JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited
October 15, 2026
JPCERT/CC warns attackers are exploiting CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that grants root or SYSTEM
News
JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited
JPCERT/CC warns attackers are exploiting CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that grants root or SYSTEM privileges.
Ahsay Issues New AhsayCBS Hotfixes After Earlier Patches Failed
Ahsay released new AhsayCBS hotfixes after its August patches did not fully close CVE-2026-105133 and CVE-2026-105134, and CISA added both flaws to KEV.
Hirudo Android Trojan Replaces Banking Apps With Patched Copies
ThreatFabric details Hirudo, an Android banking trojan that uninstalls real banking apps and installs modified copies that disable their own security checks.
ICO Reprimands Met Police Over Unvetted Use of Auror Platform
The UK ICO reprimanded the Metropolitan Police and issued an enforcement notice after officers used the Auror retail crime platform without data checks.
Juniper, Dell, NLnet Labs and SonicWall Patch Critical Flaws
Juniper, Dell, NLnet Labs and SonicWall released fixes for critical Junos OS, Wyse Management Suite, NSD and NSM On-Prem flaws; no exploitation is reported.
curl 8.23.0 Fixes High-Severity HTTP/2 Flaw CVE-2026-92392
curl 8.23.0 fixes CVE-2026-92392, a High-severity HTTP/2 upload use-after-free that a researcher turned into code execution, plus 23 Low-severity CVEs.
F5 Patches Three NGINX Memory-Corruption Flaws Enabling RCE
F5 patched three NGINX memory-corruption flaws, CVE-2026-97205, CVE-2026-93479 and CVE-2026-15176, rated CVSS 8.1 that could allow remote code execution.
Check Point Finds Two Critical LiteLLM Flaws Enabling Key Theft
Check Point Research disclosed CVE-2026-35029 and CVE-2026-59823 in LiteLLM, flaws enabling admin takeover and theft of OpenAI, Anthropic and Google API keys.
Brooklyn DA and FBI Seize 241 Domains in Crypto Scam Takedown
Brooklyn District Attorney Eric Gonzalez and the FBI seized 241 domains and 112 servers behind a crypto investment scam aimed at Russian-speaking victims.
Unsecured Database Holds 13.7M Breach Records Tied to Vibetech
Researcher Jeremiah Fowler found an unsecured database of 13.7 million records tied to AT&T, Amazon, Walmart and PayPal, linked to India-based Vibetech.
Ahsay Issues New AhsayCBS Hotfixes After Earlier Patches Failed
October 15, 2026
Ahsay released new AhsayCBS hotfixes after its August patches did not fully close CVE-2026-105133 and CVE-2026-105134, and CISA added both
Hirudo Android Trojan Replaces Banking Apps With Patched Copies
October 15, 2026
ThreatFabric details Hirudo, an Android banking trojan that uninstalls real banking apps and installs modified copies that disable their own
ICO Reprimands Met Police Over Unvetted Use of Auror Platform
October 15, 2026
The UK ICO reprimanded the Metropolitan Police and issued an enforcement notice after officers used the Auror retail crime platform
Juniper, Dell, NLnet Labs and SonicWall Patch Critical Flaws
October 15, 2026
Juniper, Dell, NLnet Labs and SonicWall released fixes for critical Junos OS, Wyse Management Suite, NSD and NSM On-Prem flaws;
curl 8.23.0 Fixes High-Severity HTTP/2 Flaw CVE-2026-92392
October 15, 2026
curl 8.23.0 fixes CVE-2026-92392, a High-severity HTTP/2 upload use-after-free that a researcher turned into code execution, plus 23 Low-severity CVEs.
F5 Patches Three NGINX Memory-Corruption Flaws Enabling RCE
October 15, 2026
F5 patched three NGINX memory-corruption flaws, CVE-2026-97205, CVE-2026-93479 and CVE-2026-15176, rated CVSS 8.1 that could allow remote code execution.
Check Point Finds Two Critical LiteLLM Flaws Enabling Key Theft
October 15, 2026
Check Point Research disclosed CVE-2026-35029 and CVE-2026-59823 in LiteLLM, flaws enabling admin takeover and theft of OpenAI, Anthropic and Google
Brooklyn DA and FBI Seize 241 Domains in Crypto Scam Takedown
October 15, 2026
Brooklyn District Attorney Eric Gonzalez and the FBI seized 241 domains and 112 servers behind a crypto investment scam aimed
Unsecured Database Holds 13.7M Breach Records Tied to Vibetech
October 15, 2026
Researcher Jeremiah Fowler found an unsecured database of 13.7 million records tied to AT&T, Amazon, Walmart and PayPal, linked to
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.