has not disclosed the attack vector or threat actor. Existing student aid and disbursements remain unaffected.
A phishing campaign impersonates OpenAI by sending fake ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fraudulent payment pages hosted on compromised WordPress sites under Nexcess's nxcli.io infrastructure. Attackers monitor submitted credit card details in real time and dynamically request one-time passwords (OTPs) to complete fraudulent transactions. The campaign uses multiple redirect domains and identical client-side code across instances to steal credit card information and OTPs.
Chainlit version 2.12.0 contains a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to bypass path-scoped MCP allowed_urls restrictions by exploiting improper validation of semicolon characters in URLs. Attackers can submit specially crafted URLs with '..;' segments to the /mcp endpoint, enabling requests to unauthorized paths on origins that strip semicolon path parameters. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity.
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
LaraDashboard versions before 1.4.9 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with post.create or post.edit permissions can inject malicious scripts via unsanitized LaraBuilder design_json block content. This allows script or event-handler markup to execute in administrator or Superadmin sessions when viewing the builder, preview, or page. The vulnerability is fixed in version 1.4.9.
LaraDashboard versions before 1.4.5 have an incorrect authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows administrators without Superadmin privileges but with settings.edit permission to perform Superadmin-only core upgrade operations. Exploitation enables access to backup, download, restore, and upgrade actions that can expose database dumps containing password hashes and allow site restoration or upgrades.
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
python-jose versions up to 3.5.0 contain a critical authentication bypass vulnerability due to improper verification of cryptographic signatures. The issue arises because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets, allowing attackers to forge JSON Web Tokens (JWTs) with arbitrary claims when the verification key is empty. This flaw affects HS256, HS384, and HS512 algorithms and can lead to unauthorized access if exploited.