MVSEP, an online service that separates music and voice tracks, published a security incident notice (last updated 6 October 2026) saying an attacker was in its servers between 4 and 6 October and could read its database and stored files. Automated probing began on 4 October; at about 01:30 UTC on 5 October the attacker abused a flaw in how the website read one of its browser cookies to run commands on the web server, found login details for MVSEP's other servers and signed in to them as an administrator. The 5 October database outage was the attacker restarting the database. MVSEP fixed the flaw on all servers at 03:25 UTC on 6 October, removed the access, moved servers to key-only logins and replaced its encryption key, database and payment-provider keys, and Google, GitHub, Google Drive and Yandex Disk credentials. It is treating everything as exposed: names, email addresses, sign-in method, plan and credit balance; passwords as salted bcrypt hashes; API keys, which were stored as-is and work until replaced; processing history including file names, transcriptions, job IP addresses and webhook URLs; audio uploads still on the servers; payment records (card details are entered on Paddle and YooKassa pages and never reached MVSEP); support tickets; and cloud-storage tokens, now revoked. All saved logins were signed out. MVSEP has not said how many users are affected. Primary: MVSEP incident notice.
MVSEP — Security incident: 4–6 October 2026 (last updated 6 Oct 2026)
Advantest Corporation, a Japanese maker of automated test equipment for the semiconductor industry, has begun notifying people that their personal information was taken in the ransomware attack it disclosed in February 2026. An attacker broke into its network on 15 February and deployed ransomware; at the time the company could not say whether customer or employee data was affected. In a notification letter dated 6 October 2026, Advantest says an unauthorised third party accessed its systems and extracted data from its servers, including the recipient's personally identifiable information. The letter does not say how many people are affected or whether they are customers, employees or partners, and BleepingComputer had no answer to those questions at publication. Advantest says it has no information that the data has been leaked or misused, and is offering 18 months of identity, credit and web monitoring through Kroll, with enrolment open until 4 January 2027. BleepingComputer found no public claim by a ransomware group. Source: BleepingComputer (7 Oct), which quotes the notification; Advantest's own notice is not yet linked publicly.
BleepingComputer — Advantest confirms personal information stolen in ransomware attack (7 Oct 2026)
Veeam released Veeam Backup & Replication 12.3.2 P4 (build 12.3.2.4934) on 6 October 2026 and listed the security fixes in KB4934. The serious one is CVE-2025-64393, rated Critical at CVSS 4.0 9.4: a low-privileged user holding only the Backup Viewer role can run code on the Veeam Backup Server through insecure deserialization of data received by the Mount Service, with no user interaction. CVE-2026-93026 (6.1) lets a Backup Viewer user change or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials, and CVE-2025-64392 (4.8) is a reflected cross-site scripting flaw in Veeam Backup Enterprise Manager that needs a logged-in portal user to open a crafted link. These three affect build 12.3.2.4854 and earlier version 12 builds; Veeam says version 13 is not affected by them. The same patch also carries the fix for CVE-2026-58069 (8.3), first published in KB4902 for version 13.1, which lets an authenticated Veeam Cloud Connect tenant read any file on the service provider's host; for version 13 that one is fixed in 13.0.3.63 and 13.1.0.411. All four were reported through HackerOne, and no exploitation has been reported. Backup servers are a favourite ransomware target, and Veeam flaws have been weaponised quickly after past patches. Version 12 reaches end of support on 28 February 2027. Primary: Veeam KB4934.
Veeam — KB4934: Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 (published 6 Oct 2026)
The SPIP maintenance team released two critical security updates on 6 October 2026 for SPIP, the French open-source content management system widely used by public bodies and associations in France. SPIP 4.4.27 (4.4.26 was skipped) fixes many flaws, which the team describes as pre-authentication remote code execution, privilege escalation, cross-site scripting, SQLite injection, anonymous HTML upload and reconstruction of the site secret. SPIP warns that its security screen, the protective filter many sites rely on between releases, does not block these. Separately, the Crayons plugin, which lets editors change content directly on the page, was updated to 3.5.0 and the Simple logs (Simplog) plugin to 2.3.0. One Crayons flaw, CVE-2026-104070 (CVSS 3.1 9.8, CVSS 4.0 9.3), lets an unauthenticated attacker skip the authorization check in crayons_store.php by leaving out the anti-forgery parameter, then chain it to write a malicious template file, read the configuration that holds the site secret, and run PHP code as the web server user. The Simplog flaw allows reading and deleting any file in the installation, which can be used to reinstall the site and create a webmaster account. No exploitation has been reported. Primary: SPIP blog; CVE record.
SPIP Blog — Mises à jour de sécurité critique : plugins Crayons et Simplog (6 Oct 2026, French)
HPE published security bulletin HPESBNW05156 on 6 October 2026 for HPE Networking AOS-Switch (AOS-S), the operating system on the former Aruba campus and access switches. It covers nine vulnerabilities in AOS-S 16.11.0031 and earlier, mostly found by HPE's own researchers. Three are rated 9.8 and need no login: CVE-2026-76742, an authentication bypass in the web management interface; CVE-2026-76743, an authentication bypass in the management interface that depends on conditions outside the attacker's control; and CVE-2026-76744, a group of buffer overflows that can let a remote attacker run code. Others include memory corruption reachable from an adjacent network that can lead to code execution (CVE-2026-76745, 9.6), adjacent and remote buffer overflows that leak information (CVE-2026-76746, 9.3; CVE-2026-76747, 9.1), privilege escalation through the API for a logged-in user (CVE-2026-76748, 8.8), and two 6.5-rated issues covering denial of service and information disclosure (CVE-2026-76741, CVE-2026-76749). HPE says it knows of no public discussion or exploit code, but urges customers to patch because of how broad and serious the set is. Versions past End of Maintenance should be treated as affected. Primary: HPE security bulletin.
HPE — HPESBNW05156 rev 1: Multiple Vulnerabilities in HPE Networking AOS-Switch (AOS-S) (6 Oct 2026)
Google moved Chrome 155 to the Stable channel on 6 October 2026, version 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux, rolling out over the following days and weeks. The release fixes 247 security bugs. Google rates four as Critical, all use-after-free memory errors: CVE-2026-106382 in Chromecast (found by Google), CVE-2026-106197 in the browser process, and CVE-2026-106358 in Navigation and CVE-2026-106347 in Track, the last two reported by Xinyang Ge of Anthropic with help from Claude. Another 53 are rated High, among them several uninitialised-resource and type-confusion bugs in the ANGLE graphics layer, a SiteIsolation authorization flaw (CVE-2026-102322), and race conditions in Fonts; the rest are Medium and Low. Google's release note does not say any of them are being exploited, and it keeps bug details restricted until most users have updated. Google does not publish CVSS scores for Chrome bugs. Browsers built on Chromium, such as Microsoft Edge, Brave and Opera, will need their own updates. Primary: Chrome Releases blog.
Google Chrome Releases — Stable Channel Update for Desktop (6 Oct 2026, Chrome 155.0.8059.39)
A CVE record published through GitHub's CNA on 6 October 2026 covers a cross-site scripting flaw in Quasar, the Vue.js user-interface framework. Before 2.22.0, the server-side rendering (SSR) meta plugin built title, meta, link and script tags from values passed to useMeta() without HTML encoding, then added them to the raw server response. If an app puts attacker-influenced text such as a post title, product name, excerpt or display name into page metadata, an attacker can break out of the tag and inject script that runs for every visitor before the page hydrates. Client-side rendering is not affected because it sets attributes through the browser's DOM APIs. The CNA scores it 10.0 (network, no privileges, no user interaction, scope changed), though real impact depends on whether an app feeds user content into useMeta() on SSR pages. The fix shipped in quasar 2.22.0 in July 2026; the current release is 2.34.0. No exploitation has been reported. Primary: Quasar GitHub advisory and CVE record.
Quasar — GHSA-pq96-jpmf-w254: XSS via unescaped SSR meta tag rendering in getHead()
JetBrains, as CVE numbering authority, published CVE-2026-106218 on 6 October 2026: in TeamCity before 2026.1.3 and 2025.11.7, the Kotlin DSL sandbox could be escaped, leading to remote code execution on the TeamCity server. JetBrains scores it 8.8 under CVSS 3.1, needing low privileges and no user interaction, so any user able to supply Kotlin DSL project settings should be treated as able to run code on the build server. JetBrains published a second TeamCity CVE the same day, CVE-2026-106219 (CVSS 6.5): before 2026.2.1, missing validation of Git submodule URLs let users read local repositories on the server. No exploitation has been reported. Earlier TeamCity flaws disclosed in 2023 and 2024 were exploited soon after release, so internet-reachable build servers should be patched quickly. Primary: JetBrains CVE records and fixed security issues page.
JetBrains — Fixed security issues (TeamCity CVE-2026-106218 and CVE-2026-106219)
Payload, the open-source TypeScript headless CMS and application framework, had at least 29 CVEs published through GitHub's CNA on 6 October 2026 across the core package and official plugins. The worst: CVE-2026-105857 (CVSS 3.1 10.0), a crafted form submission that runs code on the server when @payloadcms/plugin-form-builder is used, fixed in 3.90.0; CVE-2026-105845 (9.8), SQL injection in the SQLite and Postgres adapters by anyone who can query readable collections with dynamic filters or joins, fixed in 3.88.0; CVE-2026-105844 (CVSS 4.0 9.3), prototype pollution through @payloadcms/plugin-import-export by an unauthenticated user that can lead to code execution, fixed in 3.88.0; CVE-2026-105863 (9.2), custom fields mapped to reserved authentication claim names placing attacker-chosen values in login tokens, fixed in 3.90.0; and CVE-2026-105858 (8.1), remote code execution through the public first-register operation on an instance with local authentication and no first user yet. Others include a second SQL injection through json or blocks fields (CVE-2026-105856, 8.6), API keys readable through ordinary document reads (CVE-2026-105849), MCP API key management outside the caller's own account in @payloadcms/plugin-mcp 3.61.0 to 3.87.x (CVE-2026-105806, 8.6), multi-tenant plugin isolation bypasses, password field access-control bypass, S3 object overwrite, Stripe proxy misuse, path traversal in local upload cleanup, and a PBKDF2 work factor below current guidance. The 4.0 canary line is fixed in 4.0.0-canary.34. No exploitation has been reported. Primary: Payload GitHub security advisories and CVE records.
Payload — GHSA-r488-j9vj-wx3q: RCE in Payload Form Builder (CVE-2026-105857)
Patchstack reported on 6 October 2026 that one attacker is exploiting two unrelated stored cross-site scripting (XSS) flaws in WordPress plugins with the same JavaScript payload, loaded from imgcdn1[.]com. Patchstack first saw it on 4 October against CVE-2026-93836 in WPC Product Bundles for WooCommerce (8.6.6 and earlier, about 30,000 active sites), where a numeric quantity value with extra markup is stored in WooCommerce order data. On 5 October the same payload arrived through CVE-2026-94504 in Ninja Forms (3.15.3 and earlier, more than 500,000 sites), submitted through the plugin's normal form-submission AJAX endpoint and later rendered unescaped in the legacy admin submission editor. Neither needs the attacker to log in; the script runs when a logged-in administrator opens the order or form submission. It then uses the administrator's own session and WordPress nonces to upload a malicious plugin posing as "WP Smart Thumbnails" 1.2.4 from "MediaPress Labs", create an administrator account, and report back to its server. Patchstack found the plugin carries a heavily packed file manager that works without login, plus a second script that creates an administrator hidden from the Users screen and its counts, adds a secret login URL that signs in as the original site owner, and backdates its own files. Those extra pieces keep working after the fake plugin is removed. Patchstack says exploitation is limited so far and expects more plugins to be used. Both CVE records were published by Wordfence on 22 September with CVSS 7.2. Primary: Patchstack; wire: BleepingComputer.
Patchstack — Four ways back in: the WordPress XSS campaign that hides its own admin account (6 Oct 2026)
Trend Micro's Zero Day Initiative (ZDI) runs Pwn2Own Ireland 2026 from 6 October. Day one (BleepingComputer: 32 zero-days, US$388,500) included VinSOC chaining five bugs against the Oracle Autonomous AI Database and seven zero-days against the Philips Hue Bridge Pro (US$40,000 each); Ikotas Labs exploiting the OpenAI Codex cloud coding agent with one argument-injection bug (US$40,000); Xint's Taisic Yun and Out of Bounds both winning against the LiteLLM AI gateway; McCaulay Hudson on the Sonos Era 300 (US$50,000); Lexmark CX532adwe printer wins; and Interrupt Labs taking the first wellness-category win on the Garmin Index BPM blood pressure monitor. Day two (7 October; BleepingComputer: 45 unique zero-days, US$232,500) saw the Galaxy S26 compromised three more times, by Mobile Hacking Lab and CENSUS Labs researchers with a single confused-deputy bug, by KAIST Hacking Lab's Kyeongmin Kim remotely with one new bug and two known ones, and by PetoWorks. HaeJung Yang of Out of Bounds won US$40,000 against Dynamo in the AI infrastructure category; Ikotas Labs used a seven-bug chain ending in a use-after-free and type confusion against Oracle Autonomous AI Database, and Xint's Taisic Yun also beat it with two new bugs; Home Assistant Green fell to Xint's Yves Bieri (US$30,000), PetoWorks, Kyeongmin Kim and Doyensec (all known bugs); McCaulay Hudson used hard-coded credentials, missing authentication and command injection on a Canon imageFORCE 1643F; and Interrupt Labs and Zellic/v12 each beat the Lexmark CX532adwe. Attempts on a Brother printer, Chroma and one Home Assistant entry failed, and no one registered for the iPhone 17. UPDATE (9 Oct, final day): ZDI's day-three results and BleepingComputer report 21 more zero-days and US$641,000 on 8 October, for a contest total of US$1,262,000 and 98 zero-days from 29 teams (2025: 73 zero-days, US$1,024,750). The Google Pixel 10 fell three times: Ikotas Labs took the top US$300,000 award with a remote multi-bug chain, Xint's Tim Becker and Yves Bieri earned US$150,000 (one known bug), and Dimitrios Valsamaras, Ken Gannon and Tenia Valsamara earned US$112,500 (one zero-day plus one known bug). BunkyoWesterns hit the Galaxy S26 again; FuzzingLabs beat the Brother MFC-L8970CDW with one zero-day (US$20,000); Summoning Team beat the Canon imageFORCE 1643F; Team MAMMOTH used six zero-days on Home Assistant Green; and further entries against the Philips Hue Bridge Pro, Oracle Autonomous AI Database and Lexmark CX532adwe were partial collisions. A Garmin Index BPM attempt failed. Ikotas Labs won Master of Pwn with 42.5 points and US$361,000, ahead of Xint (US$240,000) and Team ZyGoat (US$125,000). No one tried the iPhone 17 or WhatsApp (US$300,000 each). Vendors have 90 days to ship fixes before ZDI publishes details; no CVEs have been assigned yet. Primary: ZDI; wire: BleepingComputer.
Zero Day Initiative — Pwn2Own Ireland 2026: Day Three Results and Master of Pwn (8 Oct 2026)
Google said on 6 October 2026 that the previous week it became aware of hijacks of three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). The attackers compromised the third-party registries rather than Google or the domain owners, changed the authoritative DNS records for selected domains under those suffixes, and used that control to pass certificate authority domain validation and obtain HTTPS certificates covering several Google domains and domains of other organisations. Google says it has no reason to believe the issuing certificate authorities did anything wrong. Chrome blocked the certificates through CRLSets and Google worked with the issuing CAs to revoke them; Certificate Transparency data pointed to more affected organisations, including leading global brands and widely used services, which Google also blocked and contacted where it could. Update 8 Oct: The Hacker News reviewed Certificate Transparency logs and found at least 12 unauthorised certificates for seven Google and YouTube names, including google.com.gh, google.sl and google.as, logged one ccTLD at a time: .gh on 22 September, .sl on 25 September and .as on 27 September. Let's Encrypt issued 11 and ZeroSSL one, and a Let's Encrypt staff member confirmed on its community forum on 7 October that Google and YouTube certificates were issued and revoked. All 12 showed as revoked by 1 October, between about a day and a half and nearly a week after first being logged. Only a small set of names was searched, so the total is likely higher. Google has not named the attackers, said how the registries were breached, whether any certificate was used to impersonate a site, or whether the registries are now secure, and warns its analysis may have missed affected domains and that Chrome's blocking does not protect other browsers. Primary: Google (Chrome Security blog); wires: The Hacker News, Ars Technica.
Google — Chrome's response to recent ccTLD registry hijacks (6 Oct 2026)
