Comparing 5 October 2026 with the previous day 28 September 2026.
The out-of-band update fixes an authorization weakness that allows an already authenticated attacker to access other users' mailboxes and thereby escalate privileges; there is no evidence of active exploitation so far.
The report shows that automated agents use compromised service principals for Azure resource destruction and credential collection , an attack path beyond classic endpoint ransomware.
The report summarizes multiple Linux kernel vulnerabilities without naming specific CVEs; details of the underlying CVEs are required to assess exploitability.
The update suggests that previous patches were incomplete or new vulnerabilities were discovered.
The BSI report updates a warning about a DoS vulnerability in GNU libc without providing new CVE or exploit details.
Kothamine Agent is a new RAT that abuses Tailscale's tailcat for encrypted C2 communication, thereby evading conventional network detection.
The report describes general vulnerabilities in Microsoft Edge without specific CVE or exploit details, making prioritization difficult.
Exploitation requires multiple open Edge instances, visiting an attacker-controlled website, and clicking a pop-up; there is no CVE.
No changes in this category.
No changes in this category.
CISA confirms actively exploited attacks against a high-risk SharePoint flaw; this goes beyond a mere patch recommendation and demonstrates an ongoing, real threat to exposed SharePoint instances.
The report shows that compromised service principals in Entra ID are no longer used merely for data theft but deliberately for destructive deletion operations in Azure , a TTP shift that goes beyond standard patch information.
The report describes an active, agent-driven ransomware campaign against Azure tenants with credential theft and resource destruction , i.e., new TTPs rather than a patch vulnerability.
An AI-driven attacker was able to take over an Azure tenant using compromised credentials and destructively delete data , a reminder of the risk of credential leaks in cloud environments.
The advisory remains generic at kernel level and provides neither CVE IDs nor affected subsystems, so targeted prioritisation is not possible.