Fortbridge published a working exploit chain on 5 October 2026 that turns an ordinary WordPress Media Library upload into code execution on the web server. WordPress hands uploaded HEIC images to ImageMagick, which decodes them with libheif. The chain first uses the derived-item and pixel-plane out-of-bounds read in libheif advisory GHSA-2jg2-4ch7-h545 (fixed in 1.23.2) to leak library and heap addresses through the JPEG thumbnails WordPress generates, then triggers the heap overflow in GHSA-x8r2-mggj-j6wr, a flaw in libheif's uncompressed (unci) decoder when the two chroma channels declare different bit depths, to hijack a C++ virtual call and run commands as the www-data PHP-FPM account. It needs a logged-in user with the upload_files capability (Author or higher by default); Fortbridge did not test guest uploads and validated it only on two exact Ubuntu and Debian stacks (6 of 8 and 22 of 24 runs succeeded). The libheif advisory, credited to Alex Thomas of Wordfence working with an agentic AI assessment framework, rates the overflow Critical (CVSS 3.1 9.8) and has no CVE yet. This is lab research, not an observed campaign. Wire: Cyber Security News 5 Oct.
Fortbridge — WordPress libheif RCE research (5 Oct 2026)
AhsayCBS is the central management console for Ahsay's cloud backup software, used mainly by managed service providers (MSPs) and system integrators. Two flaws were published on 4 October 2026 (CNA VulDB, with public exploit code): CVE-2026-105133, an authentication bypass in the checkSysPwd function of the API (CVSS 3.1 7.3), and CVE-2026-105134, an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (CVSS 3.1 10.0, CVSS 4.0 9.3), where a random token can stand in for valid credentials. The CVE records list versions up to 10.3.2 and point to 10.3.4 as the fix, but Huntress said on 8 October that 10.3.4 is also vulnerable and that it has told Ahsay. Huntress first saw exploitation at 23:20 UTC on 7 October and had seen five organisations targeted by 8 October: attackers chained the two bugs to run code as NT AUTHORITY\SYSTEM, set up a malicious replication receiver, dropped a JSP webshell into the CBS web directory, ran reconnaissance, installed XMRig cryptominers disguised as Microsoft Edge, kept them running with a renamed NSSM service posing as Edge Update, loaded the vulnerable WinRing0x64.sys driver, and added an apparently AI-written PowerShell script that closes Task Manager if it stays open overnight. Primary: Huntress; wire: SecurityWeek. UPDATE 14–15 October: Ahsay published an updated critical security alert saying its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully fix CVE-2026-105133 and CVE-2026-105134. Partners on v10 should apply the AhsayCBS v10.3.4.45 hotfix and partners on v7, v8 or v9 the v9.15.2.70 hotfix (both behind the partner portal), then reboot the server. Huntress says it independently verified that 10.3.4.45 blocks the initial entry point of the attack chain. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 14 October with a 17 October deadline for US federal agencies. Wire: The Hacker News.
Huntress — Threat actors exploit critical AhsayCBS flaws to drop webshells and XMRig cryptominer (8 Oct 2026, updated 8 Oct 6pm ET)
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Have I Been Squatted researchers Ian Muscat and Leanne Briffa published research on 3 October 2026 showing two edge cases in the internationalised domain name (IDN) spoofing checks used by Chromium-based browsers such as Chrome and Edge. First, Chromium's whole-script confusable check only shows the encoded Punycode form when every character in a single-script Cyrillic label is on its list of Latin lookalikes; Cyrillic ө (a Kazakh, Mongolian and Tatar letter) is not on the list, so аррӏө.com, a lookalike of apple.com that Verisign's .com Cyrillic table allows to be registered, displays in Unicode. Other 'breaker' characters such as ү also work. Second, the top-domain comparison reduces names to a 'skeleton', but a hooked letter such as ƙ, and the bar on ө, survive as combining marks, so oƙta.com does not reduce to okta.com and no match is found. Chromium's navigation-time Safety Tips only fire for matches within one edit and for targets of five or more characters, so short brands such as Okta, Nike, Sky and VK get no near-match protection. The researchers registered 20 lookalike domains (including Cyrillic versions of openai.com, skype.com, sharepoint.com, shell.com and kaspersky.com) and say all showed in Unicode in the Chrome 154 address bar with valid certificates. They found 161,894 lookalike pairs among 733,509 IDNs in the .com zone, which are possible imitations, not confirmed typosquats. In webmail tests Gmail showed all 20 IDN sender domains in Unicode, while Outlook Web showed all of them as Punycode, even harmless ones. Chromium added one more Cyrillic character (м) to its list on 11 September, after Chrome 155 branched; earlier, Chrome 148 closed the ҏ and ӿ breakers. No CVE or Google fix for ө or ƙ has been announced, and no in-the-wild abuse is reported in the research. Wire: The Register (10 Oct).
Have I Been Squatted — Turning IDN edge cases into typosquats (3 Oct 2026)
NVD record CVE-2026-71885 (published 3 October 2026; CNA CVSS 4.0 9.2 Critical; CWE-287 / CWE-295) and the Legion of the Bouncy Castle advisory page: the Messaging Layer Security (MLS, RFC 9420) implementation in Bouncy Castle for Java before 1.86 never tied an X.509 credential to the LeafNode signature_key. LeafNode.verify() checked the leaf's signature against the key carried in the leaf itself, and the credential's certificate chain was stored but never parsed or compared, so RFC 9420 section 5.3's binding was not enforced. A party could present someone else's certificate as its credential and sign the leaf and KeyPackage with an unrelated key, and be accepted under that person's identity. Where a deployment publishes GroupInfo and the ratchet tree for external joins and passes external commits to Group.handle() without its own credential-admission check, an unauthenticated attacker could join as the victim, evict them, derive the current epoch, read later group messages, and send messages accepted as the victim. Deployments using only basic credentials are unaffected. Fixed in 1.86 (commit 77632a57ed; bcmls-jdk18on 1.86 on Maven Central): the leaf is rejected unless the end-entity certificate's public key equals signature_key; chain and identity validation to a trust anchor remain the application's job. Credit: Joshua Rogers and Khaled Suliman (AISLE Research). No exploitation reported; no Australian-specific notice found. Wire pickup: Forkast 4 Oct.
Update 16 Oct: the guest-to-host escape Vercel's CEO confirmed on 3 October now has a CVE and a public write-up. Researcher Paulos Yibelo of pwn.ai published 'PwnEscape' on 15 October and the Linux kernel CNA assigned CVE-2026-99999, rated 9.3 Critical (CVSS 3.1, local attack vector, scope changed); NVD had received but not yet analysed it. The bug is not in KVM or Firecracker but in the host kernel's IPv4 networking code: checksum metadata supplied by a guest could point into the IPv4 header, so skb_checksum_help could rewrite the header after the kernel had already validated it. Vercel's own findings post (14 Oct) says the host-memory leak was demonstrated against its production Sandbox: each packet a guest sent could carry back about 32 bytes of host memory, repeatably. Crashing the host with two crafted packets and getting root on the host were shown only on the researcher's own machines built to match Vercel's; he stresses this is not a claim of root in any provider's production. Vercel says no report showed anyone reading customer files, secrets or app data, and called it the challenge's only Critical finding. Because most clouds isolate tenants on the same Linux host networking layer, the exposure is broad for anyone running untrusted guests. The fix is a single commit (6785011f8b16) by Red Hat's Michael S. Tsirkin, which its author calls a defence-in-depth check; fuller input validation is still being worked on. An attacker must already run code inside a guest; it is not reachable from the open internet, and there is no known in-the-wild use or CISA KEV listing. pwn.ai says the research used its Omega-Pwn harness with an AI model as the main reasoning engine. Earlier wire-only reporting (Rauch X post 3 Oct, Tech Insider and CSN 4 Oct) said Vercel paid US$50,000. UPDATE (20 Oct): Red Hat rates CVE-2026-99999 Important, CVSS 3.1 8.8 (it scores privileges required as low, unlike the CNA's 9.3), lists every tracked RHEL stream from 6 to 10 (kernel and kernel-rt), RHEL for NVIDIA and OpenShift 4 CoreOS as affected with fixes still in progress, and says no acceptable mitigation exists. WA's Cyber Security Unit issued advisory 20261019001 on 19 October and has seen no exploitation on WA Government networks. Primary: pwn.ai write-up and kernel commit; vendor: Vercel; wire: The Hacker News (16 Oct).
pwn.ai — PwnEscape: guest-to-host KVM escape (CVE-2026-99999) (15 Oct 2026); fix: Linux commit 6785011f8b16
Citrix Security Bulletin CTX697174 (published 3 Oct 2026; desk re-verified 5 Oct) assigns CVE-2026-88779 to the NetScaler SAML authentication crash/DoS tracked separately from CVE-2026-88771/88772. Description: memory overflow (CWE-119) leading to denial of service when NetScaler ADC or Gateway is configured as a SAML SP or SAML IdP. CVSSv4 base 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). Affected: NetScaler ADC/Gateway 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; ADC FIPS before 14.1-73.41 FIPS; ADC FIPS/NDcPP before 13.1-37.282. Patch to: 14.1-73.41+, 13.1-64.28+, 14.1-73.41 FIPS+, 13.1-37.282+. CISA added CVE-2026-88779 to KEV on 4 Oct 2026 (due 7 Oct; forensic triage Yes; BOD 26-04). ASD's ACSC Critical alert (last updated 3 Oct) already flagged the SAML issue as separate from 88771/88772 and reported impacts to Australian organisations — confirm whether SAML Gateway/AAA config is present, apply CTX697174 builds, preserve ns.log/core/support bundle if crashed, and report to ASD's ACSC if impacted. Wire context (Cryptika/Heise 3 Oct): nsaaad crashes and pitboss reboots under crafted SAML traffic after 14.1-73.37 / 13.1-64.23. Distinct desk card citrix-netscaler-unpatched-rce-20260926 covers 88771/88772. UPDATE 5 Oct (SecurityWeek wire): researcher Kevin Beaumont, who calls the bug “PitScaler 2”, reports exploitation attempts against already-patched honeypots and says one honeypot ran a downloaded malware binary. Admins on Reddit shared logs showing SAML authentication requests with shell commands hidden in the username field that try to fetch and run a script; one admin who obtained the script says it tries to plant web shells, survive reboots and upload the appliance configuration and backups, but there is no proof it ran. SecurityWeek notes some indication the flaw may be usable beyond DoS; Citrix still says it has seen availability impact only and no data-integrity impact. Citrix credits Bishop Fox and watchTowr, and watchTowr says it reproduced the issue within hours of seeing honeypot activity (The Hacker News, 5 Oct).
Citrix Security Bulletin CTX697174 — CVE-2026-88779 NetScaler SAML memory-overflow DoS (3 Oct 2026)
IBM, which now acts as CVE numbering authority for Langflow OSS, published security bulletin 7290694 on 2 October 2026 covering 25 vulnerabilities in Langflow 1.0.0 through 1.12.2, the open-source visual builder for AI agents and workflows. The CVE records went public on 6 and 7 October. The two worst, CVE-2026-104334 (code injection) and CVE-2026-93674 (OS command injection), are rated 9.8 by IBM and need no login. Most of the rest need an authenticated user, which in Langflow usually means anyone who can build flows: several sandbox escapes and code-security-scanner bypasses that run code on the server (CVE-2026-97676, 97678, 97673, 97655, 97679, 88962, all 8.8), an OS command injection (CVE-2026-97674, 8.1), path traversal that writes files anywhere the service account can and reads configuration, secrets or database files (CVE-2026-97677, 8.1; CVE-2026-103360, 8.1), cross-user access to cached component results (CVE-2026-97680, 8.3), poorly protected stored credentials (CVE-2026-101331, 7.7), authorization bypasses (CVE-2026-93678, 7.6) and a ZIP extraction denial of service (CVE-2026-93679, 4.3). IBM lists no workarounds. This is a separate set from the Langflow MCP stdio flaws already on the desk (fixed in 1.10.3), so a 1.10.3 install is still exposed. IBM does not report exploitation, but earlier Langflow code-injection flaws were exploited within days of disclosure. Primary: IBM security bulletin and CVE records.
IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (2 Oct 2026)
AWS Security Bulletin 2026-125-AWS (Important; published 2 October 2026 PDT) and Amazon CNA CVE-2026-104019 disclose OS command injection (CWE-78) in the Studio Space startup validation script in Amazon SageMaker Distribution when used with Amazon SageMaker Unified Studio. On Space startup the script network-validates available SageMaker connections in a project; improper sanitization of connection details can let an authenticated project contributor (or higher) execute arbitrary commands in another project member’s Studio Space. With Trusted Identity Propagation enabled, that can yield the peer’s temporary execution-role credentials and calls to TIP-enabled AWS services on their behalf. CVSS 4.0 9.3 Critical (Amazon CNA; also CVSS 3.1 9.0). Fixed images: 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, 4.4.3; 4.5.x not affected; 2.8–2.13 and 3.3–3.8 EOL with no fix — move to a supported minor. AWS says the fix is deployed globally; Unified Studio Spaces pick up the latest patch of their minor line on restart (no version picker). No workarounds; no exploitation reported in the bulletin. Primary: AWS 2026-125-AWS; also GHSA-w64x-664p-7w66.
AWS Security Bulletin 2026-125-AWS — SageMaker Distribution CVE-2026-104019 (2 Oct 2026)
AWS Security Bulletin 2026-124-AWS (Important; published 2 October 2026 PDT) covers three issues in Loom for AWS (AWS Labs open-source AI agent orchestration). CVE-2026-103956 (CVSS 4.0 10.0 / CVSS 3.1 10.0 Critical; CWE-306/1188): before 1.6.1, in deployments with no identity provider configured, any network client could obtain full administrative authority over the agent control plane — register tool servers, read stored integration credentials, rewrite IAM role policies on managed agent roles — via any application API request. Fixed in 1.6.1 (released 4 Aug 2026). CVE-2026-103957 (CVSS 4.0 8.2 High): before 1.7.0, authenticated mcp:write/a2a:write users could abuse OAuth2 discovery so the backend sent client secrets or another user’s access token to a third-party endpoint (1.6.1 blocked internal-address reach but not full token disclosure). CVE-2026-103958 (CVSS 4.0 8.3 High): before 1.7.0, same scopes could SSRF connection requests to internal locations including the container credential endpoint and read responses. Upgrade to 1.7.0; until then configure Cognito/external IdP before non-loopback exposure, leave LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV unset in deployed envs, and restrict mcp:write/a2a:write to trusted admins. After upgrade: rotate OAuth2 client secrets, revoke/reissue tokens, and if container role credentials may have been accessed rotate IAM session credentials and review CloudTrail. Acknowledgement: Kenneth Cox. No exploitation claimed in the bulletin. Primary: AWS 2026-124-AWS.
AWS Security Bulletin 2026-124-AWS — Loom for AWS CVE-2026-103956/103957/103958 (2 Oct 2026)
Microsoft re-released the September 2026 Exchange Server security updates on 2 October 2026 as V2 solely to add CVE-2026-96940 (CVSS 3.1 8.8; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): weak authorisation allowing an authenticated attacker to elevate privileges over the network and gain unauthorised access to other users’ mailboxes (messages and attachments) within the same organisation — not across tenant boundaries. Microsoft discovered the flaw internally; MSRC lists it as not publicly disclosed and not exploited, with exploitation more likely. Anyone who installed the original September SU still needs the V2 package. Fixed builds/KBs (Security Update Guide / coverage): Exchange Server Subscription Edition RTM KB5129955 build 15.02.2562.053; Exchange 2019 CU15 KB5129956 15.02.1748.053; Exchange 2019 CU14 KB5129957 15.02.1544.048; Exchange 2016 CU23 KB5129958 15.01.2507.075. Exchange Online already protected; hybrid and Exchange Management Tools hosts must still patch on-prem. 2016/2019 fixes require Period 2 ESU (May–Oct 2026); otherwise migrate to SE. Distinct from desk card cve-2026-62911 (Aug auth-bypass / Shadowserver). Primary: MSRC CVE-2026-96940; wire: CybersecurityNews 3 Oct.
Microsoft MSRC — CVE-2026-96940 Exchange Server Elevation of Privilege (2 Oct 2026)
Apache OpenOffice security bulletin CVE-2026-59265 (oss-security announce by Dave Fisher, 2 October 2026) rates Critical a code-execution issue in the Java integration: a crafted untrusted document can run arbitrary code, including code fetched remotely, when the user opens it. Affected: Apache OpenOffice through 4.1.16 (older OpenOffice.org builds may also be affected); the fix is due in 4.1.17, still a release candidate as of 6 October. LibreOffice published the matching flaw as CVE-2026-63277 on 5 October: a Calc cell range linked to an external data source can name a Java database (JDBC) driver to load from a remote location, so opening the document runs that Java code; fixed versions only accept local file URLs in the Java class path. LibreOffice fixed it in 26.2.5 and 26.8.0, alongside five related Codean Labs findings announced the same day (CVE-2026-63266 arbitrary file write via an embedded Firebird database, CVE-2026-63267 and 63268 local file read and SSRF through external data links, CVE-2026-63269 local file read and SSRF through GStreamer HLS playlists on Linux, CVE-2026-63270 environment and ini value leaks). The Hacker News (6 Oct) reports the chain needs Java support enabled, shows no macro-style warning, works on Windows and Linux, and that the V12 security team has published a proof-of-concept for both suites; no use in real attacks has been reported. Credit: Thomas Rinsma and Edoardo Geraci (Codean Labs) and Rick de Jager (V12), independently; Caolán McNamara (Collabora) wrote the LibreOffice fix. No numeric CVSS published by either project; do not invent a score.
Apache OpenOffice — CVE-2026-59265 (Critical; 2 Oct 2026)
