{"category":"all","changes":[{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.wiz.io/blog/php2shell-php-rce","status":"live","title":"Wiz publishes analysis of PHP2Shell: AI-uncovered critical PHP engine RCE and Heartbleed-style memory disclosure affecting ~70% of the Internet","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","incidentTitle":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Open%20Source%20Snort%203%20Control%20Channel%20Socket%20Arbitrary%20Command%20Execution%20Vulnerability%26vs_k=1","status":"live","title":"Open Source Snort 3 control channel socket allows low-privilege local arbitrary command execution (CVE-2026-76524)","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-186","status":"live","title":"Fortinet PSIRT details PHP core RCE patches for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.8)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","incidentTitle":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v2r2-x76j-6fcx","status":"live","title":"Typosquat malware cluster expands with new packages: insta-reel-search, ionic-tiktok-scraper, ionic-sound-cloud-loader-api, sound-cloud-loader-api, insta-api-wrapper","url":"https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","incidentTitle":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Information%20Disclosure%20Vulnerability%26vs_k=1","status":"live","title":"Cisco Expressway Series hardening batch adds unauthenticated information disclosure via MRA provisioning (CVE-2026-76435)","url":"https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","incidentTitle":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Manager%20Improper%20Access%20Control%20Vulnerability%26vs_k=1","status":"live","title":"October 2026 UC hardening release also fixes Unified CM/Unified CM SME improper access control flaw (CVE-2026-76487)","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","incidentTitle":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fr38-45mf-vcqf","status":"live","title":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","url":"https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-secure-email-gateway-cve-2026-76519","incidentTitle":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519)","kind":"advisory","patchStatus":"unknown","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Email%20Gateway%20Arbitrary%20File%20Write%20Vulnerability%26vs_k=1","status":"live","title":"Cisco publishes dedicated advisory for Secure Email Gateway arbitrary file write via AMP attachment handling (CVE-2026-76519)","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76519"},{"body":null,"category":"patch","date":"2026-10-25","incident":"gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","incidentTitle":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","status":"live","title":"GitLab critical patch release 19.5.1/19.4.3/19.3.6/19.2.9/19.1.9/19.0.10/18.11.13 includes fixes for CVE-2026-110264 and CVE-2026-112212","url":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://www.stepsecurity.io/blog/emudhra-emsign-ca-compromise-python-pip-ci-cd-update","status":"live","title":"Guidance published for Python/pip/CI-CD users on compromised eMudhra intermediate CA keys","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html","status":"live","title":"New interview details confirm PHP2Shell exploitation began four days before public disclosure","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry","status":"live","title":"PHP2Shell exploitation attempts and leaked details trigger industry-wide red alert remediation","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"beyondtrust-remote-support-cve-2026-102764","incidentTitle":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs","status":"live","title":"BeyondTrust Remote Support CVE-2026-102764 zero-day reported under active exploitation","url":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764"},{"body":null,"category":"patch","date":"2026-10-25","incident":"ivanti-connect-secure-cve-2026-104935","incidentTitle":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching","status":"live","title":"Ivanti ICS CVE-2026-104935 authentication bypass/RCE zero-day under active exploitation after partial July patch","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-cve-2026-104935"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://therecord.media/php-php2shell-exploitation-attempts-pocs","status":"live","title":"PHP2Shell exploitation attempts grow; exposure extends to bundled runtimes, containers and hosted apps","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://www.aikido.dev/blog/emudhra-ca-compromise","status":"live","title":"eMudhra CA compromise: analysis shows eight weak private keys, one guessable in at most 256 tries (key value 4)","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/369","status":"live","title":"oss-security follow-up clarifies Comodo AAA root trust-bit removal: dropped from TLS/browser trust but still usable for S/MIME","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/372","status":"live","title":"Python ssl module distrusts the compromised eMudhra intermediate certificates (CVE-2026-115557)","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"patch","date":"2026-10-25","incident":"pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","incidentTitle":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","status":"live","title":"New Pillow heap buffer overflow in FlashPix (FPX) JPEG-tile decoding enables code execution via crafted image files (CVE-2026-112398)","url":"https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html","status":"live","title":"PHP releases 14:00 UTC patch for PHP2Shell flaws as exploits are already public and experts warn the suggested workaround setting is insufficient","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1","status":"live","title":"Cisco issues emergency distrust of compromised eMudhra root and intermediate CAs","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"patch","date":"2026-10-25","incident":"palo-alto-networks-pan-os-cve-2026-0322","incidentTitle":"Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226","status":"live","title":"Unit 42 reports PAN-OS compromises attacked by multiple ransomware groups since June","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322"},{"body":null,"category":"patch","date":"2026-10-25","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Collabora Online CVE-2026-110447 to Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"patch","date":"2026-10-25","incident":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","incidentTitle":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Visual%20Basic%20for%20Applications%20Buffer%20Overflow%20Denial%20of%20Service%20Vulnerability%26vs_k=1","status":"live","title":"Cisco discloses four additional Snort 3 denial-of-service vulnerabilities (CVE-2026-20218, CVE-2026-76445, CVE-2026-20221, CVE-2026-20011) affecting multiple products","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497","status":"live","title":"Node2Shell evolves to HTTP2Shell: CVE-2026-111497 blast radius extends to libraries/apps using HTTP with Brotli","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","status":"live","title":"Node2Shell: Node.js Brotli flaw CVE-2026-111497 enables remote code execution","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"patch","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/373","status":"live","title":"Brotli v1.2.1 released fixing CVE-2026-111497; downstream releases tracked via patchtheplanet","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","status":"live","title":"Node2Shell Brotli flaw (CVE-2026-111497) expands to HTTP2Shell, affecting libraries and apps using HTTP with Brotli","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"patch","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html","status":"live","title":"PHP ships out-of-cycle emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) for PHP2Shell as exploit attempts emerge","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-109618-cve-2026-109619/","status":"live","title":"NodeZero releases Rapid Response check for PHP2Shell (CVE-2026-109618/CVE-2026-109619)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","incidentTitle":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-mrv2-3pqr-j5jr","status":"live","title":"New DOMPurify IN_PLACE incomplete-fix bypass (GHSA-mrv2-3pqr-j5jr) leaves detached subtree event handlers armed after hook removes parent/sibling","url":"https://helix.ml/threat-watch/i/dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg"},{"body":null,"category":"patch","date":"2026-10-25","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.4) to its Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-25","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html","status":"live","title":"PHP warns of new code execution flaw CVE-2026-115560 (session upload progress) days after PHP2Shell patches; no emergency fix, mitigation is disabling session upload progress","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-25","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html","status":"live","title":"Node2Shell PoC shows Brotli decoder OOB write (CVE-2026-111497) enables RCE on official Node.js builds and also affects Bun, Python brotli/brotlicffi, and Envoy","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-25","incident":"plex-media-server-cve-2026-96652","incidentTitle":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html","status":"live","title":"CISA adds Plex2Shell Plex Media Server vulnerabilities to KEV catalog citing active exploitation","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652"},{"body":null,"category":"patch","date":"2026-10-25","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/","status":"live","title":"Attackers actively exploit third Arista VCO zero-day SQL injection flaw to gain operator privileges","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-25","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"patch","patchStatus":"unknown","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html","status":"live","title":"Arista confirms active exploitation of VeloCloud Orchestrator zero-day and releases patches","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-25","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html","status":"live","title":"CISA adds Collabora Online CODE Server CVE-2026-110447 to KEV citing active exploitation","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"supply-chain","date":"2026-10-23","incident":"io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe","incidentTitle":"IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/367","status":"live","title":"IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)","url":"https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe"},{"body":null,"category":"patch","date":"2026-10-23","incident":"collabora-collabora-online-built-in-code-server-cve-2026-110447","incidentTitle":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110447","status":"live","title":"CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 26, 2026)","url":"https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447"},{"body":null,"category":"patch","date":"2026-10-23","incident":"arista-velocloud-orchestrator-cve-2026-114625","incidentTitle":"Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-114625","status":"live","title":"CISA added CVE-2026-114625 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 26, 2026)","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625"},{"body":null,"category":"patch","date":"2026-10-22","incident":"x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat","incidentTitle":"x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html","status":"live","title":"x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)","url":"https://helix.ml/threat-watch/i/x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat"},{"body":null,"category":"supply-chain","date":"2026-10-22","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://github.com/advisories/GHSA-jr5w-w6x2-84p9","status":"live","title":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"patch","date":"2026-10-22","incident":"mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324","incidentTitle":"mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7587-9684-52r6","status":"live","title":"mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)","url":"https://helix.ml/threat-watch/i/mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324"},{"body":null,"category":"patch","date":"2026-10-22","incident":"brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497","incidentTitle":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-9v8h-qqgm-4m35","status":"live","title":"Brotli (Google/PyPI): out-of-bounds write in Brotli decoder allows RCE via crafted compressed stream (CVE-2026-111497)","url":"https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497"},{"body":null,"category":"patch","date":"2026-10-22","incident":"pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026","incidentTitle":"Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v9pv-5gc8-w2m6","status":"live","title":"Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)","url":"https://helix.ml/threat-watch/i/pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026"},{"body":null,"category":"patch","date":"2026-10-21","incident":"cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466","incidentTitle":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","status":"live","title":"Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)","url":"https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466"},{"body":null,"category":"patch","date":"2026-10-21","incident":"cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo","incidentTitle":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","status":"live","title":"Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)","url":"https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo"},{"body":null,"category":"patch","date":"2026-10-21","incident":"gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264","incidentTitle":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html","status":"live","title":"GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)","url":"https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264"},{"body":null,"category":"patch","date":"2026-10-21","incident":"cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl","incidentTitle":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","status":"live","title":"Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)","url":"https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl"},{"body":null,"category":"patch","date":"2026-10-21","incident":"php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619","incidentTitle":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","status":"live","title":"PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)","url":"https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619"},{"body":null,"category":"patch","date":"2026-10-20","incident":"apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling","incidentTitle":"Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/374","status":"live","title":"Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)","url":"https://helix.ml/threat-watch/i/apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling"},{"body":null,"category":"patch","date":"2026-10-20","incident":"fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv","incidentTitle":"Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html","status":"live","title":"Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)","url":"https://helix.ml/threat-watch/i/fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv"},{"body":null,"category":"patch","date":"2026-10-20","incident":"chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1","incidentTitle":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","status":"live","title":"Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)","url":"https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1"},{"body":null,"category":"patch","date":"2026-10-20","incident":"siemens-software-center-cve-2026-110936","incidentTitle":"Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVE-2026-110936)","kind":"exploitation","patchStatus":"patched","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110936","status":"live","title":"CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)","url":"https://helix.ml/threat-watch/i/siemens-software-center-cve-2026-110936"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96652","incidentTitle":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652","status":"live","title":"CISA added CVE-2026-96652 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96654","incidentTitle":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVE-2026-96654)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96654","status":"live","title":"CISA added CVE-2026-96654 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96654"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96655","incidentTitle":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96655)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655","status":"live","title":"CISA added CVE-2026-96655 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 3, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96655"},{"body":null,"category":"patch","date":"2026-10-20","incident":"plex-media-server-cve-2026-96656","incidentTitle":"Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96656","status":"live","title":"CISA added CVE-2026-96656 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)","url":"https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96656"},{"body":null,"category":"patch","date":"2026-10-20","incident":"eg-secure-solutions-siteguard-server-edition-cve-2026-106931","incidentTitle":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVE-2026-106931)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-106931","status":"live","title":"CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 23, 2026)","url":"https://helix.ml/threat-watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931"},{"body":null,"category":"breach","date":"2026-10-20","incident":"assuranceretraite-data-breach","incidentTitle":"Assurance Retraite data breach: 70K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/AssuranceRetraite","status":"live","title":"Have I Been Pwned loaded 70K breached Assurance Retraite accounts","url":"https://helix.ml/threat-watch/i/assuranceretraite-data-breach"},{"body":null,"category":"patch","date":"2026-10-19","incident":"wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889","incidentTitle":"Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","status":"live","title":"Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)","url":"https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889"},{"body":null,"category":"breach","date":"2026-10-19","incident":"pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying","incidentTitle":"PingCAP (TiDB Cloud): Extortion group FulcrumSec used stolen service account credentials to access internal systems, copying business data and source code","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security","status":"live","title":"PingCAP (TiDB Cloud): Extortion group FulcrumSec used stolen service account credentials to access internal systems, copying business data and source code","url":"https://helix.ml/threat-watch/i/pingcap-tidb-cloud-extortion-group-fulcrumsec-used-stolen-service-account-credentials-to-access-internal-systems-copying"},{"body":null,"category":"patch","date":"2026-10-19","incident":"linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999","incidentTitle":"Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744","status":"live","title":"Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)","url":"https://helix.ml/threat-watch/i/linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999"},{"body":null,"category":"patch","date":"2026-10-19","incident":"laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509","incidentTitle":"Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","status":"live","title":"Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)","url":"https://helix.ml/threat-watch/i/laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509"},{"body":null,"category":"breach","date":"2026-10-18","incident":"gitesdefrance-data-breach","incidentTitle":"Gîtes de France data breach: 117K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/GitesDeFrance","status":"live","title":"Have I Been Pwned loaded 117K breached Gîtes de France accounts","url":"https://helix.ml/threat-watch/i/gitesdefrance-data-breach"},{"body":null,"category":"supply-chain","date":"2026-10-17","incident":"pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8","incidentTitle":"Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)","kind":"disclosure","patchStatus":"partial","severity":"high","sourceUrl":"https://github.com/advisories/GHSA-78g4-xqwv-q3g8","status":"live","title":"Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)","url":"https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8"},{"body":null,"category":"patch","date":"2026-10-16","incident":"pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20","incidentTitle":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html","status":"live","title":"Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)","url":"https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20"},{"body":null,"category":"patch","date":"2026-10-16","incident":"fortinet-multiple-products-cve-2025-61624","incidentTitle":"Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624","status":"live","title":"CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 19, 2026)","url":"https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-61624"},{"body":null,"category":"patch","date":"2026-10-16","incident":"beyondtrust-remote-support-cve-2026-102764","incidentTitle":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102764","status":"live","title":"CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 19, 2026)","url":"https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764"},{"body":null,"category":"patch","date":"2026-10-15","incident":"google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922","incidentTitle":"Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"http://chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_01598036246.html","status":"live","title":"Google Chrome: Extended Stable update fixes 10 security flaws including two critical CVEs (CVE-2026-110151, CVE-2026-110922)","url":"https://helix.ml/threat-watch/i/google-chrome-extended-stable-update-fixes-10-security-flaws-including-two-critical-cves-cve-2026-110151-cve-2026-110922"},{"body":null,"category":"patch","date":"2026-10-15","incident":"atlassian-multiple-products-cve-2026-21589","incidentTitle":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21589","status":"live","title":"CISA added CVE-2026-21589 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 18, 2026)","url":"https://helix.ml/threat-watch/i/atlassian-multiple-products-cve-2026-21589"},{"body":null,"category":"patch","date":"2026-10-14","incident":"next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr","incidentTitle":"Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","status":"live","title":"Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-use-cache-functions-returning-typed-arrays-ghsa-673q-mjm6-r5xr"},{"body":null,"category":"patch","date":"2026-10-14","incident":"next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96","incidentTitle":"Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2464-fhr4-w9xw","status":"live","title":"Next.js: Unauthenticated RCE in Image Optimization API via sharp memory vulnerability when SVG files are used (CVE-2026-96889)","url":"https://helix.ml/threat-watch/i/next-js-unauthenticated-rce-in-image-optimization-api-via-sharp-memory-vulnerability-when-svg-files-are-used-cve-2026-96"},{"body":null,"category":"patch","date":"2026-10-14","incident":"palo-alto-networks-pan-os-cve-2026-0322","incidentTitle":"Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322","status":"live","title":"CISA added CVE-2026-0322 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/palo-alto-networks-pan-os-cve-2026-0322"},{"body":null,"category":"patch","date":"2026-10-14","incident":"ahsay-ahsaycbs-cve-2026-105133","incidentTitle":"Ahsay AhsayCBS Improper Authentication Vulnerability (CVE-2026-105133)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105133","status":"live","title":"CISA added CVE-2026-105133 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105133"},{"body":null,"category":"patch","date":"2026-10-14","incident":"cisco-secure-email-gateway-cve-2026-76519","incidentTitle":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability (CVE-2026-76519)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76519","status":"live","title":"CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/cisco-secure-email-gateway-cve-2026-76519"},{"body":null,"category":"patch","date":"2026-10-14","incident":"ahsay-ahsaycbs-cve-2026-105134","incidentTitle":"Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105134","status":"live","title":"CISA added CVE-2026-105134 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 17, 2026)","url":"https://helix.ml/threat-watch/i/ahsay-ahsaycbs-cve-2026-105134"},{"body":null,"category":"breach","date":"2026-10-14","incident":"crunchbase-data-breach","incidentTitle":"Crunchbase data breach: 559K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/Crunchbase","status":"live","title":"Have I Been Pwned loaded 559K breached Crunchbase accounts","url":"https://helix.ml/threat-watch/i/crunchbase-data-breach"},{"body":null,"category":"patch","date":"2026-10-13","incident":"fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th","incidentTitle":"Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://fortiguard.fortinet.com/psirt/cvrf/FG-IR-26-185","status":"live","title":"Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)","url":"https://helix.ml/threat-watch/i/fortinet-fortisandbox-two-authentication-bypass-flaws-in-gui-and-fabric-api-allow-unauthenticated-attackers-to-access-th"},{"body":null,"category":"patch","date":"2026-10-13","incident":"microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026","incidentTitle":"Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208","status":"live","title":"Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)","url":"https://helix.ml/threat-watch/i/microsoft-october-2026-patch-tuesday-fixes-1-413-cves-incl-two-zero-days-one-actively-exploited-cve-2026-96951-cve-2026"},{"body":null,"category":"patch","date":"2026-10-13","incident":"microsoft-windows-cve-2026-96951","incidentTitle":"Microsoft Windows Command Injection Vulnerability (CVE-2026-96951)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","status":"live","title":"CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2026)","url":"https://helix.ml/threat-watch/i/microsoft-windows-cve-2026-96951"},{"body":null,"category":"patch","date":"2026-10-13","incident":"ivanti-connect-secure-cve-2026-104935","incidentTitle":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104935","status":"live","title":"CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 16, 2026)","url":"https://helix.ml/threat-watch/i/ivanti-connect-secure-cve-2026-104935"},{"body":null,"category":"patch","date":"2026-10-12","incident":"dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg","incidentTitle":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","status":"live","title":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive in shadow root content on DOM output modes (GHSA-cg2g-xh64-v4q7)","url":"https://helix.ml/threat-watch/i/dompurify-safe-for-templates-bypass-lets-template-expressions-survive-in-shadow-root-content-on-dom-output-modes-ghsa-cg"},{"body":null,"category":"breach","date":"2026-10-12","incident":"sharecare-data-breach","incidentTitle":"Sharecare data breach: 318K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/Sharecare","status":"live","title":"Have I Been Pwned loaded 318K breached Sharecare accounts","url":"https://helix.ml/threat-watch/i/sharecare-data-breach"},{"body":null,"category":"supply-chain","date":"2026-10-10","incident":"black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134","incidentTitle":"Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","status":"closed","title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134)","url":"https://helix.ml/threat-watch/i/black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134"},{"body":null,"category":"breach","date":"2026-10-09","incident":"neogen-data-breach","incidentTitle":"Neogen data breach: 435K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/Neogen","status":"closed","title":"Have I Been Pwned loaded 435K breached Neogen accounts","url":"https://helix.ml/threat-watch/i/neogen-data-breach"},{"body":null,"category":"patch","date":"2026-10-08","incident":"proftpd-proftpd-cve-2015-3306","incidentTitle":"ProFTPD Improper Access Control Vulnerability (CVE-2015-3306)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306","status":"closed","title":"CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/proftpd-proftpd-cve-2015-3306"},{"body":null,"category":"patch","date":"2026-10-08","incident":"onlyoffice-docs-cve-2021-3199","incidentTitle":"ONLYOFFICE Docs Server Path Traversal Vulnerability (CVE-2021-3199)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199","status":"closed","title":"CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/onlyoffice-docs-cve-2021-3199"},{"body":null,"category":"patch","date":"2026-10-08","incident":"strapi-strapi-cve-2023-22894","incidentTitle":"Strapi Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-22894)","kind":"exploitation","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894","status":"closed","title":"CISA added CVE-2023-22894 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/strapi-strapi-cve-2023-22894"},{"body":null,"category":"patch","date":"2026-10-08","incident":"apache-struts-cve-2016-3081","incidentTitle":"Apache Struts Command Injection Vulnerability (CVE-2016-3081)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081","status":"closed","title":"CISA added CVE-2016-3081 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/apache-struts-cve-2016-3081"},{"body":null,"category":"patch","date":"2026-10-08","incident":"isc-bind-cve-2015-5477","incidentTitle":"ISC BIND Data Processing Errors Vulnerability (CVE-2015-5477)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477","status":"closed","title":"CISA added CVE-2015-5477 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 11, 2026)","url":"https://helix.ml/threat-watch/i/isc-bind-cve-2015-5477"},{"body":null,"category":"patch","date":"2026-10-07","incident":"cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam","incidentTitle":"Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","status":"closed","title":"Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)","url":"https://helix.ml/threat-watch/i/cisco-meraki-critical-hardening-release-fixes-7-internally-discovered-vulnerability-groups-across-mg-mr-ms-mv-mx-and-cam"},{"body":null,"category":"patch","date":"2026-10-07","incident":"splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2","incidentTitle":"Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-76268/","status":"closed","title":"Splunk Enterprise: unauthenticated Patroni REST API flaw allows OS command execution on search head cluster members (CVE-2026-76268)","url":"https://helix.ml/threat-watch/i/splunk-enterprise-unauthenticated-patroni-rest-api-flaw-allows-os-command-execution-on-search-head-cluster-members-cve-2"},{"body":null,"category":"breach","date":"2026-10-07","incident":"cyrusone-data-breach","incidentTitle":"CyrusOne data breach: 373K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/CyrusOne","status":"closed","title":"Have I Been Pwned loaded 373K breached CyrusOne accounts","url":"https://helix.ml/threat-watch/i/cyrusone-data-breach"},{"body":null,"category":"breach","date":"2026-10-07","incident":"doublecounter-data-breach","incidentTitle":"Double Counter data breach: 274K accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/DoubleCounter","status":"closed","title":"Have I Been Pwned loaded 274K breached Double Counter accounts","url":"https://helix.ml/threat-watch/i/doublecounter-data-breach"},{"body":null,"category":"breach","date":"2026-10-07","incident":"angelone-data-breach","incidentTitle":"Angel One data breach: 6.8M accounts exposed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://haveibeenpwned.com/Breach/AngelOne","status":"closed","title":"Have I Been Pwned loaded 6.8M breached Angel One accounts","url":"https://helix.ml/threat-watch/i/angelone-data-breach"},{"body":null,"category":"patch","date":"2026-10-06","incident":"sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach","incidentTitle":"SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.darkreading.com/vulnerabilities-threats/max-severity-ssrf-flaw-sonicwall-sma-devices-under-attack","status":"closed","title":"SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)","url":"https://helix.ml/threat-watch/i/sonicwall-sma-1000-actively-exploited-max-severity-ssrf-in-workplace-interface-allows-unauthenticated-attackers-to-reach"},{"body":null,"category":"patch","date":"2026-10-04","incident":"citrix-netscaler-cve-2026-88779","incidentTitle":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2026-88779)","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88779","status":"closed","title":"CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 7, 2026)","url":"https://helix.ml/threat-watch/i/citrix-netscaler-cve-2026-88779"},{"body":null,"category":"patch","date":"2026-10-02","incident":"zammad-gmbh-zammad-cve-2026-102489","incidentTitle":"Zammad GmbH Zammad Session Fixation Vulnerability (CVE-2026-102489)","kind":"exploitation","patchStatus":"unknown","severity":"critical","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102489","status":"closed","title":"CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog (federal remediation due Oct 5, 2026)","url":"https://helix.ml/threat-watch/i/zammad-gmbh-zammad-cve-2026-102489"}],"feeds":{"changes":"https://helix.ml/threat-watch/changes.json","json":"https://helix.ml/threat-watch/feed.json","llms":"https://helix.ml/threat-watch/llms.txt","page":"https://helix.ml/threat-watch","rss":"https://helix.ml/threat-watch/feed.xml"},"generatedAt":"2026-10-25T11:12:42Z","site":"https://helix.ml/threat-watch"}