Comparing 9 October 2026 with the previous day 8 October 2026.
The report links the addition of five vulnerabilities to the CISA KEV catalog with active exploitation by the China-linked APT Flax Typhoon, indicating a state-sponsored attack campaign.
The report shows that Chinese state-sponsored APTs use purpose-built scanning and exploitation tools (MicroScan, FishHub) to target Western critical infrastructure, and that US authorities are now actively disrupting them , a sign of escalating state-level cyber operations.
The flaw resides in digital signature (DigSig) handling and requires only that a crafted file or web page be opened , behaviour that is hard to avoid in everyday PDF use.
The flaw requires user interaction (opening a crafted file or web page) and fits the recurring pattern of Acrobat RCE issues, with no active exploitation reported.
The report provides technical details on a new use-after-free vulnerability in Adobe Acrobat Reader DC; no public exploit is known.
ZDI reports an unpatched use-after-free flaw in Acrobat Reader DC's Annots report handling that can be triggered simply by opening a crafted PDF.
Exploitation merely requires opening a crafted PDF file or visiting a malicious web page, allowing code execution with the privileges of the logged-on user.
The flaw requires user interaction, so email attachments and web links remain the most likely attack vector for PDF-based attacks.
The vulnerability requires user interaction, meaning it can be exploited via crafted PDFs or web pages in the normal document workflow, making it a classic entry point for attacks on office workstations.
Exploitation strictly requires user interaction (opening a crafted document or visiting a malicious page); the advisory contains no indication of active exploitation in the wild.
This is a plain ZDI advisory with no indication of active exploitation; the attack requires a user to open a crafted DCM file.
A vulnerability in Adobe Photoshop disclosed so far only by ZDI allows code execution via crafted image files, with no indication yet of active exploitation or KEV listing.
Exploitation requires active user interaction (opening a crafted file or visiting a manipulated page), which raises the risk in creative workflows primarily via email attachments and downloads.
Exploitation requires user interaction (visiting a crafted page or opening a malicious file), making email attachments and web downloads the realistic attack vectors.
The vulnerability is a type confusion in the Dialog object of Adobe Acrobat Reader DC that enables remote code execution with user interaction; a CVSS of 7.8 indicates its high severity.
This is pure patch information with no indication of active exploitation, KEV listing, or published exploit code.
The ZDI advisory describes a use-after-free flaw in Acrobat Reader DC's annotation handling that is only triggerable through user interaction and rated low at CVSS 3.3.
The vulnerability is rated low with CVSS 3.3 and requires user interaction; no active exploitation is documented.
Beyond the plain patch information, the report only adds the assessment that the code-smuggling flaw sits just below the highest severity level, making it urgent but not classified as critical.
Since it is a zero-day, the vulnerability was already actively exploited before the patch was released, underscoring the urgency of the update.
The BSI advisory does not contain CVE IDs, CVSS scores, or exploitation details, so prioritization can only be based on vendor information.
The report does not provide CVE IDs or technical details, but merely points to multiple vulnerabilities in Microsoft Edge.
The vulnerability allows an unprivileged local user in a private network namespace to trigger a kernel panic, which can impact the availability of Linux systems.
The BSI WID reports multiple Linux kernel vulnerabilities without CVE IDs or details, making prioritization difficult.
The report updates a DoS vulnerability in GNU libc that can be exploited from adjacent networks; further CVE or patch details are missing.
No changes in this category.
No changes in this category.
Microsoft confirms exploitation of a Windows ALPC vulnerability as a zero-day in the wild, while the rest of Patch Tuesday comprises a record 999 CVEs.
The joint advisory provides an official international attribution of state-directed Chinese cyber activity and frames it as a long-term, cross-sector espionage campaign , relevant for strategic risk assessment, with no concrete patch reference.
The report shows Russian-aligned APT groups are continuously evolving malware against Ukrainian manufacturing, energy, and transport companies, signaling a persistent threat to Europe's industrial base.
The report shows that Chinese inverters in German solar systems pose a strategic risk to power grid security that goes beyond classic IT vulnerabilities.
The FBI seizure of Flax Typhoon domains shows that Chinese APTs constantly rebuild their infrastructure for attacks on critical infrastructure, which is also a strategic risk for European industrial partners.
The analysis shows that edge vulnerabilities are exploited by both state-sponsored and criminal actors, and high-priority CVEs remain unpatched even longer (median 146 days).
ZDI reports a vulnerability in Windows that can disclose NTLM responses through localized filenames, but only with user interaction and a low CVSS.
The campaign remains active and now escalates by deleting accounts and passwords to lock out victims , this calls for continuous account and credential monitoring on the Fortinet devices beyond patching.
The Wazza phishkit uses integrated filtering and session management features to specifically target manufacturing companies in the EU, making it an active, sector-specific threat.
The vulnerabilities in VMware ESXi and vCenter Server allow code execution and bypass of security measures, making the virtualization infrastructure vulnerable.
The report points to an HTML injection flaw in Microsoft Office for which no CVE has been assigned yet and no active exploitation is known.
The vulnerability requires local code execution and enables privilege escalation on Linux systems after an initial compromise.
Attackers use Teams calls and chats instead of classic phishing emails to obtain credentials and MFA codes through trust-building.
The report summarizes multiple OpenSSH vulnerabilities without specific CVE IDs, complicating prioritization.
The BSI advisory contains no CVE IDs and no exploitation details, which complicates prioritization of the vulnerabilities.
The report does not specify concrete CVE IDs or exploitation details; it serves as a general indication of Chrome security updates.
Beyond the patch information, the report provides no additional insights into active attacks or affected sectors.
Veeam Backup & Replication is a central system for data backup and recovery; code execution on this server directly endangers the integrity of the backups.