Live feed
MyCyber News
Your daily cybersecurity news feed in one view.Curated, concise, and connected.
Your daily cybersecurity news feed in one view.Curated, concise, and connected.
Last feed pull: Oct 20, 2026, 12:06 AM (UTC+3)
Latest stories
Sector: Law Firm
ERP software and hosting company • USA • Internal network configurations and security credentials of an ERP hosting company; Administrator and remote access credentials; Network topology of corporate and hosted client environments • [NOT PAID — EXPOSED]
NameCompany: Seminole Schools • Domain: internal.seminole.org • Country: Seminole,Florida,US • Website: sps.k12.ok.us • Revenue: $15.5 Million • Industry: Education General, Education • Employees: 50-100 • Properties: 39.6 GB (54,468 Files, 5,495 Folders)
Serial Number: AV26-1063 Date: October 19, 2026 As of October 15, 2026, Siemens is affected by a vulnerability in the following product: • Siemens Software Center • Prior to V4.0.9.8 Siemens has reported that CVE-2026-110936 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. • SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center • Active Exploitation of CVE-2026-110936 in Siemens Software Center • Siemens Product CERT Siemens security advisory (AV26-1063) - Canadian Centre for Cyber Security
Serial Number: AV26-1062 Date: October 19, 2026 As of October 19, 2026, Eptura is affected by a vulnerability in the following product: • Archibus • Prior to 2025.02 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. • Eptura Archibus • Archived Archibus Release Notes Eptura security advisory (AV26-1062) - Canadian Centre for Cyber Security
Serial Number: AV26-1061 Date: October 19, 2026 As of October 19, 2026, Red Hat is affected by vulnerabilities in the following products: • Fast Datapath for RHEL 10/8/9 • All versions • ManageIQ • All versions • Migration Toolkit for Applications 8 • All versions • Migration Toolkit for Virtualization • All versions • OpenShift Service Mesh 3 • All versions • Red Hat Advanced Cluster Management for Kubernetes 2 • All versions • Red Hat Ansible Automation Platform 2 • All versions • Red Hat Ansible Automation Platform Ansible Core 2 • All versions • Red Hat Certification Program for Red Hat Enterprise Linux 9 • All versions • Red Hat CloudForms • All versions • Red Hat Discovery 2 • All versions • Red Hat Enterprise Linux 6/7/8/9/10 • All versions • Red Hat Hardened Images • All versions • Red Hat OpenShift Container Platform 4 • All versions • Red Hat OpenStack Platform 13
TeamUpdraft has disclosed unauthorized access to its teamupdraft. com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using valid UpdraftCentral connection keys to send remote commands to connected WordPress sites. Those commands were used to upload, activate, and delete malicious plugins. Because the requests were properly signed with trusted keys, an UpdraftPlus installation that contained the earlier CVE-2026-10795 security fix could still accept them as legitimate UpdraftCentral instructions. This does not mean that every website running UpdraftPlus was exposed.
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.
CVE ID : CVE-2026-112254 Published : Oct. 19, 2026, 7:30 p. m. • 25 minutes ago Description : A vulnerability was found in agit8or1 clientst0r up to 3. 17. 586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer. py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3. 17. 587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVE ID : CVE-2026-112260 Published : Oct. 19, 2026, 7:24 p. m. • 31 minutes ago Description : A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service. Severity: 7.1 • HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
special-effects fog fluid manufacturer and distributor (order management and shipping operations) • Tennessee, USA • The complete shipping and order management database of a specialty fluid manufacturer, including full nightly backup copies from January 2026 to present; Employee account directory for the company domain; Shipping software and remote access configuration for their warehouse servers • [NOT PAID — EXPOSED]
Your XP is now visible in CTF events Hack The Box
CVE ID : CVE-2026-112252 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3. 5. Affected is the function xp_cmdshell of the file /ws. asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.5 • HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-112259 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application. Severity: 5.5 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-112251 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : A vulnerability was detected in antoinersx clawhost up to 0. 0. 45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy. ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 5.0 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-112249 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : A vulnerability was detected in grandnode grandnode2 up to 2. 3. 0. Affected is the function Html. Raw of the file src/Web/Grand. Web/Views/Product/Product. Layout. Simple. cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2. 4. 0-beta and 2. 4. 0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure. Severity: 4.8 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-110687 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 43 before 4. 80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes. Severity: 0.0 • NA
CVE ID : CVE-2026-110688 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 51 before 4. 80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time. Severity: 0.0 • NA
CVE ID : CVE-2026-110686 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process. Severity: 0.0 • NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-110685 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory. Severity: 0.0 • NA
CVE ID : CVE-2026-110680 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 20 before 4. 80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared. This corrupts stack or heap memory and can crash the process. Severity: 0.0 • NA
CVE ID : CVE-2026-110681 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there. A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process. Severity: 0.0 • NA
CVE ID : CVE-2026-110678 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size. Severity: 0.0 • NA
CVE ID : CVE-2026-110675 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 33 before 4. 80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error. Severity: 0.0 • NA
CVE ID : CVE-2026-110677 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 28 before 4. 80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory. Severity: 0.0 • NA
CVE ID : CVE-2026-110682 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 42 before 4. 80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads. A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry. Severity: 0.0 • NA
CVE ID : CVE-2026-110676 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU. Severity: 0.0 • NA
CVE ID : CVE-2026-110674 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 4. 33 before 4. 80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4. 41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number. Severity: 0.0
CVE ID : CVE-2026-110684 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions from 3. 0202 before 4. 80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4. 20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4. 10 it also never frees its copy of the string. Repeatedly encoding data that contains such values grows process memory without bound. Severity: 0.0 • NA
CVE ID : CVE-2026-110672 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4. 09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory. Severity: 0.0 • NA
CVE ID : CVE-2026-110673 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth. Severity: 0.0 • NA
CVE ID : CVE-2026-109437 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Cognition before 0. 13. 0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process. Severity: 9.8 • CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-109434 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : Fenrir Sleipnir Browser for Android before 3. 9. 0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages. Severity: 5.1 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-60482 Published : Oct. 19, 2026, 7:17 p. m. • 38 minutes ago Description : A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors. c) of GPAC Project/MP4Box 2. 5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. Severity: 0.0 • NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-112782 Published : Oct. 19, 2026, 7:10 p. m. • 44 minutes ago Description : Grav 1. 7. 53 before 1. 7. 53. 5 and 2. 0. 0-rc. 8 before 2. 2. 2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system. images. max_pixels limit when system. images. url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down. Severity: 7.5 • HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Reducing Reward Hacking by Localizing Bad Behavior Instead of Penalizing It Anthropic Alignment Science blog
A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.
Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026. The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal’s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating. The most important detail is that Drupal core alone does not provide a direct path to exploit the flaw. However, the security team confirmed that several serious attack paths exist when contributed modules are present. These are additional modules used to extend a website’s features beyond its core functions.
Apple's fall hardware blitz continues with MacBook and iPad reveals on October 28.