Comparing 9 October 2026 with the previous day 2 October 2026.
The report links the addition of five vulnerabilities to the CISA KEV catalog with active exploitation by the China-linked APT Flax Typhoon, indicating a state-sponsored attack campaign.
The report shows that Chinese state-sponsored APTs use purpose-built scanning and exploitation tools (MicroScan, FishHub) to target Western critical infrastructure, and that US authorities are now actively disrupting them , a sign of escalating state-level cyber operations.
The flaw resides in digital signature (DigSig) handling and requires only that a crafted file or web page be opened , behaviour that is hard to avoid in everyday PDF use.
The flaw requires user interaction (opening a crafted file or web page) and fits the recurring pattern of Acrobat RCE issues, with no active exploitation reported.
The report provides technical details on a new use-after-free vulnerability in Adobe Acrobat Reader DC; no public exploit is known.
ZDI reports an unpatched use-after-free flaw in Acrobat Reader DC's Annots report handling that can be triggered simply by opening a crafted PDF.
Exploitation merely requires opening a crafted PDF file or visiting a malicious web page, allowing code execution with the privileges of the logged-on user.
The flaw requires user interaction, so email attachments and web links remain the most likely attack vector for PDF-based attacks.
The vulnerability requires user interaction, meaning it can be exploited via crafted PDFs or web pages in the normal document workflow, making it a classic entry point for attacks on office workstations.
Exploitation strictly requires user interaction (opening a crafted document or visiting a malicious page); the advisory contains no indication of active exploitation in the wild.
This is a plain ZDI advisory with no indication of active exploitation; the attack requires a user to open a crafted DCM file.
A vulnerability in Adobe Photoshop disclosed so far only by ZDI allows code execution via crafted image files, with no indication yet of active exploitation or KEV listing.
Exploitation requires active user interaction (opening a crafted file or visiting a manipulated page), which raises the risk in creative workflows primarily via email attachments and downloads.
Exploitation requires user interaction (visiting a crafted page or opening a malicious file), making email attachments and web downloads the realistic attack vectors.
The vulnerability is a type confusion in the Dialog object of Adobe Acrobat Reader DC that enables remote code execution with user interaction; a CVSS of 7.8 indicates its high severity.
This is pure patch information with no indication of active exploitation, KEV listing, or published exploit code.
The ZDI advisory describes a use-after-free flaw in Acrobat Reader DC's annotation handling that is only triggerable through user interaction and rated low at CVSS 3.3.
The vulnerability is rated low with CVSS 3.3 and requires user interaction; no active exploitation is documented.
Beyond the plain patch information, the report only adds the assessment that the code-smuggling flaw sits just below the highest severity level, making it urgent but not classified as critical.
Since it is a zero-day, the vulnerability was already actively exploited before the patch was released, underscoring the urgency of the update.
The BSI advisory does not contain CVE IDs, CVSS scores, or exploitation details, so prioritization can only be based on vendor information.
The report does not provide CVE IDs or technical details, but merely points to multiple vulnerabilities in Microsoft Edge.
The vulnerability allows an unprivileged local user in a private network namespace to trigger a kernel panic, which can impact the availability of Linux systems.
The BSI WID reports multiple Linux kernel vulnerabilities without CVE IDs or details, making prioritization difficult.
The report updates a DoS vulnerability in GNU libc that can be exploited from adjacent networks; further CVE or patch details are missing.
No changes in this category.
No changes in this category.
Switzerland is set to get its first standalone cybersecurity law; affected companies should track the consultation draft due by June 2027, as it may introduce reporting and operator obligations.
The report provides technical details on a Secure Boot bypass in GRUB where an insufficiently validated MMIO base address in the serial command allows loading unsigned modules despite active lockdown restrictions.
The report identifies the China-based APT Warlock as the attacker and shows that SharePoint exploitation has been active since July 2025 and is expanding to critical infrastructure.
No evidence of active exploitation or exploit code; the vulnerability allows code execution inside the Chrome sandbox but requires visiting a crafted web page.
The report only describes the vulnerability and provides no indication of active exploitation or attacker TTPs.
The report describes a pure vulnerability without indications of active exploitation or strategic implications.
The report contains no indication of active exploitation, threat actors, or affected sectors and does not go beyond the CVE description.
The report contains no information beyond the patch details about active exploitation or attack tactics.
Classifying an intrusion by ransomware payload alone obscures the affiliate behind it: Storm-2570 shows identical post-compromise tradecraft across Qilin, DragonForce, Anubis and BERT, providing a stable basis for detection.
A China-linked ransomware group uses SharePoint vulnerabilities as an initial access vector, confirming that collaborative Microsoft platforms are a favoured entry point for state-supported attackers.
The aggregated advisory lists no CVE IDs and no indication of active exploitation, so prioritisation must rely solely on the regular Chrome patch cycle.
The BSI advisory summarizes multiple vulnerabilities in GNU libc without providing specific CVE IDs or exploitation details.
This report contains no details beyond the pure patch information.
The alert updates previous OpenSSL advisories and points to multiple new vulnerabilities without providing specific CVE details.
The report lacks CVE IDs and details on active exploitation, so no prioritized patching order can be derived.
The report provides no patch information but a quarterly telemetry assessment of ICS-related malware campaigns and newly documented APT tooling for industrial environments.