The Prime Mover – Backup and Migration WordPress plugin (versions up to 2.2.1) is vulnerable to PHP Object Injection via unsafe deserialization of untrusted input stored in comment content. An unauthenticated attacker can submit a crafted base64-encoded serialized object through the comment submission endpoint, which is later unserialized without restrictions during plugin export or restore operations. This leads to a critical remote code execution risk without requiring additional plugins or themes.
The User Profile Builder plugin for WordPress up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with Author-level access or higher can assign themselves or others privileged roles such as Editor via the Gutenberg Register block due to improper server-side authorization. The vulnerability arises because the plugin does not adequately restrict role assignment for roles lacking certain high-level capabilities, allowing unauthorized role elevation.
A malicious file identified by the SHA-256 hash b5149190ab5cdfcee95c4aa201bdd0229f426d3bbf6d2cd45d0e983f120b94b7 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was seen 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash d5d4249912afc83472420ec77c8a97081800436df1e31d14bb814649e084e061 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The threat is an indicator of compromise (IOC) rather than a vulnerability or exploit itself. No known exploits or threat actors are associated with this hash, and no affected software versions or countries are specified.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc. This file was observed 10 times on October 24, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The threat is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash 31087290fc269af7921f9591418ac5d0baff3304bc3a18bc7b614546766586e9 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information on affected software versions or known exploits in the wild. The file hash serves as an indicator of compromise (IOC) to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 792a633371540ee9695ed6923f566de4a41cdaec6883e5b537d8ef848ee8636e was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or geographic targeting are indicated. No known exploits in the wild or threat actors are associated with this indicator at this time.
A malicious file identified by the SHA-256 hash 0616c20dea0ff2bd59fff5b60b3e907231d8c99296d0a0c719ba553f83dbd056 was observed 10 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is provided.
A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
In October 2026, critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP affecting multiple supported versions. These vulnerabilities allow unauthenticated attackers to execute code remotely due to out-of-memory corruption and stale global state issues. Emergency security updates were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Mitigations exist but are incomplete; updating to the fixed versions is strongly recommended. Additional incidents involving LiteLLM, eMudhra, GitLab, Railway, and Zeabur were also reported in the same timeframe. The PHP project continues to address these issues with further advisories and release candidates.
CVE-2026-115929 is a high-severity vulnerability in MongoDB Compass caused by improper certificate validation due to the inclusion of recoverable eMudhra intermediate CA certificates in the Electron runtime's TLS root certificate store. This issue is resolved by updating to Compass version 1.53.1, which includes Electron 44.9.1.
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
CVE-2026-115938 is a high-severity vulnerability in Craft CMS affecting versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2. It involves improper neutralization of special elements in the template engine, allowing authenticated control panel users to exploit a sandbox bypass in Twig templates. This leads to leakage of the GeneralConfig::securityKey and enables offline computation of HMAC signatures, which can then be used to pass signed parameters to unsandboxed template rendering, potentially invoking native PHP callables.
CVE-2026-115937 is a high-severity vulnerability in the Craft CMS commerce-mollie plugin where the Mollie webhook endpoint fails to verify the association between two attacker-controlled parameters: commerceTransactionHash and id. This flaw allows an unauthenticated attacker with any paid Mollie payment ID from the merchant's account to mark arbitrary transactions as paid, regardless of the actual payment amount.
CVE-2026-115801 is an out-of-bounds read vulnerability in Kakao khaiii versions 0.1 through 0.4. It occurs in the khaiii::nn::Linear::open function within the JSON Config File Handler component. The flaw arises from improper handling of the hidden_dim/class_num arguments, allowing a local attacker with write access to the resource directory to cause an out-of-bounds read. This vulnerability affects unsupported versions of the product and has a medium severity score of 4.8. Exploit code has been publicly released, but exploitation requires local access and the ability to modify the resource directory, which is already a trusted input. The vendor notes that with such access, an attacker can alter analysis results even without exploiting this vulnerability.
CVE-2026-115935 is a high-severity code injection vulnerability in CraftCMS that allows authenticated non-admin users with control panel access to inject a new security key into the .env file via crafted API response headers. This enables the attacker to forge signed login redirects containing Twig system() callbacks, potentially leading to remote code execution. The vulnerability affects CraftCMS versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2.
CVE-2026-115897 is a cross-site scripting (XSS) vulnerability in the yahoo serialize-javascript library prior to version 7.1.3. The issue arises because the function-source escaping logic fails to neutralize a bare closing-script prefix when attacker-controlled function source text ends exactly at that prefix. This can allow an attacker to inject live HTML elements into a page if they control the serialized function's source text, such as via a spoofed toString() method. The vulnerability has a low CVSS score of 2.1 and requires high attack complexity and partial user interaction. It is fixed in version 7.1.3.
CVE-2026-115895 is a high-severity code injection vulnerability in the capricorn86 happy-dom JavaScript library. Versions from 17.0.0 up to but not including 21.0.4 improperly validate named ESM import aliases, allowing attacker-controlled input to execute arbitrary code in the Node.js host process when enableJavaScriptEvaluation is enabled. This issue is a residual path from an earlier incomplete fix and is resolved in version 21.0.4.
The Arrakis 2026 Autonomous Agents Threat Report reveals that a significant majority of enterprise autonomous agents remain dormant yet retain active credentials, posing security risks. Notably, 76% of agents have not run in 60 days but still have valid credentials and active triggers. Additionally, 24% of dormant agents can be activated externally via unsigned webhooks, and 20% can delegate tasks to other agents with higher permissions, potentially bypassing intended access controls. The report highlights a common operational gap where agent credentials and approvals are not revoked or expired after inactivity, unlike employee access which is promptly removed upon departure.
CVE-2026-115893 is a critical vulnerability in the bytecodealliance wasmtime runtime for WebAssembly on aarch64 platforms using the Cranelift compiler backend. Versions prior to 36.0.19, between 37.0.0 and before 48.0.7, and between 49.0.0 and before 49.0.4 are affected. The flaw allows a user-controlled WebAssembly module to escape the sandbox by exploiting an incorrect conditional branch target when compiling a br_table instruction with more than approximately 256,000 targets. This can lead to arbitrary code execution outside the sandbox. The issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.