Rapid7 disclosed three vulnerabilities in Eptura Archibus on 19 October 2026, found by Rapid7 security consultant Marcus Chang during continuous red-teaming through its Vector Command service. Rapid7 says a legacy API endpoint in the Archibus Web Central application, which uses Java Direct Web Remoting (DWR), can be abused to bypass authentication and run workflow functions without logging in (CVE-2026-107186, CVSS 8.6 High); the most serious of those functions allow full database read, including user names and passwords (CVE-2026-107187, CVSS 8.5 High), and an insecure file upload that leads to remote code execution (CVE-2026-107188, CVSS 9.6 Critical). Rapid7 says a malicious actor with HTTP network access to the server can read secrets and passwords out of the database and run system commands as NT AUTHORITY\Local Service. Rapid7 says users should update Archibus to version 2025.02 or higher, in which the vulnerable DWR method used for the bypass was moved to a REST API, with the installer available through an Eptura account. Rapid7's disclosure timeline says it first contacted Eptura on 2 July, that Eptura replied on 9 October clarifying impacted versions and saying a fix was in development for version 2025.01, and that disclosure was moved to 19 October at Eptura's request. Rapid7's post does not include an Eptura statement and does not list exact affected versions. No exploitation outside Rapid7's authorised testing has been reported. Source: Rapid7 blog (19 Oct 2026).
Rapid7 — Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) (19 Oct 2026)
Pillar Security said on 19 October 2026 that it found a critical remote code execution flaw in opencode, Anomaly's open-source AI coding agent, affecting Windows and Windows Subsystem for Linux (WSL): an attacker-controlled remote Model Context Protocol (MCP) server can execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent. Pillar says the MCP server supplies the OAuth authorization_endpoint, which opencode passed to the open package (open@10.1.2); on Windows that package builds a PowerShell command without escaping the target, so a PowerShell subexpression carried inside an ordinary https:// URL runs. Pillar says the server did not need to be malicious when configured: a later compromise, hijacked registry entry, typosquat or expired domain could trigger the same path. Pillar lists opencode (opencode-ai on npm) versions 1.0.137 to 1.18.32 on Windows and WSL as affected and says macOS and Linux are not affected; it says the fix shipped in 1.18.33, which GitHub shows was released on 28 September 2026. Pillar says the fix (pull request #51414, merged 25 September) bumped open to 11.0.4 and added http/https scheme checks, but that scheme validation alone would not have stopped its payload and the dependency bump is what closed the hole. Pillar says Anomaly did not issue a security advisory or request a CVE, shipped the fix as a refactor, and told Pillar that malicious MCP servers are outside its threat model; opencode's GitHub security policy says external MCP servers a user configures are outside its trust boundary. Pillar rates the flaw critical with a proposed CVSS 3.1 score of 9.8, and notes that without a CVE, vulnerability scanners and dependency alerts will not flag affected installs. Primary: Pillar Security (19 Oct); vendor: opencode v1.18.33 release on GitHub. Updated 22 Oct 2026: The Hacker News reported the flaw, noting that the browser step runs only when a developer starts the sign-in, for example by running opencode mcp auth. (source: The Hacker News)
Pillar Security — Open and Shut: Remote Code Execution in opencode via MCP OAuth (19 Oct 2026)
Siemens ProductCERT said on 19 October 2026 that it has confirmed active exploitation of CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center (the installer and update manager for Siemens software) that it fixed in version 4.0.9.8 and disclosed in advisory SSA-580366 on 15 October. The app loaded helper DLLs from its own folder without checking them, so attackers shipped a genuine, validly signed copy of version 3.5.8.7 alongside their own archive.dll inside an installer called AllMyBasic.msi; msiexec.exe installs it under AppData\Local\Programs and starts SiemensSoftwareCenter.exe, which loads the attacker DLL. Siemens says the Siemens program itself was not modified and no Siemens system, product or update channel was breached, and it is sharing indicators with EDR vendors and authorities. The victims are lured by ClickFix pages that get them to paste a PowerShell command; Huntress found the bug and The Hacker News ties the campaign to the ROMULUS ClickFix delivery platform (separate card on this desk), with some lures reached through malicious ChatGPT Custom GPTs. The payload is a remote access trojan. Siemens rates the flaw CVSS 3.1 6.7 and CVSS 4.0 8.4 because it needs local access, but in this campaign the attackers bring the vulnerable signed copy with them, so PCs that never had Siemens software are also at risk. Canada's Cyber Centre issued AV26-1063. Primary: Siemens ProductCERT. UPDATE (22 Oct 2026): CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a 3 November due date for US federal agencies. (source: CISA KEV catalog)
Siemens ProductCERT — Active exploitation of CVE-2026-110936 in Siemens Software Center (19 Oct 2026)
Roundcube published security updates 1.6.20 (1.6 LTS) and 1.7.5 on 19 October 2026 and says it strongly recommends updating all production installations of 1.6.x and 1.7.x. The release notes list about 20 security fixes. The first to get a CVE record, CVE-2026-113386 (published 20 October, CVSS 3.1 score 7.1), lets a logged-in user inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to run arbitrary IMAP commands; a similar IMAP injection through the _flag parameter of mail/mark is also fixed. Other fixes cover mail header injection in the bounce (resend), forward-as-attachment and reply paths, an XSS in password driver error responses, a CSRF check bypass in mark-as-junk, an SSRF filter bypass using NAT64 addresses, remote-content blocking bypasses via SVG and CSS, unsafe attachment content passed to ImageMagick during image resizing, an object injection primitive in session handling, deprecated action aliases that ignored the disabled_actions setting, and a Modoboa password driver bug that could change another account's password. Roundcube has not said any of these are being exploited, but earlier Roundcube flaws have been exploited in the wild, so patch promptly. Primary: Roundcube. UPDATE (22 Oct 2026): MITRE published 19 further CVE records for the fixes in 1.6.20 and 1.7.5 on 22 October (CVE-2026-114714 to CVE-2026-114732), with CVSS 3.1 scores from 3.1 to 8.5; the highest is CVE-2026-114716, a mail header injection (8.5), followed by CVE-2026-114727, unsafe content passed to ImageMagick (8.3). (source: CVE records at cve.org, scored by MITRE)
Roundcube — Security updates 1.6.20 and 1.7.5 released (19 Oct 2026)
The Pillow maintainers released Pillow 13.0.0 on 16 October 2026 (UTC) and published 40 GitHub security advisories for it on 17 October: two rated critical, 13 high, 22 medium and three low. The most serious, CVE-2026-112398, is a heap buffer overflow in the FlashPix (FPX) JPEG-tile decoder; the reporter shows code execution from a single crafted file passed to Image.open(), and because Pillow detects FPX by its content rather than its extension, any service that opens or thumbnails untrusted uploads is reachable when the optional olefile package is installed. Other high-severity fixes include JPEG encoder and decoder heap overflows (CVE-2026-96778 when re-saving a JPEG with its colour profile, CVE-2026-112403 via Image.thumbnail()), TIFF out-of-bounds reads that can leak heap memory into pixels, and a heap-buffer-overflow write in the OpenJPEG library bundled in every Pillow wheel since 11.1.0 (CVSS 3.1 8.1), which a patched operating system does not fix. CVE-2026-112900 is a Ghostscript argument injection in EPS handling when a file name starts with a dash. Most of the rest are denial-of-service bugs (decompression-bomb bypasses, infinite loops, quadratic parsing). Some were found by Anthropic using Claude and validated by Ada Logics. Red Hat began listing the CVEs on 19 October. A further medium advisory published 19 October (Arrow export leaking heap memory when PILLOW_ALIGNMENT is above 1) also affects 13.0.0 and has no fixed release yet. No exploitation has been reported. Primary: Pillow on GitHub. UPDATE (23 Oct 2026): The CVE records published by GitHub, the CVE numbering authority, on 19 October (UTC) score four of the flaws 9.2 under CVSS 4.0: CVE-2026-112398 (FlashPix decoding), CVE-2026-112403 (JPEG decoding after draft()), CVE-2026-112393 (heap buffer overflow when saving TIFF to BytesIO) and CVE-2026-112900 (argument injection in the Ghostscript call, potentially leading to code execution). The maintainers' own advisories rate those four critical, high, high and medium respectively. In the same records, CISA's ADP enrichment records a public proof of concept for CVE-2026-112398, CVE-2026-112403 and CVE-2026-112393, and no known exploitation for CVE-2026-112900. Pillow 13.0.0 remains the fixed release. (source: CVE.org records)
Pillow GHSA-5x8w-8jj5-q52h — FlashPix (FPX) JPEG decoding heap buffer overflow leads to code execution (CVE-2026-112398, critical; 17 Oct 2026)
Rank Math, maker of the widely used Rank Math SEO plugin for WordPress, published a security incident notice on 16 October 2026 (UTC) saying that some copies of its paid Rank Math PRO plugin, version 3.0.123, contained malware. Only packages downloaded, or installed through an update, between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 are affected (about 4:02 am to 3:12 pm on 16 October in Perth). Having version 3.0.123 does not by itself mean a site was compromised. Rank Math removed the affected files and released a clean version, 3.0.124. Wordfence assigned CVE-2026-111862 and rated it CVSS 9.8; Patchstack lists it as a backdoor, published 17 October. If the plugin was activated, the malicious code could set up persistent access and rebuild a hidden backdoor whenever someone visited the site, so deactivating the plugin is not enough. Rank Math warns that WordPress passwords, database credentials, API keys and other secrets the web server can read should be treated as exposed. Indicators from the notice: outbound connections to rank1cdn[.]com; wp_options entries named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c; administrator accounts whose usernames start with wpsupport_ or that use @wp-mail[.]net email addresses; PHP files in the inc/, includes/ or lib/ folders of non-default themes containing base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code; a fake WordPress core file; .htaccess rules that make .cache files run as PHP; and a web-server-user crontab entry tagged #ms6v46. Rank Math has not said how its distribution was tampered with or how many sites received the affected package. The free Rank Math SEO plugin on WordPress.org is not named in the notice. UPDATE (19 Oct, BleepingComputer): BleepingComputer found a PHP malware sample on VirusTotal, named 'cache-preloader-fff033 (1).php', that carries the same indicators as Rank Math's notice, including code that creates administrator accounts with the wpsupport_ prefix and @wp-mail[.]net addresses. It appears to be a first-stage script that drops the wp-includes/class-wp-cache-util.php backdoor named in the advisory, and it can also run commands, change the WordPress database and steal AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys. BleepingComputer could not confirm that this file was delivered through the compromised plugin. Rank Math has not answered questions about how many sites were affected or how the attackers got in.
Rank Math — PRO 3.0.123 security incident: how to secure your website (16 Oct 2026, updated 17 Oct)
Security firm Calif showed a series of iPhone attacks on stage at the Hexacon offensive-security conference in Paris on 16 October 2026. Its newsletter post lists four demos ('Signal 1-click', an iMessage demo, 'Can your iPhone do this?' and 'APT stands for Apple Persistent Threat') and says everything 'will be released in due time'. Stage video posted by jailbreak researcher Billy Ellis, as described by Decrypt, shows an iPhone 18 Pro running iOS 27.0.1 being rebooted, unlocked with its normal passcode, and an SSH session opened as root with about two minutes of uptime, so root access came back on its own after the restart with no computer attached (an untethered jailbreak). heise online reports the chain works on versions up to iOS 27.0.1, Apple's latest public release, and that AI helped find it. Calif has not named the vulnerabilities, released a tool or published a write-up; there are no CVE IDs, Apple has not commented and no fix has shipped. No exploitation outside the demo has been reported. Primary: Calif newsletter (16 Oct); context: heise online and Decrypt.
Calif — iPhone: demos revealed at Hexacon Paris (16 Oct 2026)
The maintainers of Pion DTLS, the Go DTLS library used by the pion/webrtc stack and many Go real-time and IoT services, published six GitHub security advisories on 16 October 2026, all credited to Anthropic's OSS Scanner. GHSA-7c2r-jhm9-43vf (critical, CVSS 3.1 9.1) lets an attacker who can redirect a DTLS handshake and has the peer's public certificate impersonate that peer without its private key, because the library chose the verification primitive from the certificate's key type but took the digest from the attacker-controlled signature scheme; the maintainers note that checking the WebRTC SDP certificate fingerprint does not stop it, since the genuine certificate is presented. GHSA-hhpj-h56m-9f2p (critical, 9.1) lets an unauthenticated client skip required client-certificate checks by resuming a DTLS 1.2 session the server cached before the original handshake finished. GHSA-cqhp-ggp7-58qj (high, 7.4) is a similar bypass when an application shares one session store between its outbound connections and its listener. The other three are denial-of-service bugs: an unbounded handshake cache (memory exhaustion), oversized peer RSA keys (CPU exhaustion), and repeated client-certificate verification while the server waits for the client's Finished message. The maintainers say the two session-resumption bypasses do not affect pion/webrtc users, but the impersonation flaw and the DoS bugs can reach WebRTC applications acting as the DTLS server. No CVE IDs were listed at publication and no exploitation is reported. Fixes shipped in v3.1.13 (16 Oct) and v3.1.14 (16 Oct, the session-store fixes); the advisories list no patched v2 release. Primary: Pion DTLS GitHub security advisories; context: maintainer post on Hacker News (16 Oct).
Researcher Quentin Kaiser disclosed on 16 October 2026, at Hexacon in Paris and in a long write-up, a memory-corruption flaw in Broadcom's proprietary 802.11 Wi-Fi stack: an overflow in the reassembly of WPS EAP messages that can be triggered remotely over Wi-Fi without the network key or a completed WPS enrollment, giving controlled information disclosure and arbitrary code execution. He says the bug has been in Broadcom's SDK since at least 2010; Broadcom silently shipped an incomplete patch in 2018 and then advised OEMs to move to hostapd, leaving it a lasting 'forever day' on eCos-based chips (BCM3380, BCM3383, BCM33834) and a potential one on Linux-based chips (BCM3390, BCM65xx, BCM68xx) on any device that was never migrated. Broadcom declined to assign a CVE or publish an advisory, which Kaiser says is why so many OEMs never patched; he reported it under a 90-day timeline that expired on 16 October. He demonstrated working over-the-air exploitation against gateways from three of four Belgian ISPs (Proximus BBOX 3/3V+ Sagemcom F@st, VOO Netgear CG3100/CG3700 and Technicolor/Commscope models, Orange Belgium ASKEY TCG3000), showing a root shell and extraction of the Wi-Fi PSK from NVRAM, and says that as of 15 October none of the demonstrated devices were patched. The same Broadcom silicon ships worldwide in cable and DSL gateways from many vendors, so the blast radius extends well beyond Belgium; Kaiser released a fingerprinting script and a YARA rule to help map affected models. There is no indication of in-the-wild exploitation, and no Australian ISP or device has been named. Primary: Quentin Kaiser research (16 Oct); context: Hexacon 2026 talk.
Quentin Kaiser — One Parser, Two Bugs, Many Routers: exploiting Broadcom Wi-Fi across eCos and Linux (16 Oct 2026)
Security firm Calif published research and full exploit code on 16 October 2026 showing local privilege escalation to root on OpenBSD 7.9 with KARL kernel relinking, SMAP and SMEP enabled, and without any information-leak bug. The chain starts with shm_nattch, the System V shared-memory attach counter, which has been a signed 16-bit short since the original 1988 BSD sources: mapping 127 segments and forking 259 processes wraps it to -32,643, and a race then frees kernel memory other processes still use. A separate out-of-bounds write corrupts multicast-membership counters so that later decrements alter page-table entries, making a user mapping supervisor-accessible; the exploit then overwrites a function pointer that sits at a predictable kernel address because OpenBSD's boot-time and best-fit allocators are not randomised. OpenBSD fixed the integer overflow in errata 018 on 14 September 2026, labelled a reliability fix, and the reference-counting use-after-free in errata 026 on 30 September, labelled a security fix; both apply to all architectures through syspatch, and OpenBSD 7.8 also received the overflow fix. No CVE has been assigned and there is no report of use in attacks. Calif also proposes kernel hardening such as safe unlinking for linked lists and allocator randomisation. Primary: OpenBSD 7.9 errata; research: Calif (16 Oct); wire: The Hacker News.
The Apache Kylin project published five CVE records on 16 October 2026 for the open-source OLAP analytics engine, all fixed in Kylin 5.0.5. CVE-2026-64959, which Apache rates critical, is a backend cache API that is missing authentication and can execute injected SQL (Kylin 5.0 to 5.0.4). The others, affecting Kylin 4 through 5.0.4, are CVE-2026-68571, code injection through a special parameter in a JDBC URL (moderate); CVE-2026-64610, unsafe Java deserialisation from a broken external cache service (moderate); CVE-2026-63619, a metadata dump API without enough authorisation or path confinement (moderate); and CVE-2026-63618, exposure of system configuration information (important; CISA's enrichment scores it CVSS 3.1 7.5). Apache says the impact falls mostly on Kylin services exposed directly to the internet, which it describes as uncommon, and that in-house deployments are mostly unaffected. No exploitation is reported. Primary: Apache Kylin advisories on the Apache security mailing list (16 Oct 2026).
Google's Chrome Releases blog says the Stable channel was updated on 15 October 2026 to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 for Linux, rolling out over the coming days and weeks, with 10 security fixes. The one Critical bug is CVE-2026-110922, a use-after-free in Prerender reported by Xinyang Ge on 2 October. The six High bugs are CVE-2026-110913 (memory corruption in DOM, reported by Xinyang Ge of Anthropic, assisted by Claude, on 29 September), CVE-2026-110919 and CVE-2026-110921 (use-after-free in V8), CVE-2026-110920 (memory corruption in V8), CVE-2026-110918 (memory corruption in Core, found by Google) and CVE-2026-110917 (memory corruption in SVG, reported by C0rk1). The three Medium bugs are CVE-2026-110916 (improper input validation in Desktop), CVE-2026-110915 (use-after-free in Compositing) and CVE-2026-110914 (memory corruption in Workers). Google does not say any of them is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. The same day, Extended Stable moved to 152.0.7977.169 for Windows and Mac with 10 fixes, including Critical CVE-2026-110151 and CVE-2026-110922, and Chrome 155.0.8059.84 for Android carries the same fixes as desktop. This follows the 13 October 155.0.8059.79/.80 release, which is a separate card. Primary: Chrome Releases (15 Oct 2026); wire: Cyber Security News (17 Oct 2026).
Chrome Releases — Stable Channel Update for Desktop, 155.0.8059.84/.85 (15 Oct 2026)
