High Severity Threats

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.

This report summarizes multiple cybersecurity incidents and emerging threats including AI-assisted bank breaches in South Korea, a poem-guided botnet called PoeLLM targeting AI and open-source services, a supply chain attack on the Tensorlake npm SDK, and the sentencing of the Empire Market co-founder. The PoeLLM malware uses a novel method of hiding its command-and-control server IP address encoded in a GitHub-hosted poem. The Tensorlake npm SDK was compromised to deliver a credential-stealing worm. Nvidia's DCGM Exporter had a high-severity denial-of-service vulnerability that has been patched. The South Korean bank breaches are under investigation with AI suspected to be involved. The Empire Market co-founder received a 40-year prison sentence for running a dark web marketplace. These events highlight evolving attack techniques and ongoing law enforcement actions.

Hackers hijacked the .gh, .sl, and .as country-code top-level domains (ccTLDs), modifying authoritative DNS records and obtaining unauthorized HTTPS certificates for several Google domains and other organizations. Google blocked these unauthorized certificates in Chrome and worked with certificate authorities to revoke them. The incident highlights risks associated with third-party ccTLD management and certificate issuance. Google recommends domain owners monitor Certificate Transparency logs and implement restrictive CAA DNS records to prevent future unauthorized certificate issuance.

Beginning October 7, 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to achieve unauthenticated remote code execution on exposed systems. The attackers chained these vulnerabilities together, first bypassing authentication and then executing code with SYSTEM privileges. Post-exploitation activities included deploying JSP webshells, installing XMRig cryptocurrency miners disguised as Microsoft Edge processes, and dropping an AI-assisted PowerShell script that monitors and terminates Task Manager to hide mining operations. The attackers established persistence through a fake Windows service named MicrosoftEdgeUpdateSvc and utilized a vulnerable WinRing0x64.sys kernel driver to enable kernel-level hardware access for optimized mining performance. All AhsayCBS versions through 10.3.4 are affected, with managed service providers being the primary targets.

In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials.  Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.