Genesys experienced a cyberattack involving unauthorized access to internal business systems, including a learning management system and a customer relationship management environment. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not compromised, and customer and partner data within those platforms remain secure. The attackers accessed and likely downloaded business and account information used to manage customer relationships, including names, phone numbers, business emails, job titles, and company information. Genesys contained the incident by suspending the LMS platform and confirmed full containment by October 23, 2026. The investigation is ongoing, and customers are cautioned to watch for phishing attempts impersonating Genesys.
A flaw in OpenAI's context compaction process allowed researchers to transfer reasoning traces between AI models, enabling the cheaper distillation of rival AI models. This technique, called compaction smuggling, bypassed initial mitigations and was fixed by OpenAI in October 2026. The vulnerability enabled extraction of proprietary reasoning data from advanced models and its reuse in weaker models, facilitating large-scale copying of AI capabilities. This has been exploited by Chinese entities to develop competitive AI systems, raising national security concerns.
Mattermost versions up to 11.9, 11.1.9, 11.5.8, and 11.10.7.0 contain a vulnerability where the Zoom chat line length is not properly validated before slicing. This improper check can be exploited by an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription with short continuation lines.
CVE-2026-97200 is a high-severity vulnerability in the benoitc hackney HTTP client library affecting versions from 2.0.0-beta.1 up to but not including 4.9.0. It involves improper handling of highly compressed or oversized HTTP response bodies, allowing a malicious server to exhaust client memory by sending a large or compressed response that is buffered and decompressed without limits. This can lead to resource exhaustion on the client side. The issue is fixed in version 4.9.0.
CVE-2026-115693 is an improper certificate validation vulnerability in the hackney_ssl module of benoitc hackney. It allows an on-path attacker to impersonate a server pinned to a private certificate authority by exploiting the acceptance of certificate chains ending in a publicly trusted root. The hostname check remains enforced, requiring the attacker to have a publicly trusted certificate for the pinned hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.
CVE-2026-113440 is a vulnerability in the benoitc hackney HTTP client library versions from 2.0.0 up to but not including 4.9.0. It allows a redirecting server to capture basic authentication and cookie credentials when a redirect occurs on the same host but changes scheme (e.g., HTTPS to HTTP) or port. This happens because the library reissues requests with credentials after comparing only the hostname, exposing sensitive headers in cleartext or to unintended services.
CVE-2026-115700 is a Server Side Request Forgery (SSRF) vulnerability in the benoitc hackney library affecting versions from 4.0.1 up to but not including 4.9.0. The flaw arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots, allowing bypass of allowlist checks and unintended connections to internal IP addresses. This issue was introduced as a fix attempt for a previous vulnerability (CVE-2026-47076) but still allows certain malformed IP literals to bypass validation. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9 and is fixed in version 4.9.0.
CVE-2026-112880 is an HTTP Request/Response Splitting vulnerability in the hackney HTTP client library. It occurs because the proxy_auth_fun callback's return value is written into the Proxy-Authorization header without sanitization, allowing injection of CR, LF, or NUL bytes. This can lead to additional header lines being added to requests sent to an HTTP CONNECT proxy. The issue affects hackney versions from 2.0.0 up to but not including 4.9.0 and was fixed in version 4.9.0.
CVE-2026-116283 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19. The flaw exists in the Local API component, specifically in the /profiles file, and can be exploited remotely. Upgrading to version 5.2.0 mitigates this issue.
CVE-2026-107656 is a critical authentication bypass vulnerability in Fortinet FortiSandbox versions 4.2.x, 4.4.x, and 5.0.x. It allows an attacker to execute unauthorized code or commands by sending crafted HTTP requests. The flaw affects both on-premises FortiSandbox and FortiSandbox PaaS versions within the specified ranges. An official fix is available to address this issue.
Harbor versions prior to 2.15.3, 2.14.5, and 2.13.6 contain a Server-Side Request Forgery (SSRF) vulnerability in the webhook delivery component. An authenticated attacker with ProjectAdmin permissions can configure webhooks to target internal private or link-local IP addresses. When triggered, Harbor's jobservice makes unauthenticated HTTP POST requests to these targets. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata.
CVE-2026-108529 is an inefficient algorithmic complexity vulnerability in the HTTP/2 implementation of the mtrudel bandit server. An unauthenticated remote attacker can exhaust the server CPU by sending many small SETTINGS or connection-level WINDOW_UPDATE frames, causing the server to perform costly O(n²) operations when retrying blocked sends. This affects bandit versions from 0.3.4 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
A critical vulnerability (CVE-2026-59107) exists in the vSolution Matrix file sharing feature of WolfVision Cynap Pro and Cynap Core Pro devices configured as main/master stations. The flaw involves a shared cryptographic trust configuration that could allow an attacker with the matching private key to authenticate via SSH as root. This affects versions prior to 1.78a and version 0. A fix is available in version 1.78a.
CVE-2026-110499 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.6 up to but not including 1.14.0. It involves allocation of resources without limits or throttling, where an unauthenticated remote attacker can cause unbounded growth in per-connection memory and CPU usage by specifying a large SETTINGS_HEADER_TABLE_SIZE. This leads to quadratic CPU cost per connection due to the HPACK encoder table resizing and linear scanning of response headers. The issue is fixed in version 1.14.0.
This content is a thematic cybersecurity analysis using Christopher Nolan's film adaptation of The Odyssey as an allegory to illustrate various cybersecurity concepts and threats. It draws parallels between characters and events in the story and common cyber threats such as ransomware, Trojan horses, VPN usage, social engineering, DDoS attacks, and advanced persistent threats (APTs). The narrative uses metaphorical language to educate about digital hygiene and security principles rather than describing an actual technical vulnerability or active threat.
CVE-2026-109584 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit that allows unauthenticated remote attackers to exhaust server memory. The flaw arises from improper handling of highly compressed HPACK HEADERS blocks, where a small compressed block can cause excessive memory allocation by repeatedly referencing a large cookie value. This affects bandit versions from 0.3.3 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-111103 is an improper cleanup on thrown exception vulnerability in the HTTP/2 handler of the mtrudel bandit server. It allows unauthenticated remote attackers to bypass per-connection resource limits by sending a single TCP write containing multiple frames, one of which triggers a stream error. This causes the server to roll back certain connection state variables, effectively ignoring some streams and allowing more concurrent streams than intended. The issue affects bandit versions from 1.9.0 up to but not including 1.14.0.
CVE-2026-111101 is a high-severity vulnerability in mtrudel bandit's HTTP/1.1 chunked body reader. It allows unauthenticated remote attackers to exhaust server memory and CPU by sending requests with many small 1-byte chunks. The vulnerability arises because the chunked reader accumulates each chunk without limits, causing excessive memory and CPU usage. This affects bandit versions from 0.1.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
CVE-2026-113436 is an inefficient algorithmic complexity vulnerability in the header integer parser of the mtrudel bandit HTTP server. An unauthenticated remote attacker can exploit this by sending extremely large numeric values in headers such as content-length or Host, causing excessive CPU consumption. This affects versions from 1.0.0-pre.7 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-110314 is a vulnerability in the mtrudel bandit WebSocket connection handling where client-side enforcement incorrectly allows continued execution of WebSocket handler code after the server has sent a Close frame. This flaw enables a remote client to send data frames that are processed despite the server intending to close the connection, potentially allowing unauthorized actions such as admin-only operations. The issue affects bandit versions from 0.5.1 up to but not including 1.14.0 and is fixed in version 1.14.0.