Palo Alto Networks disclosed a high-severity PAN-OS flaw, rated 8.6, that lets authenticated attackers with management-interface access execute code as root. The company said it observed limited exploitation in the wild and has released patches for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with a fix for 11.2.16 due October 15. The flaw affects PA-Series and VM-Series firewalls and Panorama appliances, but not Cloud NGFW or Prisma Access.
bleepingcomputer.com
· 2026-10-14
Cisco has released a patch for CVE-2026-76519, a path traversal bug in Secure Email Gateway's Advanced Malware Protection feature that lets unauthenticated attackers send a malicious email attachment to gain root-level command execution on unpatched devices. Cisco's security team said it detected active exploitation of the flaw in October 2026 and published indicators of compromise for administrators to check their systems. The vulnerability only affects devices with File Reputation enabled and running Content Scanner Tools versions earlier than 25.3.0.5525.
bleepingcomputer.com
· 2026-10-14
A Picus Security engineer outlines how agentic pentesting—where AI agents autonomously run reconnaissance, exploitation and reporting steps—has emerged as a faster alternative to scheduled automated pentests, citing Picus's own Swarm product as an example. The piece argues this approach can uncover exploit chains humans might miss, but notes it carries tradeoffs, including heavy token/compute usage, and identifies blind spots that need to be addressed.
bleepingcomputer.com
· 2026-10-14
CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.
bleepingcomputer.com
· 2026-10-14
Microsoft released updates addressing more than 1,400 security vulnerabilities across Windows and other software, far exceeding September's previous record of about 1,000 fixes. One flaw, CVE-2026-96951, a Windows Shell security feature bypass, is already being exploited in the wild, while another, CVE-2026-108398 in the .NET Framework, was publicly disclosed before patching though not yet seen exploited. At least 78 of the fixes are rated critical, mostly allowing remote code execution.
krebsonsecurity.com
· 2026-10-13
Wordfence researchers using their Argus AI system found a critical heap buffer overflow in Ghostscript, the PostScript/PDF rendering engine used by tools like ImageMagick and WordPress's thumbnail generator. A malicious PDF embedding a JPEG 2000 image can force Ghostscript to write far more data than a buffer can hold, corrupting memory and allowing unauthenticated remote code execution. The bug affects Ghostscript versions 9.21 through 10.07.1 and was confirmed present across ten tested Linux distributions and an official WordPress Docker image.
bleepingcomputer.com
· 2026-10-13
Microsoft released its October 2026 Patch Tuesday update, fixing 1,411 vulnerabilities across its product line, including three zero-day flaws. The bulk of the disclosed issues affect .NET and related components, spanning remote code execution, elevation of privilege, denial of service, and information disclosure bugs rated mostly Important severity.
bleepingcomputer.com
· 2026-10-13
Docker disclosed a critical flaw in Docker Hub where converting a personal account into an organization could reassign that account's personal access token to a named owner without rotating the token or requiring the target's consent. An attacker could exploit this to authenticate as the target user, gaining the ability to pull, push, or delete images in their repositories, depending on the token's scope and permissions. The bug has existed since August 26, 2024, though it did not grant web access or allow changes to passwords, email, or two-factor settings.
bleepingcomputer.com
· 2026-10-13
SAP's October 2026 security update fixes 20 vulnerabilities, including a maximum-severity OAuth2 SSRF flaw (CVE-2026-89111) in the Cloud SDK for Python used to build AI agents and apps on SAP BTP. The bug lets unauthenticated remote attackers manipulate the tenant_subdomain parameter to redirect OAuth2 token requests and steal client credentials. SAP also fixed two other critical issues: a broken access control flaw in NetWeaver Visual Composer and a privilege-escalation bug in Manufacturing Integration and Intelligence.
bleepingcomputer.com
· 2026-10-13
SonicWall disclosed CVE-2026-102255, a 10/10 CVSS SSRF vulnerability in the WorkPlace interface of its SMA 1000 secure access gateway, caused by an unintended alternate access path that lets unauthenticated attackers issue requests on the appliance's behalf. Days after the Oct. 6 advisory, security firms Previdian and Defused reported seeing exploitation attempts against this flaw on their honeypot sensors, though SonicWall says it has no evidence of in-the-wild exploitation.
darkreading.com
· 2026-10-12
GitLab issued an advisory urging immediate patching of a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, tracked as CVE-2026-97229. The flaw, an integer overflow found by researcher 'joaxcar' through HackerOne, could let an unauthenticated attacker execute arbitrary code via a crafted regular expression in a CI/CD configuration file. GitLab fixed the issue in versions 19.2.8, 19.3.4, and 19.4.2, noting GitLab.com and Dedicated customers are already protected.
bleepingcomputer.com
· 2026-10-12
A write-up on NixOS describes how generic SBOM-based vulnerability scans flag CVEs in dependencies even when the vulnerable code path isn't actually used, creating noise for maintainers and security teams. It argues that VEX (Vulnerability Exploitability eXchange) documents, which state whether a product is truly exposed to a given CVE, can be generated and applied effectively within Nix's build system to filter out irrelevant findings.
blog.kammel.dev
· 2026-10-11
GoKawiil