|
|
Your daily, AI-assisted cybersecurity intelligence brief.
|
|
|
|
Today's report
|
|
Source: Security Rabbits
|
The Rabbit's Foot (TLDR)
|
|
PHP Emergency Patches for Two Critical RCE Flaws (CVSS 9.2)
PHP is releasing out-of-cycle security updates for two critical vulnerabilities rated 9.2, with details reportedly leaked ahead of disclosure. Administrators should prepare to apply emergency patches immediately upon release.
|
|
|
Oracle E-Business Suite and WebLogic Critical Vulnerabilities
Oracle E-Business Suite Workflow has an unauthenticated remote takeover flaw (CVSS 10.0), and WebLogic Server has a CVSS 9.8 flaw frequently targeted for mass exploitation. Apply Oracle's October Critical Patch Update without delay.
|
|
|
Apache Tomcat Authentication Bypass and HTTP/2 Request Mix-Up
A missing authentication step in Tomcat's JNDI realm allows attackers to authenticate without the correct password, and HTTP/2 async processing can leak data across sessions. Upgrade to 11.0.27, 10.1.61, or 9.0.123 immediately.
|
|
|
Plex Media Server Multiple Chainable Vulnerabilities
Plex Media Server has SSRF, URI scheme neutralization, and arbitrary file write flaws that can be chained together. Apply vendor mitigations per CISA BOD 26-04 guidance and evaluate internet exposure.
|
|
|
FortiSIEM Critical Flaw Has Public Exploit PoC
A proof-of-concept exploit is available for a critical FortiSIEM vulnerability (CVE-2026-106173) enabling unauthenticated remote code execution. Patch immediately and monitor for exploitation attempts.
|
|
| Source: CVE Trend
|
|
Trending vulnerability
|
|
|
I can't determine the impacted software name because the text you provided doesn't contain a CVE description—it only includes the trending header and hype score. Please provide the actual CVE description or CVE ID.
|
Published:
Updated:
|
Currently trending CVE - Hype Score: 65
|
|
| Source: CISA
|
|
CISA exploits
|
|
|
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-10-20)
|
|
|
|
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-10-20)
|
|
|
|
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-10-20)
|
|
|
|
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-10-20)
|
|
|
|
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-10-20)
|
|
|
|
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-10-20)
|
|
| Source: NIST
|
|
NIST CVE
|
|
|
A missing authentication step in Tomcat's JNDI realm with non-GSSAPI SASL mechanisms lets attackers authenticate without the correct password. Upgrade to 11.0.27, 10.1.61, or 9.0.123 immediately, as Tomcat is ubiquitous in enterprise Java deployments.
|
|
|
|
Incorrect object recycling in HTTP/2 async servlet processing can mix up requests and responses between users, potentially leaking data across sessions. Patch to 11.0.27, 10.1.61, or 9.0.123.
|
|
|
|
Unauthenticated remote attackers can achieve full takeover of the Workflow Notification Mailer (CVSS 10.0) via HTTP. Apply Oracle's October Critical Patch Update without delay.
|
|
|
|
Unauthenticated network attackers can fully compromise the Oracle Application Object Library core (CVSS 9.8). Prioritize patching E-Business Suite 12.2.3-12.2.15.
|
|
|
|
Unauthenticated attackers can take over WebLogic Server via T3/IIOP (CVSS 9.8); WebLogic is a frequent target for mass exploitation. Apply the latest Oracle CPU urgently.
|
|
|
|
Any member of an operator-configured WhatsApp group can control other agent sessions and execute arbitrary commands on the host. Upgrade to version 0.7.2 immediately.
|
|
|
|
The unauthenticated POST /tools/call endpoint exposes the always-registered shell tool, allowing remote OS command execution as root in the shipped Docker image. Restrict network access and patch or remove the endpoint.
|
|
|
|
|
News
|
|
|
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit [...] (BleepingComputer)
|
|
| Source: Ransomware.live
|
|
Ransomware attacks
|
|
|
P...S...R... \\ P... H... \\ M... M...
|
|
|
|
Brüninghoff Group \\ BW Office World
|
|
|
|
51Ridge (Newark NJ hosting/IT) \\ Company #95 \\ Company #96 \\ Company #97 \\ Company #98
|
|
|
|
The Excalibur Group \\ Beach Eye Medical Group \\ Asensus Surgical
|
|
|
|
COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA \\ City of Mt. Angel, Oregon \\ City Hall - Everett, MA \\ Chicago Vein Institute \\ Pearland Pediatrics \\ Research Foundation of The City University of New York
|
|
|
|
