Dell's DSA-2026-324 (1 Oct 2026) fixes five flaws in Dell System Update, the command-line tool admins use to push BIOS, firmware and driver updates to PowerEdge servers on Linux and Windows. The critical one, CVE-2026-86360 (CVSS 3.1 9.6), is a path traversal that an unauthenticated remote attacker could use for filesystem access; Dell says it can be leveraged to run arbitrary code with root privileges and fully compromise the application and the underlying operating system. The same release fixes CVE-2026-86361 and CVE-2026-86362 (both 8.2, local low-privileged elevation of privilege), CVE-2026-63697 (7.6, improper certificate validation leading to remote execution by a high-privileged attacker) and CVE-2026-71168 (7.3, local path traversal leading to code execution). Dell has not flagged any of them as exploited. Reporters credited by Dell: Ori Gabriel, saltedfish, and Nir Yehoshua of Cipher Security Labs. Wire: BleepingComputer 5 Oct.
Dell — DSA-2026-324: Security update for Dell System Update (DSU) vulnerabilities (1 Oct 2026)
Nozomi Networks Labs (1 October 2026) describes Cling, a botnet it found while investigating a spike in exploitation of CVE-2021-35394, the Realtek Jungle SDK 'UDPServer' diagnostic-daemon command injection (CVSS 3.1 9.8; on the CISA KEV catalog since December 2021). The attack sends UDP datagrams starting with orf; plus shell commands that use BusyBox wget to fetch and run the bot. The analysed MIPS sample also carries exploits for CVE-2014-8361 (Realtek SDK), CVE-2023-26801 (LB-LINK), CVE-2024-3721 (TBK DVR), CVE-2025-34037 (Linksys), CVE-2016-10372 (Eir D1000), CVE-2023-41011 (FiberHome / China Mobile router) and CVE-2016-20016 (MVPower DVR). It persists by copying itself to /root/.cling and /usr/local/bin/.cling, adding entries to /etc/inittab, /etc/init.d/rcS and /etc/rc.d/rc.boot, and replacing the wget binary so it re-runs whenever wget is called. Its command channel imitates STUN, the NAT-traversal protocol used by Teams, Zoom, Webex and WebRTC: every ~5 seconds it queries 13 hard-coded public STUN servers (including a Google address), sends a non-standard registration packet with its mapped ports and infection tag, then takes commands hidden in the 12-byte STUN transaction ID. Nozomi saw commands appear to come from Google STUN infrastructure and assesses spoofed source addresses as the likely explanation. Capabilities: spreading, proxying, tunnelling and DDoS; observed attack orders targeted an internet provider, university infrastructure and gaming services. No infection count or confirmed outages published; no Australian victims reported. Wire: Cybersecurity News 5 Oct. UPDATE (FortiGuard Labs, 5 Oct 2026): Fortinet tracks the same malware as ClingSTUN, a back-connect proxy backdoor, across three phases with different download servers. It was first delivered through CVE-2022-36553 (Hytec Inter HWL-2511-SS routers), then CVE-2025-34035 (EnGenius IoT cloud service) and CVE-2024-23625 (D-Link UPnP), then CVE-2021-35394 (Realtek), CVE-2023-1389 (TP-Link Archer AX21), CVE-2024-7029 (AVTECH AVM1203), CVE-2024-10915 (D-Link) and a goform buffer overflow across several vendors; SecurityWeek counts about two dozen exploited flaws including Ivanti, Lantronix, Linear, MeiG, Sunhillo and Tenda devices. Builds exist for ARM, x86, x86-64, MIPS and PowerPC. Newer versions kill the watchdog and competing malware, hide their process details behind copied PID 1 metadata, and send STUN binding requests to 24 (later 13) public endpoints. Fortinet rates it High severity.
Nozomi Networks Labs — A STUNning disguise: Cling malware masquerades as Google (1 Oct 2026)
Fortra Product Security published a 1 October 2026 BoKS (Core Privileged Access Manager) advisory batch covering eight flaws, three Critical. CVE-2026-79901 (FI-2026-012; CVSS 3.1 9.9; AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): in deployments using BoKS keytab management, boks_keytabmd generates Active Directory service-account passwords from a predictable PRNG seeded with the current Unix timestamp — an attacker who knows the SPN and can estimate password-change time can reproduce a limited candidate set and verify offline (standard AD account can request a service ticket; admin access to BoKS/host/keytab not normally required). Fix: upgrade active BoKS Master to boks-server 9.0.0.7, restart BoKS, then rotate all affected/uncertain service-account passwords via BoKS keytab management and rebuild keytabs after max service-ticket lifetime + clock skew — installing the update alone does not secure passwords generated by an affected release. CVE-2026-12627 (FI-2026-017; CVSS 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): stack buffer overflow in boks_autoregisterd — remote attacker with network access to the autoregistration service (default port 6507) may trigger memory corruption; affected boks-server 8.1.0.0–8.1.0.23 and 9.0.0.0–9.0.0.6; fixed 8.1.0.24 / 9.0.0.7; workaround restrict/disable autoregistration until patched. CVE-2026-79898 (FI-2026-015; CVSS 9.1; AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H): authenticated command injection in crlserver via BCC / WSI REST or SOAP / cacrl — shell commands run as root on the BoKS Master; same fixed builds. Also patched: CVE-2026-79896 (High 7.5) unauth boks_portmux TLS ClientHello OOB read DoS, plus further High/Medium heap/OOB/temp-file/password issues. Fortra has not reported exploitation in the wild. Primary: Fortra FI-2026-017 / FI-2026-012 / FI-2026-015; wire: SecurityWeek 3 Oct.
ASUS product security notices (last updated 1 October 2026; amplified by CyberInsider 1 Oct and Tom's Hardware 3 Oct) address two authenticated remote flaws in consumer/prosumer router firmware reachable via the web management interface. CVE-2026-14157 (Critical, CVSS v4.0 9.4): a specially crafted VPN client configuration file uploaded through the management UI can cause arbitrary command execution on firmware series 3.0.0.6_102. Until patched, ASUS says import VPN client configs only from trusted, verifiable sources — avoid publicly shared or unknown-origin OVPN/profile files. CVE-2026-13313 (High, CVSS v4.0 8.9): authenticated attacker can bypass checks (debug code left active) to enable Telnet and run commands with elevated/root privileges; affects 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series. ASUS also recommends a strong unique admin password (≥10 chars, upper/number/symbol mix) and against running untrusted scripts/tools/commands on LAN hosts that can reach the router UI. Neither router bulletin states exploitation in the wild. Separate same-day board notice: CVE-2026-93495 (CVSS v4.0 7.0) improper BIOS init — physical crafted device → memory R/W on listed Z390/C246 boards (BIOS 2203 / 1502). Primary wire: CyberInsider 1 Oct (cites ASUS bulletins); vendor landing: ASUS Product Security Advisory; models: install latest firmware for exact SKU from ASUS Support. ASUS security-advisory HTML table was empty on fetch (likely JS) — switch primary_url when the specific bulletin permalink is listed.
CyberInsider — ASUS warns of critical router flaw via malicious VPN files (1 Oct 2026)
GitHub Security Advisory GHSA-rvm3-566m-v7fv / CVE-2026-103922 (published 1 October 2026; GitHub CNA CVSS 3.1 9.3 Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N): Capacitor Android/iOS WebView navigation guard validated host and scheme but not path. A victim who opens an untrusted link inside an affected app can navigate a frame to /_capacitor_http_interceptor_; the native HTTP proxy fetches attacker-chosen remote content and returns it as a document at the application origin, giving same-origin access to localStorage, cookies, and registered Capacitor plugin APIs (device data, tokens, files — plugin-dependent). Disabling CapacitorHttp does not mitigate on vulnerable builds because the proxy path was still served. Affected: >=6.0.0 <6.2.2, >=7.0.0 <7.6.9, >=8.0.0 <8.3.5, >=8.3.5 <8.4.3, >=8.5.0 <8.5.1. Fixed in 6.2.2, 7.6.9, 8.3.5, 8.4.3, 8.5.1 — rebuild and redistribute mobile apps. Wire: Cyber Security News 2 Oct. Primary: Ionic/GitHub GHSA-rvm3-566m-v7fv.
Red Hat CVE-2026-96659 (published 1 October 2026; Red Hat CVSS 3.1 9.1 Important; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L): authorization weakness (CWE-267) in Foreman template-preview endpoints used by Red Hat Satellite. An authenticated low-privileged user with only the Viewer role can submit crafted requests and retrieve sensitive host attributes that should be admin-only — including host root passwords. If template Safemode protections are disabled or circumvented, Red Hat warns the same flaw class can escalate to arbitrary command execution as the Foreman service account. Affects Satellite/Foreman deployments that expose the vulnerable preview path; companion Critical safemode-bypass CVE-2026-96658 (desk foreman-safemode-96658-20261001) shipped in the same 1 Oct RHSA train. Fixed via RHSA-2026:74503 / 74504 / 74505 / 74506 (Satellite 6.16–6.19 trains per Red Hat CVE page). Wire amplify: Cyber Security News 2 Oct. Primary: Red Hat CVE-2026-96659.
Red Hat — CVE-2026-96659 (Satellite/Foreman template preview authz; 1 Oct 2026)
SEC Consult Vulnerability Lab blog (1 October 2026; researcher Timo Longin) details two From-header smuggling flaws in Apple iCloud’s outbound SMTP processing that let an authenticated free iCloud account send mail appearing to come from arbitrary @icloud.com addresses (examples include high-value identities such as tim.cook@icloud.com or no-reply@icloud.com) while receiving systems still recorded SPF, DKIM, and DMARC pass. Root cause: inconsistent parsing between iCloud’s outbound validators and later cleanup/relay stages (carriage-return / line-break tricks in the From: header; SMTP dot-stuffing / “dot-peeling” discrepancies). SPF passed because Apple’s legitimate infrastructure sent the message; DKIM passed because iCloud signed after the affected stage; DMARC passed on icloud.com alignment. Carriage-return issue first reported to Apple 21 May 2024; Apple adjusted handling; researchers found a second bypass; final fixes confirmed December 2025; public write-up 1 Oct 2026. Apple Security Bounty awarded US$15,000. No CVE id assigned in the SEC Consult blog. Wires: Cyber Security News / SecurityWeek “In Other News” 2 Oct. Primary: SEC Consult blog.
SEC Consult — From: anyone@icloud.com — Spoofing Arbitrary Apple iCloud Identities (1 Oct 2026)
Broadcom Symantec Threat Intelligence (1 October 2026) reports the China-nexus operator behind Warlock ransomware — tracked by Symantec as Longlegs (aka Storm-2603; linked to CL-CRI-1040 / CamoFei / ChamelGang) — continues exploiting Microsoft SharePoint flaws against critical infrastructure, government and education. Past two months: at least four victim organisations in Portuguese- and Spanish-speaking countries spanning Europe, Africa and Latin America, including a water utility, a telecommunications provider, a regional government body and a university. One intrusion disabled security software on ≥40 systems then ran Warlock on ≥33. Typical chain after SharePoint access: webshell, ASP.NET machine-key theft, forced-signed RCE payload; DLL sideloading / LOTL; abuse of legitimate file-sharing hosts and a vulnerable driver to blunt EDR. Warlock rose on the 2025 ToolShell SharePoint exploit chain; Symantec says those flaws likely remain in the group's arsenal, alongside newer SharePoint flaws that CISA warned about in an advisory published in July 2026. No Australian victim named in this report. Primary: Symantec/security.com. Correction (27 Oct 2026): removed a list of six 2026 SharePoint CVE numbers credited to Symantec; Symantec's post refers only to newer SharePoint flaws covered by a July 2026 CISA advisory and does not list them. (source: Symantec, security.com) Correction (27 Oct 2026): removed the SecurityWeek link and credit; the card rests on Symantec's report. (source: Symantec, security.com)
Symantec / security.com — Warlock ransomware attackers hit water and telecom operators (1 Oct 2026)
Dell Security Advisory DSA-2026-448 (article 000515771; initial release 1 October 2026) patches multiple critical flaws in Dell Container Storage Modules (CSM), which connect Dell PowerStore/PowerScale/PowerFlex/PowerMax/Unity XT arrays to Kubernetes via CSI. Headline proprietary issues in CSM Authorization 2.4.0: CVE-2026-63688 (CVSS 3.1 10.0; AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) missing authentication on the csm-authorization-storage gRPC server lets an unauthenticated remote attacker obtain storage-backend administrator credentials for all registered arrays and fully bypass the CSM authorization model; CVE-2026-63692 (CVSS 10.0, same vector) missing authentication on the authorization proxy/tenant service enables unauthenticated elevation to administrative control across tenants. Same advisory also covers CVE-2026-67269 (CVSS 9.9) CSM Operator 1.12.0 privilege escalation to root on cluster nodes; CVE-2026-54472 (9.8) hard-coded credentials enabling forged admin tokens; CVE-2026-61421 (9.8) archived karavi-authorization JWT demo secret ("supersecret"); CVE-2026-67273 (9.6) template-engine issue granting cluster-wide Secrets read / RBAC tamper; plus additional High/Medium issues. Affected: CSM versions prior to 1.17.0. Remediated: CSM 1.18.0 or later. No workarounds. Dell has not reported active exploitation of these CSM flaws. Primary: Dell DSA-2026-448; wire: BleepingComputer 2 Oct.
Red Hat CNA CVE-2026-96658 (published 1 October 2026; CVSS 3.1 9.9 Critical AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): authenticated low-privilege attacker can achieve remote code execution by bypassing the Foreman templating safemode sandbox — improper handling of delegated methods lets an attacker append unauthorised functions to the allowed execution list and run arbitrary commands on the hosting server. Red Hat Product Security rates Critical because a user with minimal read/view permissions can RCE the underlying Satellite host where Foreman relies on the sandbox to render templates. Fixed packages shipped 1 Oct via RHSA-2026:74506 (Satellite 6.16 el8/el9 rubygem-safemode 0:1.5.0-2), RHSA-2026:74504 (Satellite 6.18 el9 rubygem-safemode), and RHSA-2026:74503 (Satellite Utils 6.19 el9 foreman 0:3.18.0.14-1). Bugzilla 2534185. Primary: Red Hat CVE + RHSAs; Tenable/NVD amplify.
Red Hat — CVE-2026-96658 Foreman safemode bypass RCE (1 Oct 2026)
Wind River CNA CVE-2026-104018 (published 1 October 2026; CVSS 3.1 8.8 High AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): improper privilege management (CWE-269) in the VxWorks 7 command shell when per-user command privileges are enforced. Under certain shell operations a command may run without the usual privilege check, so an authenticated low-privilege user can execute unauthorised commands — confidentiality/integrity/availability impact on the device. Affects all VxWorks 7 versions prior to 26.09; fixed in 26.09 (per Wind River CVE text). CISA SSVC on NVD: exploitation none / not automatable at publication. Primary: Wind River CVE page; NVD/Rapid7 amplify patch floor.
Wind River Support — CVE-2026-104018 VxWorks 7 privilege management
