IBM published two security bulletins on 8 October 2026 for IBM Guardium Data Protection, the database activity monitoring platform whose collectors sit on the network and inspect database traffic. The Sniffer bulletin (versions 12.0, 12.1 and 12.2) fixes CVE-2026-75875 (CVSS 9.8, path traversal allowing remote code execution), CVE-2026-80381 (9.8) and CVE-2026-81932 (8.6, unauthenticated SQL injection), and several memory-corruption bugs in the traffic parsers, including a MongoDB SCRAM username overflow (CVE-2026-82335, 8.1) and a Microsoft SQL Server TDS PRELOGIN overflow (CVE-2026-84058, 8.1) that a remote attacker could trigger simply by sending crafted packets across a network the collector monitors. The Edge bulletin fixes CVE-2026-84272 (9.8): the edge-controller in 12.1 and 12.2.2 lacks authentication, so an unauthenticated remote attacker could run arbitrary container images and take control of managed edge clusters. The CVE records were published on 8 October; a related September bulletin also fixed CVE-2026-84249 (9.8, missing authentication for management operations in 12.2 and 12.2.2). IBM lists no workarounds and no exploitation. Primary: IBM.
IBM — Security Bulletin: multiple vulnerabilities addressed in the Sniffer component of IBM Guardium Data Protection (8 Oct 2026)
Researchers from the V12 security team (Rick de Jager) published a full working exploit on GitHub on 8 October 2026 for a heap buffer overflow in the session protocol of AnyDesk for Linux. When handling mode-5 stream packets, AnyDesk adds a 16-byte header to the payload length declared by the remote side using 32-bit arithmetic with no overflow check; a declared length of 0xFFFFFFF0 wraps to a tiny allocation while the object keeps the huge length, so attacker data is written past the end of the buffer. Because the AnyDesk service normally runs as root on Linux, the exploit gains root command execution before the desktop user approves the session. The published exploit works over direct TCP connections to port 7070 and is tuned for build 8.0.2; it is probabilistic and may crash the service instead. The researchers say the same code path is reachable through AnyDesk relay servers (shown only with a minimal trigger), while AnyDesk said in June that the issue is limited to direct connections on Linux and that Windows and macOS are not affected. The researchers reported the bug on 22 June; AnyDesk fixed it in Linux 8.0.3 the next day with a changelog line about a crash, assigned no CVE and issued no advisory (none as of 9 October). The latest Linux release is 8.1.0. No exploitation in the wild has been reported. Source: V12's research release on GitHub; wire: The Hacker News. Correction (22 Oct 2026): the headline said the flaw had no CVE. CVE-2026-109390 was published on 12 October 2026, assigned and scored (CVSS 3.1 9.8) by MITRE as the CNA, covering AnyDesk for Linux 8.0.0 to before 8.0.3; Censys says AnyDesk still had not published its own security advisory as of 13 October. (source: Censys advisory, 13 Oct 2026; CVE record CVE-2026-109390)
The Hacker News — Researchers publish working exploit for pre-auth AnyDesk Linux flaw that gives root access (9 Oct 2026; V12 code released on GitHub 8 Oct)
Citrix Security Bulletin CTX697191 (published 8 October 2026) assigns CVE-2026-107406 to a memory-overflow flaw (CWE-119) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a SAML service provider or identity provider. CVSS v4.0 base 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L). Successful abuse can lead to remote code execution or denial of service. Exposure is version-specific: builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and matching FIPS/NDcPP ranges) are affected only as SAML IdP; older supported builds before those floors are affected as either SAML SP or IdP. Citrix urges upgrades to 14.1-73.46 or later, 13.1-64.29 or later, 14.1-73.46 FIPS or later, and 13.1-37.283 or later for 13.1-FIPS/NDcPP. Secure Private Access Hybrid deployments that use affected NetScaler instances also need the upgrade. Customer-managed appliances only; Citrix-managed cloud and Adaptive Authentication are updated by Citrix. Check config for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP). Citrix said it was not aware of unmitigated exploits at publication. Distinct from earlier SAML DoS CVE-2026-88779 (desk card citrix-netscaler-saml-acsc-20261003). Primary: Citrix CTX697191; wire: Cyber Security News.
GreyNoise reported on 8 October 2026 a rise in scanning and exploitation attempts against digital video recorders and cameras in Ukraine between 21 September and 1 October 2026. Almost all of it targeted CVE-2021-36260, the 2021 unauthenticated command injection in the web server of many Hikvision products (CVSS 9.8, NVD). Reconnaissance started on 21 September from a Ukrainian IP address; exploitation attempts jumped from near zero on 23 September and ran to 1 October. Four IP addresses sent nearly all of them: three PureVPN exit nodes (195.238.124.178, .181 and .188, AS56630) and one Ukrainian domestic address, which GreyNoise links to the VPN activity only with low confidence. Every request used the same command test from the public Nuclei template for this bug, with no payload, and the four addresses did not try it against GreyNoise sensors outside Ukraine; nothing more came from them through 7 October. GreyNoise records attempts, not confirmed takeovers, and does not link the activity to the missile and drone strikes it coincided with. Context: Ukraine said in January 2024 that Russian intelligence had used two hijacked cameras to watch Kyiv air defences. Primary: GreyNoise; wire: Cyber Security News.
GreyNoise — Spike in attacks targeting digital video recorders in Ukraine (8 Oct 2026)
Strapi Cleartext Storage of Sensitive Information Vulnerability. Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ONLYOFFICE Docs Server Path Traversal Vulnerability. ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Apache Struts Command Injection Vulnerability. Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ISC BIND Data Processing Errors Vulnerability. ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ProFTPD Improper Access Control Vulnerability. ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
SEC Consult published technical details on 8 October 2026 of five vulnerabilities it reported to TP-Link from December 2024 in ISP-supplied (Aginet) mesh systems, routers, fibre (PON) devices and DSL modems. TP-Link says 65 models are affected, including ISP-customised variants; the list includes Australian models HX510(AU) and HX220(AU). CVE-2025-30237 is an authentication bypass in the web server that lets an unauthenticated attacker with access to the web interface create a super-administrator and enable SSH; CVE-2025-30238 lets a low-privileged user act as an administrator; CVE-2025-30241 is authenticated command injection as root; CVE-2025-30239 is hardcoded, model-wide keys protecting configuration files and backups, so extracted keys reveal user, Wi-Fi and sometimes ISP remote-management credentials; CVE-2025-30240 needs physical USB access to read the whole file system. SEC Consult says an attacker on the same network could fully take over a device. TP-Link disclosed the flaws in August 2026; its fixes, including custom ISP firmware, rolled out into 2026 and are distributed by ISPs. Separately, the attorneys general of Florida, Iowa, Montana and Nebraska filed near-identical consumer protection lawsuits against TP-Link Systems on 6 October, after Texas in February, alleging its HomeShield marketing overstated protection, citing past use of TP-Link routers in Volt Typhoon and Flax Typhoon activity, unsupported models without updates, and undisclosed ties to China; they cite these five CVEs. TP-Link's response is not in the reporting. No exploitation of the five flaws is reported. Primary: SEC Consult; wire: SecurityWeek.
SEC Consult Vulnerability Lab — Multiple critical vulnerabilities in multiple TP-Link device series (8 Oct 2026)
Searchlight Cyber researcher Kevin Gervot published a write-up on 7 October 2026 of two flaws in Discourse, the open-source forum platform Searchlight says powers more than 22,000 communities, including OpenAI, Atlassian and Cloudflare. Both were reported to Discourse on 9 June 2026 and affect default configurations. First, the color_scheme_id (and dark_scheme_id) cookie was written into a page tag without escaping and was not part of the anonymous page-cache key, so a single unauthenticated request could poison the cached page and run attacker JavaScript for every anonymous visitor, getting past Discourse's nonce-based Content Security Policy (CVE-2026-55674, CVSS 3.1 9.3). Second, a Trust Level 0 account, the lowest user level, could read files from the server through the profile picture upload. ImageMagick's policy blocked PostScript but still let Ghostscript handle files with a .pdf extension. Searchlight padded a JPEG so jpegoptim took about 25 seconds to process it, then used Ghostscript file operators that still work under its -dSAFER sandbox to swap the temporary file before ImageMagick computed the image's dominant colour. ImageMagick's MSVG coder then ran a Magick Scripting Language file that read a local file and saved it as an image, and Discourse handed it back as a normal upload URL (CVE-2026-55420). No Ghostscript zero-day was needed. Searchlight stopped at file read, but warns that reading Rails secrets such as secret_key_base could lead on to code execution. Discourse's CVE record for 55420 is titled remote code execution via PDF uploads, rates it CVSS 3.1 7.5 and says it needs certain non-default configurations. Discourse fixed its hosted sites on 15 June and published the ImageMagick fix on 30 June and the cache fix on 28 July. The fix adds a default-deny ImageMagick policy that blocks all delegates (no Ghostscript) and allowlists only the coders Discourse needs, and makes the colour-scheme cookies strict integers that are part of the cache key. This is separate from Hacktron's libheif research on this desk. No exploitation has been reported. Wire: Cybersecurity News 12 Oct.
Searchlight Cyber — A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline (Kevin Gervot, 7 Oct 2026)
AWS security bulletin 2026-128-AWS (published 7 October 2026, US Pacific time; early 8 October Perth) says missing authorisation checks in Amazon Athena engine version 3 request handling could have let an authenticated user read limited query metadata from other AWS accounts, namely AWS account identifiers and SQL statement text. AWS says query results, credentials and Amazon S3 data were not affected, that it fixed the issue on 1 September 2026, and that it has confirmed no customer metadata was accessed. No customer action is required. AWS credits Oren Yomtov of Act Security through coordinated disclosure. The AWS-issued CVE record rates it CVSS 3.1 7.7 (scope changed, high confidentiality impact). It is a cross-tenant flaw in a managed service, so there is nothing to patch on the customer side.
