Comparing 21 October 2026 with the previous day 20 October 2026.
The report shows that exploitation of CVE-2024-47575 does not end with patching: PEERSTITCH masquerades as a legitimate service and serves long-term credential collection across managed FortiGate devices.
The report shows that China-linked APTs are actively exploiting zero-days in remote support appliances to gain root access and credentials , a risk for indirectly exposed service providers.
The report adds to the patch information by describing active exploitation by a suspected advanced actor and the use of memory-resident malware that operates on FortiGate VPN gateways without file artifacts.
The report merely describes a low-severity Chrome vulnerability and provides no indication of active exploitation or new attack techniques.
This NVD advisory contains no indication of active exploitation, exploit code, or advanced TTPs; it merely documents a medium-severity Chrome vulnerability.
The alert contains no information beyond the CVE description, in particular no indication of active exploitation or a public exploit.
Pure NVD patch notice with no indication of active exploitation, PoC or attacker TTPs , the added value is limited to version number 156.0.8078.47.
The report provides no details beyond patch information; active exploitation is not documented.
The report contains no indication of active exploitation or new attack techniques and merely supplements the patch information for a medium-severity Chrome vulnerability.
The alert contains no indication of active exploitation or a public exploit; it merely documents a medium-severity use-after-free vulnerability in Chrome that is fixed by patching.
The NVD entry contains no indication of active exploitation, exploit code, or a campaign and therefore does not go beyond patch information.
The report merely describes a medium-severity Chrome vulnerability without any indication of active exploitation, threat actor groups, or a campaign.
Beyond the patch information, the alert contains no indication of active exploitation, an exploit, or a targeted campaign.
A pure vulnerability disclosure with no indication of active exploitation or public exploit code; the attack vector is limited to a user visiting a crafted web page.
No insights beyond the patch information; the report contains no evidence of active exploitation.
This report contains no information beyond the patch advisory regarding active exploitation, exploits, or attack tactics.
Beyond the patch information, the alert provides no indication of an exploit or active exploitation; the only relevant point is that the memory corruption sits in the ANGLE graphics module of Chromium browsers and therefore also affects Edge.
The report contains no information beyond the CVE description; it mentions neither active exploitation nor specific attack tactics.
Beyond the patch information, there is no indication of active exploitation, a public exploit, or KEV inclusion.
Beyond the patch information, the NVD entry contains no evidence of active exploitation, specific victim groups, or TTPs.
The report only contains NVD patch information about a Chrome vulnerability; there are no indications of active exploitation or new TTPs.
The alert only provides the CVE description; there is no information on active exploitation, targeted victims, or additional TTPs.
The alert provides no information beyond the patch details about active exploitation, attacker TTPs, or affected sectors.
This NVD entry only describes a high-severity Chrome V8 memory-corruption flaw; it contains no indication of active exploitation or new TTPs.
Beyond the patch information, the report contains no indications of active exploitation, attack tactics, or affected victim sectors.
The report contains no indication of active exploitation or new attack techniques and does not go beyond the patch information already included in the Chrome update.
The advisory details a high-severity use-after-free in ANGLE that enables code execution inside the Chrome sandbox via a crafted HTML page; no active exploitation is reported.
The report contains no information beyond the pure patch information regarding active exploitation or specific attackers.
The report only adds patch information: a high-severity input validation vulnerability in ANGLE potentially allows code execution outside the sandbox; active exploitation is not mentioned.
The NVD entry mainly provides CVE and patch information; it contains no indication of active exploitation or a specific campaign.
The alert contains no information beyond the patch details about active exploitation, attacker TTPs, or specific victim groups.
No additional insights beyond the patch; the report contains no indication of active exploitation or attacker TTPs.
Beyond the patch information, the alert contains no indications of active exploitation, specific attacker TTPs, or affected sectors.
The alert adds no indication of active exploitation, an exploit, or affected sectors beyond the pure patch information.
The report contains no insights beyond patch information; active exploitation is not documented.
The report provides no indication of active exploitation or attacker TTPs and does not go beyond patch information for CVE-2026-113293.
The report adds only the High severity rating of the Chromium vulnerability to the patch information; active exploitation is not evidenced.
The report provides the NVD description of a critical Chrome vulnerability but no indication of active exploitation or an attack campaign.
The report contains no indication of active exploitation or additional TTPs; it merely confirms a medium-severity use-after-free vulnerability in Chrome for which an update is available.
The advisory provides no indication of active exploitation or new attack techniques; it merely documents a high-severity memory-corruption flaw in Chrome's ANGLE component.
The report only provides CVE and patch information; there are no indications of active exploitation, specific attackers, or affected sectors.
Beyond the patch information, the NVD advisory contains no indications of active exploitation, exploit code, or an attacker campaign.
The report merely provides the NVD description of a medium-severity Chrome memory corruption; it contains no indications of active exploitation, attacker TTPs, or affected sectors.
The report only confirms a medium-severity Chrome vulnerability with no indication of active exploitation or new attack techniques.
The NVD entry describes a medium-severity Chrome sandbox vulnerability with no indication of active exploitation, exploit code, or attacker TTPs.
The report only provides patch information for a medium-severity Chrome vulnerability; there are no indications of active exploitation or a strategic threat.
The BeyondTrust Remote Support zero-day was actively exploited by a China-nexus actor starting August 29, 2026, and fits a broader pattern of attacks on exposed edge appliances,a strategic signal for nation-state targeting of enterprise infrastructure.
The report shows a state-aligned actor scaling an MSP supply-chain campaign with automated AI attack orchestration, putting identity environments under broad pressure.
The report provides details on a new Lazarus campaign with an updated malware chain and selective spear-phishing targeting, offering TTPs for detecting nation-state attacks beyond patch information.
APT29 specifically steals OAuth/Entra ID tokens from the token broker cache; the identity compromise often occurs without any malware payload, thereby evading classic endpoint signatures.
Lazarus uses post-quantum cryptography to secure malware delivery and thus evade conventional detection , a new TTP standard for state actors.
The use of agentic AI attack frameworks compresses the time from initial targeting to privileged cloud access to under three hours, and compromise of a single MSP tool acts as a springboard into hundreds of customer tenants.
The report shows that APT-associated attackers use Linux edge systems and SMTP as a covert C2 channel to bypass perimeter controls.
The report describes a local privilege escalation in Windows that is exploitable only after low-privileged code execution; no active exploitation or KEV status is mentioned.
The flaw sits in Acrobat Pro DC's JPEG handling and is therefore reachable via email attachments or web downloads , a classic entry point for targeted attacks on office environments.
The advisory adds patch information about a pre-authenticated RCE flaw in Windows IKEv2, whose practical relevance depends heavily on the IPsec configuration in use.
The vulnerability affects the Linux kernel and therefore also Ubuntu servers; however, exploitation requires already elevated local privileges, which reduces the risk for exposed systems.
A local attacker who already has code execution can escalate to SYSTEM privileges via a race condition in the kernel graphics driver , the value lies primarily in the post-exploitation phase.
The report contains no information about active exploitation or an attacker; it merely describes a vulnerability that requires timely patching.
Beyond the patch information, the alert provides no evidence of active exploitation, an exploit, or a strategic campaign.
Beyond the plain patch information, the report shows that a Windows Shell vulnerability is already being actively exploited, while two further flaws (.NET Framework, MessagePack-CSharp) are publicly known and attacks on them may be imminent.
Beyond the patch reminder, the report provides no indication of active exploitation, specific CVEs, or attacker TTPs.
CISA quantifies SafePay for the first time with over 600 victims since 2024, confirming a scaled double-extortion operation with data theft rather than an isolated incident.
Phishing kits and credentials for Microsoft and Google cloud environments are traded as commodities on a Chinese-language marketplace, letting attackers run large-scale credential phishing without building anything themselves.
The EDR-killer trade has become a commercialised, tiered market, and because the same vulnerable driver is used by multiple unrelated ransomware crews, attribution by driver hash groups the suppliers rather than the gangs.
A 0-day LPE in Windows HTTP Proxy elevates privileges for attackers who already have local code execution; the exact attack vector remains undisclosed in the ZDI advisory.
The report describes only a medium-severity Chromium vulnerability with no indication of active exploitation, affected sectors, or attacker TTPs.
The quarterly report provides an aggregated ICS/OT threat overview that goes beyond individual patch disclosures for assessing risk in industrial automation environments.
The BSI update provides neither CVE IDs nor CVSS or KEV details, so prioritization must rely solely on the kernel patch level.
The advisory summarises multiple vulnerabilities in Ubiquiti UniFi without listing individual CVE IDs or evidence of active exploitation; a timely review of deployed UniFi firmware versions is therefore required.
The report adds to patch information the insight that several different error classes occur combined in Lightroom Classic and enable arbitrary code execution.
The report highlights the ongoing risk of malicious Office documents opened in Outlook and the need to treat email attachments as an attack vector.
The BSI advisory remains unspecific: without CVE IDs or exploit status, the actual likelihood of exploitation cannot be prioritized.
The alert provides no CVE IDs or exploitation details; the key question is therefore whether the glibc version used by the Ubuntu systems is affected.
The report summarizes multiple Chrome and Edge vulnerabilities without CVE IDs; concrete exploitation details or KEV status are missing, so practical prioritization remains open.
No changes in this category.
No changes in this category.
The report adds to the patch information that the Siemens vulnerability is already actively exploited in ClickFix campaigns to distribute a remote access Trojan.
The report clarifies exploitation: code execution occurs in the user context and requires opening a crafted file; there are no indications of active exploitation.
The report documents an active APT28 campaign against NATO defense suppliers using the new HOOKEDGE backdoor and a reflective loader, which goes beyond patch information as a supply-chain warning.
The report shows that Russian state espionage continues to target defense and aerospace suppliers as well as law enforcement agencies, increasing supply-chain pressure on European industrial companies.
The advisory shows that Western intelligence agencies are now publicly attributing state attackers from China with names and technical details , an escalation with signalling effect for all export and manufacturing companies in the DACH region.
Russian APT28 is using a newly documented backdoor for long-term persistence in defense and law-enforcement networks, underscoring the sustained threat of espionage against European industry.
The joint government warning highlights SafePay as one of the most active ransomware groups and shows that attacks on businesses and critical infrastructure rely on simple access vectors such as password guessing and phishing.
Exploitation requires user interaction (opening a crafted file or web page), which keeps email and web vectors relevant despite the lack of a network-facing attack surface.
ZDI reports a use-after-free flaw in Acrobat Reader DC that allows code execution after user interaction; exploit code or active exploitation is not mentioned.
No evidence of active exploitation; exploitation requires user interaction by opening a crafted file or visiting a malicious web page.
The flaw resides in annotation handling and requires user interaction, making crafted PDF documents an entry vector for code execution on client systems.
The vulnerability requires user interaction and has not been reported as actively exploited so far; it is in line with the regular stream of Acrobat security flaws.
The ZDI advisory documents no active exploitation and no PoC; relevance stems from the widespread use of Acrobat as an email attachment and web viewer.
The vulnerability requires user interaction and is therefore primarily exploitable via phishing or crafted documents , a classic attack vector against end users.
The vulnerability requires user interaction and enables code execution when opening malicious PDFs; active exploitation is not confirmed.
ZDI reports an RCE vulnerability in Adobe Acrobat Reader DC with a CVSS score of 7.8; the advisory contains no indication of active exploitation or a public exploit.
The exploit requires opening a malicious image file; no active exploitation has been reported.
At the time of publication there are no signs of active exploitation; an attack requires the user to open a manipulated DCM file.
This is a client-side RCE triggered by opening a manipulated image file; no active exploitation in the wild is reported.
The incomplete fix and public exploit turn the COM registration into a concrete local privilege-escalation risk that goes beyond patch information.
The advisory confirms an RCE vulnerability in Adobe Acrobat Reader DC without providing evidence of active exploitation or KEV listing.
The ZDI advisory mentions neither a proof of concept nor active exploitation; the decisive factor is that simply opening a crafted PDF file is enough to achieve code execution on the endpoint.
The NVD entry contains no indication of active exploitation; the risk lies in the required user interaction via malicious URLs or compromised web pages.
The report shows that SafePay does not exploit a single CVE but operates as an active ransomware campaign with double extortion and exposed remote access.
The October Patch Tuesday includes an already actively exploited zero-day and numerous critical RCE vulnerabilities, increasing the importance of timely prioritization of Microsoft patches for Windows, Exchange, and .NET systems.
The report adds a concrete ransomware TTP beyond patch information: compromised GPOs can serve as a domain-wide payload distribution mechanism and require AD-specific security controls.
The report highlights an unauthenticated information disclosure in Entra ID's OAuth device code grant that was published without a CVE ID and without known exploitation.
The NVD entry describes exposure of administrator credentials from encrypted project files for EdgeLink devices; there is no indication of active exploitation.
The alert does not name any CVE IDs or provide evidence of active exploitation; it merely describes the general possibility of code execution via manipulated files in Edge.
The BSI advisory does not include CVE IDs or details on the individual vulnerabilities, which complicates prioritization.
The BSI advisory remains unspecific: it names neither CVE IDs nor exploitation status, so urgency can only be derived from the vendor's UniFiOS version information.
Without specific CVE IDs or evidence of active exploitation, no increased priority beyond regular Edge updates can be derived from this alert.
The report contains no CVE IDs, CVSS scores, or evidence of active exploitation; it only confirms multiple vulnerabilities in Acrobat/Reader, some of which require user interaction to exploit.
Beyond the patch information, the article provides no signs of active exploitation or attacker TTPs; its relevance lies in the direct exposure of the backup infrastructure.