A highly critical access bypass vulnerability (CVE-2026-118539) in the Drupal Commerce Core module is actively exploited in the wild. This flaw allows unauthenticated attackers to bypass access controls on certain routes and entity fields, potentially leading to financial impact for online store vendors. The vulnerability affects Commerce Core 3.x versions prior to 3.3.13 and earlier 8.x-2.x releases before 8.x-2.41. Drupal urges administrators to update to fixed versions and audit their store orders for inconsistencies. The module is widely used on over 42,000 sites. Drupal assigned a high risk score of 21 out of 25 to this vulnerability. No detailed exploitation methods or attacker identities have been disclosed.
An exploit targeting Exasol Database version 7.1.30 enables command execution. Limited technical details are available, and no affected versions or patch information are provided.
Automotive Shop Management System version 1.0 is affected by a SQL injection vulnerability. This vulnerability allows an attacker to manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification.
Synametrics Syncrify version 6.2 is associated with a command execution security issue. Specific technical details and affected versions are not provided, and no patch information is available.
An SQL injection (SQLi) exploit targeting pizzafy version 1.0 has been identified. The exploit allows attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification.
A vulnerability in Siemens Software Center allowed attackers to pair a legitimate signed copy of the software with malicious DLLs to infect Windows PCs. The flaw, CVE-2026-110936, involves improper DLL search path restrictions, enabling local authenticated attackers to execute arbitrary code with Software Center privileges. Siemens released version 4.0.9.8 to fix the issue, with automatic updates for existing users. The attacks are linked to the Romulus ClickFix malware campaign, which uses social engineering to trick users into executing malicious commands. Siemens confirmed no breach of their distribution channels and is sharing threat intelligence with authorities and security vendors.
A critical vulnerability (CVE-2026-85097) in the Bricksforge WordPress plugin allows unauthenticated attackers to upload arbitrary files and execute malicious code, potentially taking full control of affected WordPress websites. The flaw affects versions 3.1.8.9 and earlier and was patched in version 3.1.8.10. Exploitation attempts have been observed in the wild since October 7, 2026, involving automated attacks from multiple IP addresses. Bricksforge is a commercial add-on used by approximately 6,000 websites. The vulnerability has a CVSS score of 9.8, indicating critical severity.
Threat actors are exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. The exploited flaws include a critical authentication bypass (CVE-2026-105133) and a medium-severity OS command injection (CVE-2026-105134). These vulnerabilities affect versions up to and including 10.3.4, despite fixes reportedly available in 10.3.2. Attackers chain these vulnerabilities to gain unauthorized access and execute malicious code, deploying XMRig miners disguised as legitimate services and using obfuscation techniques to evade detection. The attacks have targeted at least five organizations as of October 7, 2026. No official patch status from the vendor is confirmed at this time.
Krayin CRM version 2.2.4 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows unauthorized attackers to bypass authentication and configure administrative settings via a specific API endpoint. Exploit code is publicly available demonstrating how to create an admin user without proper authorization.
Ecava_ntegraXor version 16.0.701.10 contains a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code on the affected system remotely.
Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. [...]
A remote code execution (RCE) vulnerability identified as CVE-2026-86060 affects MikroTik RouterOS versions 7.0 up to but not including 7.23.4, and versions 7.24.0 up to but not including 7.24.2. Exploit code leveraging this vulnerability is publicly available, involving MikroTik CHR 7.23.3 (x86_64) and Python3-paramiko on Kali Linux 2025.x. No official patch or vendor advisory details are provided.
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. [...]
A stack-based buffer overflow vulnerability (CVE-2026-7273) in ZyXEL GS1900 switches has been exploited by a Chinese threat actor to exfiltrate sensitive information from nearly 1,000 devices worldwide. The vulnerability allows unauthenticated OS command execution via crafted HTTP requests. ZyXEL released patches for ten GS1900 models in June 2026. The attacker used an obfuscated Python script targeting firmware versions 2.10 to 2.90, extracting hashed root credentials and configuration data. Over half of the compromised devices used factory default credentials, increasing risk. The US CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating patching within three days for federal agencies. The same threat actor also exploited other vulnerabilities in Ubiquiti devices and WordPress installations. The threat actor is suspected to be linked to the Red Heron group.
Three high-severity vulnerabilities in JFrog Artifactory have been exploited in the wild to bypass authentication and gain administrative privileges. These flaws allow attackers to deploy backdoors, create persistent admin accounts, and execute arbitrary code. The vulnerabilities, identified as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329, have been patched by JFrog. Multiple threat actors have chained these vulnerabilities to escalate privileges and maintain persistent access on self-hosted Artifactory instances. The Cybersecurity and Infrastructure Security Agency (CISA) has added these CVEs to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch within two weeks. Organizations are strongly advised to update to the fixed versions immediately.
Two zero-day vulnerabilities in PaperCut NG/MF were exploited in AI-powered attacks by a Russian-speaking threat actor targeting hundreds of organizations worldwide. The flaws allowed remote unauthenticated attackers to bypass authentication and execute arbitrary code. The attacker used AI to rapidly build, test, and deploy exploits, compromising 440 deployments across 48 countries, primarily in the education sector. Credential harvesting, secret exfiltration, and domain admin privilege escalation were observed. The vulnerabilities were disclosed and patched shortly after, but the campaign demonstrated rapid exploitation using AI automation.
The BlueMoon exploit kit is a modular tool used by multiple cyber-espionage groups to chain zero-day vulnerabilities in Microsoft Windows and Google Chrome. It combines two Chromium-based browser flaws allowing remote code execution and sandbox escape with a Windows kernel local privilege escalation. Observed since August 2026, BlueMoon has been deployed by Chinese state-sponsored actors targeting NGOs, aerospace, defense, and manufacturing sectors. The kit exploits delays in Chrome stable releases to weaponize recent Chromium fixes. It executes payloads by elevating Chrome renderer privileges and injecting commands to download and run malware loaders.