Comparing 18 October 2026 with the previous day 17 October 2026.
The flaw sits in the AdobePDFL PDF/JPEG parsing component and requires user interaction, making email attachments and web downloads the primary attack vector.
The ZDI advisory details CVE-2026-95636, an RCE flaw in Photoshop's DCM pixel processing that can be exploited via crafted image files requiring user interaction.
The disruption of a DPRK IT-worker operation highlights the risk of North Korean sham employment in Western supply chains, even without classic malware.
The report names no active exploitation, attacker, or affected sectors; it describes only a technical memory-exhaustion DoS flaw in OpenSSH compression handling.
Besides the already actively exploited Mark-of-the-Web bypass in Windows Shell, the Exchange and DHCP remote code execution flaws and the high number of Office vulnerabilities are the most practically relevant points of this Patch Tuesday.
The campaign shows that monetized bandwidth theft via compromised network devices, not just classic malware, is an active risk.
No changes in this category.
No changes in this category.
The report describes an active supply-chain attack via a compromised ConnectWise Cloud Backup credential that allows attackers to directly breach Microsoft 365 tenants.
The attack shows that compromised application identities at a backup provider can lead directly to Microsoft 365 tenant takeover, making supply-chain risk a matter of delegated cloud permissions, not just software.
The BSI WID reports multiple vulnerabilities in Synology DSM without CVE or exploitation status; for operators, the patch status of the NAS operating system is relevant.
The alert does not provide CVE IDs, versions, or exploitation status, and therefore adds no concrete patch information beyond general browser hardening.