VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.
Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.
CVE-2026-115722 is a vulnerability in the diegonehab rply library up to version 1.1.4 involving improper validation of array indices in the ply_read_header_property() function. This flaw allows crafted PLY files to trigger out-of-bounds accesses in ply_read_list_property(), potentially causing crashes during ASCII parsing or memory corruption during binary parsing.
Vvveb CMS versions 1.0.8.6 and earlier contain a path traversal vulnerability in the backup controller's nextRestore() and nextBackup() functions. These functions accept a file parameter that is concatenated to the backup directory path without proper sanitization, allowing an authenticated administrator to read arbitrary files or write SQL dump content to arbitrary locations. This flaw contrasts with other related functions that correctly sanitize file names. The issue has been patched in a subsequent commit.
Between July and September 2026, a sophisticated campaign targeted Microsoft 365 accounts using adversary-in-the-middle attacks and token replay techniques. Attackers captured sign-in sessions via AiTM relays and replayed stolen tokens from IP addresses linked to a German hosting provider. The campaign compromised 79 organizations with 497 successful sign-ins amid over 200,000 failed attempts. Malicious actors registered rogue Entra devices, replaced victim MFA methods, and created hidden inbox rules to conceal their activities. The operation evolved through four phases, rotating IP addresses and employing scripted token and browser session replay techniques. Compromised accounts were used for business email compromise, including sending payroll-related emails to external contacts.
TRUST#GRAFT is a sophisticated malware attack targeting authenticated WordPress administrator browser sessions. It uses JavaScript loaders that mimic Cloudflare verification screens to fingerprint browsers, harvest credentials, and profile environments. Upon detecting an active WordPress admin session, it extracts CSRF tokens and uploads a malicious plugin disguised as 'Web Media Optimizer.' The PHP backdoor persists by copying itself to the must-use plugins directory, injects remote JavaScript into public pages, provides token-gated admin access, and hides from standard plugin management interfaces. This attack leverages existing trusted sessions without authentication bypass and involves coordinated infrastructure across multiple domains.
MythicRatatoskr is a Go-based backdoor leveraging the Yggdrasil mesh network for encrypted, decentralized command and control communications. It was deployed in a coordinated attack involving UAC-0099 and Sandworm targeting a Ukrainian grain logistics company in mid-2025. The backdoor provides typical malicious capabilities such as command execution, file transfer, screenshot capture, and SOCKS5 proxying. The attack sequence included initial access via spearphishing, backdoor deployment, and a subsequent destructive data-wiping phase using SDelete via Active Directory Group Policy. This incident marks the first known use of Yggdrasil by state-aligned threat actors for C2 communications.
In October 2026, the autonomous AI penetration-testing agent ARTEX was used by the Storm-0940 actor, linked to Chinese state interests, to target IT and software vendors. The attacks focused on identity providers such as Okta, Entra, and Cognito. Techniques included mapping applications via JavaScript bundles and source maps, probing authentication mechanisms, manipulating OAuth callbacks, password spraying, abusing account recovery endpoints, and testing tenant isolation. Sessions lasted 24-30 hours with automatic IP rotation upon blocking. The agent exhibited automated step chaining, output-based adaptation, and relentless iteration. Attacks involved coordinated bursts with unique user agents and rapid attempts targeting software engineers across many users.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
A China-linked advanced persistent threat (APT) group known as Storm-0940 has been using the open source AI penetration testing tool Artex to automate attacks targeting ConnectWise customers. The campaign, active since at least 2021 and intensified since September 2026, involved password spraying, OAuth application abuse, and reconnaissance at machine speed. The attackers gained privileged access to multiple Microsoft 365 tenants by abusing compromised ConnectWise application credentials. ConnectWise suspended several cloud services in response. The threat actor established persistence by modifying application credentials, enabling continued access even after remediation efforts. Hundreds of organizations across multiple sectors were targeted, including aerospace, defense, financial services, and government. Microsoft and other security firms have documented the attack techniques and recommended monitoring service principal sign-ins and directory changes for suspicious activity.
This entry is a daily podcast update from the SANS Internet Storm Center dated October 23, 2026. It does not contain specific information about a security vulnerability, exploit, or threat. The content primarily serves as a news or informational update without technical details or actionable threat intelligence.
The securityheaders.com API is no longer accepting new API keys and is effectively deprecated. Users are advised to switch to an alternative API provided by https://httpsornot.com, which offers similar functionality for checking HTTP security headers with a rate limit of 120 requests per hour per IP without requiring an API key. The new API uses a different JSON response format and grading system. This change does not represent a security vulnerability but rather a service discontinuation and migration notice.
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in Plug.Crypto validates argument types in a function-head guard. A failed guard makes the Erlang VM raise FunctionClauseError with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward.
Two entry points take request data. Plug.Crypto.verify/4 exposes the secret key base when the token is neither a binary nor nil, which Phoenix.Token.verify/4 reaches because it forwards the token unguarded. Plug.Crypto.secure_compare/2 exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker.
This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1.
A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.
CVE-2026-89320 is a high-severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the HmacShaCryptor.Hash function fails to hash its input and always returns the MAC of an empty message under the key. This flaw causes the authentication tag in AES-CBC-HMAC JSON Web Encryption (JWE) to be constant per key and independent of the message, effectively removing ciphertext integrity.
CVE-2026-89319 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the Decrypt function improperly validates a 64-bit plaintext length read from a protected header field. This can cause panics due to truncated or oversized values, leading to unbounded memory allocation or slice-bounds errors.
CVE-2026-25784 is a critical vulnerability in Hallo Welt! GmbH BlueSpice container images (versions 5.2.3 up to but not including 5.2.7). It arises from an insecure default initialization of the $mwsgTokenAuthenticatorServiceCIDR setting, which disables IP restrictions on internal service authentication if the related environment variable is unset. This allows any user with read access, including anonymous users on public wikis, to obtain an application token via the REST API and escalate privileges to sysop level.
CVE-2026-25716 is a missing authorization vulnerability in Hallo Welt! GmbH BlueSpice affecting the BlueSpiceUserManager extension. Authenticated users without special privileges can block or unblock arbitrary user accounts, including administrators, via REST endpoints that do not verify permissions. This can lead to denial of service by locking out administrators or unauthorized removal of blocks imposed by administrators. The issue affects BlueSpice versions from 5.0.0 before 5.1.11 and from 5.2.0 before 5.2.7.
