Comparing 7 October 2026 with the previous day 30 September 2026.
The shift to compromised legitimate websites as phishing infrastructure and to password-protected container attachments (ZIP/RAR/VHDX) combined with the new RedFlick delivery technique significantly undermines signature- and URL-based detection.
A previously unknown China-based malware framework grants long-term, stealthy access to compromised networks , a sign of espionage rather than extortion.
The US has issued a bounty for an alleged Chinese Hafnium hacker, underscoring the ongoing threat from state-directed Chinese cyber operations.
A public working exploit shows that CVE-2026-66804 is only an incomplete fix of the 'Dark Elevator' COM registration bug (CVE-2026-50343), so dangling CLSID entries under HKEY_CLASSES_ROOT must be re-verified for completeness.
US authorities confirm an ongoing, global campaign to harvest Fortinet credentials and explicitly warn operators of two product types , this goes beyond a pure patch notice, since no CVE is the underlying vector.
The report describes an injection vulnerability in OpenSSH via special characters in the username, with no evidence of active exploitation.
Beyond the pure patch information, the report describes that a Backup Viewer account can be abused to execute code with SYSTEM privileges on the backup server, without evidence of active exploitation.
The campaign exploits reused or leaked credentials and legacy SHA-256 password storage on FortiGate devices, meaning even patched systems remain compromiseable through weak or reused credentials.
The FBI confirms that FortiBleed is not a closed patching case but an ongoing campaign in which attackers harvest credentials from exposed FortiGate VPNs and lock out legitimate administrators.
The report shows that ransomware groups increasingly abuse Active Directory Group Policy for enterprise-wide payload distribution, bypassing conventional endpoint protections.
Beyond the plain patch information, the alert shows that exploitation requires an active action by a portal user opening a crafted link, so the attack vector lies in the browser context of the Enterprise Manager web interface rather than in the backup data path itself.
An attacker holding only the low-privileged Backup Viewer role can modify the Enterprise Manager master key and stored antivirus update credentials, thereby compromising the trust basis of the entire backup and recovery chain.
The flaw breaks Veeam Cloud Connect's tenant boundary: an authenticated tenant can reach arbitrary files on the service provider host, undermining the trust architecture between customer and service provider.
The advisory lacks CVE IDs and technical details, so prioritization is only possible via the general OpenSSH patch status.
The BSI report contains no CVE IDs, which makes targeted prioritization and patch mapping for affected Linux systems difficult.
The report updates an existing warning but provides no details on affected versions or exploitation.
The report bundles multiple OpenSSH vulnerabilities that allow denial of service, information disclosure, file manipulation, and bypassing of security measures.
No changes in this category.
No changes in this category.
The September Patch Tuesday contains an already actively exploited Windows ALPC EoP flaw and, with 999 CVEs, exceeds all previous Microsoft Patch Tuesdays.
The report documents a new, previously undisclosed installation and execution technique (RedFlick) used by a Russian state actor, which complicates detection and defense against this campaign.
The report shows that Star Blizzard is scaling its phishing infrastructure with a new RedFlick infection chain and, after hijacking email accounts, now drops a dedicated backdoor (CosmicPulse) , moving beyond pure credential phishing toward persistent compromise of cloud identities.
An unauthenticated attacker can trigger a memory fault in kernel context via a crafted HTTP/1.x request over TLS, potentially leading to code execution with kernel privileges.
The September patch cycle covers 972 CVEs, including two already exploited zero-days and 113 critical vulnerabilities, which drives prioritization of Windows and Office patches.
The report contains no indication of active exploitation or KEV listing; exploitation requires user interaction.
The ZDI advisory describes a use-after-free in Acrobat Reader DC's Annots Report parsing (CVSS 7.8) that is client-side only and requires opening a crafted PDF; no active exploitation is documented.
ZDI-26-667 describes a use-after-free vulnerability in Adobe Acrobat Reader DC rated CVSS 7.8, but contains no indication of active exploitation.
ZDI publishes a use-after-free flaw in Acrobat Reader DC's annotation handling (CVSS 7.8) with no patch reference or evidence of active exploitation provided in the advisory.
The vulnerability requires user interaction via a crafted DCM file or web page, making it suitable for targeted phishing or spear-phishing attacks against design and engineering workstations.
This is a pure vulnerability disclosure with no indication of active exploitation; its added value lies in the file-based attack vector rather than a network perimeter exposure.
The vulnerability is an integer overflow in DCM JPEG image parsing that can be exploited by opening images from untrusted sources.
ZDI documents a type-confusion flaw in Adobe Acrobat Reader DC that leads to code execution with user interaction; active exploitation is not documented.
The ZDI advisory describes a CVSS 7.8 vulnerability that requires user interaction and mentions neither a public exploit nor active exploitation in the wild.
No evidence of active exploitation; the vulnerability has a low CVSS score and requires user interaction.
The attack abuses Entra ID's legitimate device code authentication flow, so no password and no MFA prompt need to be compromised , restricting that flow is the central countermeasure.
The report shows that device code phishing operates as a scalable phishing-as-a-service capability against Microsoft 365, and the takedown of individual domains is only a snapshot in an ongoing arms race.
ZDI published the vulnerability without a CVE ID, complicating tracking in patch management.
The campaign uses Teams chats and calls as a trusted communication channel to impersonate helpdesk staff, thereby bypassing email phishing filters and conventional awareness measures.
AI-powered phishing services such as Eviltokens can harvest Microsoft 365 session tokens at scale and thereby bypass MFA without stealing passwords.
Beyond pure patch information, the report shows that CVE-2026-68820 is already actively exploited and allows local attackers to gain SYSTEM privileges, while macOS and several incidents outside the industry are also affected.
The ZDI advisory describes an unauthenticated information disclosure in Microsoft Entra ID's OAuth Device Code Grant, rated CVSS 5.8 and without an assigned CVE.
The vulnerability requires valid administrator credentials, which limits the exploitation risk to compromised or malicious admin accounts.
The updated BSI advisory provides neither CVE IDs nor attack vectors or exploitation status, so individual kernel vulnerabilities cannot be prioritised.
BSI updates its warning about multiple vulnerabilities in Chrome and Edge without providing specific CVE details or exploit status.
The BSI report on multiple TeamViewer vulnerabilities does not contain CVE IDs or information on active exploitation, making prioritization difficult.
The BSI advisory bundles multiple vulnerabilities in Ubiquiti UnifiOS that together allow code execution, privilege escalation, and security bypass.
The report provides neither CVE nor CVSS nor exploitation status, so it offers no prioritization beyond a general kernel warning.
The BSI report describes multiple Edge vulnerabilities without CVE IDs; relevant is user interaction (website or Office file) as the exploitation vector.