Patchstack published an advisory on 8 October 2026 for an incorrect privilege assignment flaw in WooCommerce, the Automattic e-commerce plugin for WordPress, and the CVE record (Patchstack as CVE numbering authority) followed on 10 October. Versions 9.8.0 through 11.1.2 are affected. Patchstack says the attacker needs a Shop manager account, the built-in WooCommerce role many stores hand to staff or contractors for orders and products, and that the flaw lets that account escalate privileges; it rates the issue CVSS 3.1 7.2 (network, low complexity, high privileges required, high impact on confidentiality, integrity and availability) and medium priority. The researcher, Ananda Dhakal of Patchstack, reported it on 25 August. Patchstack lists 11.2.0 as the patched version. No technical write-up or exploitation has been reported. The risk is mainly to stores where shop manager logins are shared, weakly protected or held by outside parties, since a takeover of one of those accounts could become a full site takeover. Primary: Patchstack advisory; CVE record.
Patchstack — WooCommerce 9.8.0–11.1.2 Privilege Escalation (CVE-2026-106608, published 8 Oct 2026)
Zenity Labs disclosed AgentCorruption on 8 October 2026 at SecTor in Toronto. Researchers sent one prompt to a public-facing Amazon Bedrock AgentCore agent that had a common tool able to make outbound web requests, telling it to call the instance metadata service from inside its microVM. That returned temporary credentials for the agent's default execution role, and the role was not scoped to that agent: it carried region-wide AgentCore permissions. With it the researchers found other agents' IDs through CloudWatch log groups, pulled their container images (and source code) from ECR, invoked internal agents they were never meant to reach (bedrock-agentcore:InvokeAgentRuntime), read private conversations across agents and sessions (ListEvents), planted memories that redirected agents to send future conversations to an attacker (CreateEvent on AgentCore Memory), and read API keys, OAuth tokens and secrets (GetResourceApiKey, secretsmanager:GetSecretValue). Zenity reported the metadata access to AWS on 25 December 2025 and the role scope on 12 January 2026. AWS made IMDSv2 (MMDSv2) the default for new AgentCore runtimes and cut the default execution role's permissions; Zenity confirmed by 29 September that agent-to-agent invocation, chat reading and Secrets Manager access had been removed, and says the issues are fixed. AWS, per Cyber Security News, disputes calling it a vulnerability: it says an agent reaching its own execution-role credentials is expected and documented, and its guidance warns that any code inside the microVM can call the metadata endpoint. Existing agents built with the older broad default roles may still carry them. No in-the-wild abuse reported. Primary: Zenity press release and Zenity Labs write-ups; wire: Cyber Security News 10 Oct.
Zenity — Zenity Labs discloses AgentCorruption, a chain of AWS AgentCore flaws (8 Oct 2026)
CISA published ICS advisory ICSA-26-281-01 on 8 October 2026 for Red Lion Controls N-Tron 700 Series managed Ethernet switches (Red Lion is part of Sweden's HMS Networks), used worldwide in critical manufacturing, communications and commercial facilities. Firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier are affected by seven CVEs: SNMP can retrieve configuration files, change user accounts and settings and start firmware or bootloader upgrades or downgrades without authentication (CVE-2026-33367, CVSS 3.1 8.1); usernames and passwords, including factory defaults, sit in plaintext in the configuration file and can be exported by TFTP, which SNMP can trigger without logging in (CVE-2026-39460, 8.1); browsing to a particular URL on the web server reboots the switch, which can be scripted for a constant reboot loop (CVE-2026-39453, 8.3); credentials are stored with weak, recoverable encryption (CVE-2026-28745, 7.5); firmware and bootloader updates need no authentication and N-Tron devices can be found and pushed new firmware over SNMP/TFTP (CVE-2026-29797, 7.1); factory administrator credentials stay active even after other admin accounts are set up (CVE-2026-32645, 6.0); and someone with physical access can boot to factory settings and log in with the defaults (CVE-2026-33272, 4.9). CISA lists no known public exploitation. Primary: CISA advisory (CSAF); vendor: HMS Networks cybersecurity page.
CISA ICS advisory ICSA-26-281-01 — Red Lion Controls N-Tron 700 Series (8 Oct 2026)
CISA published ICS advisory ICSA-26-281-02 on 8 October 2026 for Grid Protection Alliance's openPDC (a phasor data concentrator for synchrophasor/PMU data in power grids) and openHistorian (a time-series historian). CVE-2026-100730 (CVSS 3.1 9.8): a service console interface deserialises client-supplied data; with Windows Authentication it needs a logged-in user, without it an unauthenticated network attacker can trigger deserialisation of an arbitrary object graph. CVE-2026-105278 (9.8): the published openPDC Docker image ships a fixed administrative credential with no forced change. CVE-2026-104629 (8.8): the component loader will build and run any specified type, so an authenticated user who can drop a file on the host can run code as the service account. CVE-2026-105281 (7.5) and CVE-2026-85479 (5.3): the internal and STTP data publishers accept unauthenticated connections by default, exposing the device and measurement topology or data exchange. CVE-2026-101022 (4.3): the Modbus connection feature can be pointed at any internal host to map the network. The new defaults bind the publishers to loopback only on new installs; upgraded systems keep their old settings. The vendor has not published fixes to the Docker image and advises against running those images in live environments. CISA lists no known public exploitation. Primary: CISA advisory (CSAF).
CISA ICS advisory ICSA-26-281-02 — Grid Protection Alliance openPDC and openHistorian (8 Oct 2026)
Flashpoint published an analysis on 8 October 2026 of CastleStealer, a C# information stealer first seen in April 2026 in a ClickFix campaign that ran a Python script to launch a loader called CastleLoader. By June it was spreading through malicious search ads for Node.js that led to fake installer sites, where a batch file pulled down an in-house loader called OXLOADER that decrypts itself in several rounds, hides its API calls, checks for sandboxes and runs in memory. Newer samples skip Russian-language systems, send a handshake with a build ID to their command server, then collect Chromium browser logins, cookies, history, form data and extension storage. They now get past Chrome's App-Bound Encryption by abusing the browser's IElevator COM interface, a trick other modern stealers also use. A basic remote shell lets an operator run commands, push a file to run or have the malware download another payload, so an infection does not end once passwords are taken. Stolen data leaves in small AES-encrypted chunks over raw TCP rather than one big archive, which Flashpoint says may avoid alerts for large transfers; the malware then deletes itself. Flashpoint has not yet seen wide uptake by criminals. Primary: Flashpoint; wire: Cyber Security News.
Flashpoint — CastleStealer: an emerging infostealer growing more sophisticated (8 Oct 2026)
Gen Threat Labs (Gen Digital) published an analysis on 8 October 2026 of Warden Stealer, a Windows information stealer sold as malware-as-a-service and written in Rust. First builds appeared in early May 2026 and it has been advertised on Russian-language forums since August; within months it became one of the most common stealers in Gen's user base. Gen previously tracked it as CallbackBeaver and has now linked it to the Warden brand. Each operator configures their own build, targets and command-and-control servers, and the kit includes its own loader and a clipboard clipper that swaps copied cryptocurrency wallet addresses. Builds are heavily obfuscated and re-shaped ('morphed') to beat signature detection, and Gen documents how it bypasses Chrome's Application-Bound Encryption. Beyond browsers, wallets, messengers, password managers and VPN clients, many builds collect configuration files and local data from AI assistants and coding agents, which can hold access and refresh tokens, MCP credentials, prompt histories and project traces; version 1.9, announced on 29 September 2026, made AI coding agent token theft an official feature. Operators spread it through ClickFix fake-verification pages, malicious ads, cracked software and fake game cheats (per Cyber Security News). Primary: Gen Threat Labs; wire: Cyber Security News.
Gen Threat Labs — Warden Stealer: from attribution to a technical breakdown of a Rust infostealer (8 Oct 2026)
CERT Polska published CVE-2026-103663 on 8 October 2026 for Ollama, the popular tool for running large language models locally. The /api/pull endpoint, used to download model layers, did not properly check layer digests in its digestToPath function, so an unauthenticated remote attacker can supply a digest containing a path traversal sequence and have a malicious file written outside the model store. If the server process can write to /usr/lib/ollama, which is the default in most Ollama Docker images, the planted file is loaded and executed on the next server restart, giving code execution as root. CERT Polska rates it CVSS 4.0 9.4 (the vector requires some user interaction, such as a pull being triggered). Ollama fixed it in version 0.35.0, released on 28 September 2026 (UTC). The bug was reported by Bartłomiej Dmitruk (striga.ai). No exploitation has been reported, but exposed Ollama servers are already being hunted by botnets such as PoeLLM. Primary: CERT Polska.
CERT Polska — CVE-2026-103663 vulnerability in Ollama (8 Oct 2026)
LAVA published research on 8 October 2026 about CVE-2026-47483, a flaw it reported in NVIDIA's DCGM Exporter, the tool that publishes GPU health and usage metrics (typically on port 9400) for systems such as Prometheus. The exporter exposed Go's /debug/pprof profiling endpoints without authentication, and enough concurrent profiling requests can exhaust memory and crash it, blinding operators to GPU health and possibly slowing training or inference on the same host (CWE-770; NVIDIA rates it 8.2, denial of service and information disclosure). LAVA reproduced the behaviour with NVIDIA's official container unmodified. In four internet scans it found more than 2,000 hosts exposing the exporter without authentication, reporting over 12,000 unique GPUs including Blackwell Ultra B300, H200 and H100 parts as well as RTX 5090 and 4090 cards; many sat on customer infrastructure at GPU cloud providers such as Voltage Park, Lambda, Northern Data and DigitalOcean, which helped notify customers. LAVA did not test the crash against public systems. NVIDIA's July 2026 bulletin fixed the issue in the release pairing DCGM 4.5.3 with DCGM Exporter 4.8.2, which makes pprof opt-in (--enable-pprof or DCGM_EXPORTER_ENABLE_PPROF). No exploitation has been reported. Primary: NVIDIA bulletin and LAVA; wire: SecurityWeek.
Microsoft's Security Update Guide added seven cloud-service CVEs on 8 October 2026 (US time), all rated Critical by Microsoft and all marked as already fully mitigated by Microsoft with no action for customers; they are published for transparency under its cloud-service CVE policy. They are CVE-2026-96207, improper certificate validation in Microsoft Partner Center allowing privilege escalation by an unauthenticated attacker (CVSS 10.0); CVE-2026-94510, an authorisation bypass through a user-controlled key in Microsoft Bookings (9.9); CVE-2026-88131, deserialisation of untrusted data allowing unauthenticated code execution in Microsoft Dataverse (9.8); CVE-2026-77900, missing authentication allowing unauthenticated code execution in Azure App Service (9.8); CVE-2026-69435, missing authorisation in Azure SRE Agent allowing an authenticated attacker to escalate privileges (9.6); CVE-2026-83943, information disclosure in Azure API Center (8.7); and CVE-2026-83947, spoofing in Azure Event Grid (7.7). Microsoft says none were publicly disclosed or exploited. Primary: Microsoft Security Response Center.
Microsoft Security Response Center — CVE-2026-96207, Microsoft Partner Center elevation of privilege (8 Oct 2026)
IBM published two security bulletins on 8 October 2026 for IBM Guardium Data Protection, the database activity monitoring platform whose collectors sit on the network and inspect database traffic. The Sniffer bulletin (versions 12.0, 12.1 and 12.2) fixes CVE-2026-75875 (CVSS 9.8, path traversal allowing remote code execution), CVE-2026-80381 (9.8) and CVE-2026-81932 (8.6, unauthenticated SQL injection), and several memory-corruption bugs in the traffic parsers, including a MongoDB SCRAM username overflow (CVE-2026-82335, 8.1) and a Microsoft SQL Server TDS PRELOGIN overflow (CVE-2026-84058, 8.1) that a remote attacker could trigger simply by sending crafted packets across a network the collector monitors. The Edge bulletin fixes CVE-2026-84272 (9.8): the edge-controller in 12.1 and 12.2.2 lacks authentication, so an unauthenticated remote attacker could run arbitrary container images and take control of managed edge clusters. The CVE records were published on 8 October; a related September bulletin also fixed CVE-2026-84249 (9.8, missing authentication for management operations in 12.2 and 12.2.2). IBM lists no workarounds and no exploitation. Primary: IBM.
IBM — Security Bulletin: multiple vulnerabilities addressed in the Sniffer component of IBM Guardium Data Protection (8 Oct 2026)
Researchers from the V12 security team (Rick de Jager) published a full working exploit on GitHub on 8 October 2026 for a heap buffer overflow in the session protocol of AnyDesk for Linux. When handling mode-5 stream packets, AnyDesk adds a 16-byte header to the payload length declared by the remote side using 32-bit arithmetic with no overflow check; a declared length of 0xFFFFFFF0 wraps to a tiny allocation while the object keeps the huge length, so attacker data is written past the end of the buffer. Because the AnyDesk service normally runs as root on Linux, the exploit gains root command execution before the desktop user approves the session. The published exploit works over direct TCP connections to port 7070 and is tuned for build 8.0.2; it is probabilistic and may crash the service instead. The researchers say the same code path is reachable through AnyDesk relay servers (shown only with a minimal trigger), while AnyDesk said in June that the issue is limited to direct connections on Linux and that Windows and macOS are not affected. The researchers reported the bug on 22 June; AnyDesk fixed it in Linux 8.0.3 the next day with a changelog line about a crash, assigned no CVE and issued no advisory (none as of 9 October). The latest Linux release is 8.1.0. No exploitation in the wild has been reported. Source: V12's research release on GitHub; wire: The Hacker News. Correction (22 Oct 2026): the headline said the flaw had no CVE. CVE-2026-109390 was published on 12 October 2026, assigned and scored (CVSS 3.1 9.8) by MITRE as the CNA, covering AnyDesk for Linux 8.0.0 to before 8.0.3; Censys says AnyDesk still had not published its own security advisory as of 13 October. (source: Censys advisory, 13 Oct 2026; CVE record CVE-2026-109390)
The Hacker News — Researchers publish working exploit for pre-auth AnyDesk Linux flaw that gives root access (9 Oct 2026; V12 code released on GitHub 8 Oct)
The US Justice Department said on 8 October 2026 that Oleg Korniev, 42, a dual Ukrainian and Russian citizen, pleaded guilty to running the Your Mule Cashout (YMCO) money-laundering organisation, which recruited more than 15,000 US-based money mules to launder at least US$10 million stolen by hackers from over 750 US bank accounts. Mules were recruited through spam from fake companies and an apparently normal hiring process, told they were processing payments for real businesses, and then wired stolen funds through Western Union and MoneyGram to cash-out contractors abroad (BleepingComputer lists Moldova, Ukraine, Russia and Latvia). Korniev admitted YMCO caused more than US$14.7 million in actual and intended losses and that he laundered at least US$7 million; he was arrested in the Republic of Georgia, pleaded guilty to money laundering, computer-fraud and access-device conspiracies and aggravated identity theft, and faces two to 50 years at a later sentencing. Four other YMCO members were earlier extradited and sentenced to about 37 to 63 months. BleepingComputer, citing the case, reports that YMCO ran similar mule schemes in Germany, Italy, the UK and Australia since it began in 2007. For employers and job seekers, 'payment processing' job offers that move money through personal accounts remain a classic mule recruitment pattern. Primary: US DOJ; wire: BleepingComputer.
US Department of Justice — Ukrainian-Russian dual citizen pleads guilty to running international money laundering organisation (8 Oct 2026)
