Comparing 1 October 2026 with the previous day 24 September 2026.
CVE-2023-42793 is actively exploited by APT29 for supply-chain attacks, underlining its strategic relevance for Swiss industrial companies with software suppliers.
The vulnerability is a local privilege escalation in the DirectX graphics kernel and is therefore primarily relevant as a building block in attack chains after an attacker has already gained a foothold.
The analysis reveals two previously undocumented DPRK implants and an attack path abusing the HAProxy filter API, underscoring North Korean groups' continued willingness to target industry-adjacent supply chains.
The flaw is a ZDI-coordinated disclosure rated CVSS 7.8 for which neither exploit code nor in-the-wild exploitation is documented so far, with the fix arriving through Adobe's regular security bulletin.
Beyond the pure patch information, the report provides no indication of active exploitation or technical details.
Beyond the pure patch information, the report shows that in addition to remote code execution, bypassing session access restrictions is also possible, which expands the attack surface beyond classic RCE.
The zero-day nature suggests exploitation occurred prior to the patch release.
Device code phishing abuses Microsoft Entra ID's legitimate device code flow to bypass MFA, with the victim authorizing the attacker's sign-in on a genuine Microsoft page.
The report summarizes several unspecified vulnerabilities in Microsoft Edge and serves as a general patch reminder without providing specific CVEs or exploitation details.
No changes in this category.
This is not a patch issue but an active campaign: attackers use phone calls and unmanaged BYOD devices to gain initial access, leverage the Microsoft Graph API to pick targets, and hand the resulting access to extortion groups such as ShinyHunters.
A non-read-only PRTG user can read the stored Windows/domain password in plaintext from the sensor error output without requiring code execution or memory corruption.
Attacks can be detected more reliably via Storm-2570's recurring tool and behaviour chain than via the specific ransomware payload that is used.
The new ShieldCrash exploit bypasses the already released patch for the Windows Defender ShieldBreak vulnerability (CVE-2026-69414), meaning public exploit code now exists that undermines the previous mitigation.
The real risk is not the XSS itself but the fact that the PRTG session cookie lacks the HttpOnly flag, allowing it to be read and exfiltrated via JavaScript , an indication of broader hardening gaps in the web interface.
The report bundles multiple vulnerabilities in PRTG that together enable XSS, bypass of security measures, and information leaks; exact versions and severity levels are missing.
The report describes a kernel vulnerability in the BPF interpreter that can lead to a page fault and kernel oops when using BPF_ADDR_PERCPU.
Exploitation requires user interaction, making these vulnerabilities particularly interesting for targeted phishing attacks on creative workstations.
The vulnerability lies in XZ decompression and can therefore be triggered via crafted archives from arbitrary sources (email, downloads, removable media), expanding the attack surface beyond mere file extraction.