Comparing 21 October 2026 with the previous day 14 October 2026.
The report shows that exploitation of CVE-2024-47575 does not end with patching: PEERSTITCH masquerades as a legitimate service and serves long-term credential collection across managed FortiGate devices.
The report shows that China-linked APTs are actively exploiting zero-days in remote support appliances to gain root access and credentials , a risk for indirectly exposed service providers.
The report adds to the patch information by describing active exploitation by a suspected advanced actor and the use of memory-resident malware that operates on FortiGate VPN gateways without file artifacts.
The report merely describes a low-severity Chrome vulnerability and provides no indication of active exploitation or new attack techniques.
This NVD advisory contains no indication of active exploitation, exploit code, or advanced TTPs; it merely documents a medium-severity Chrome vulnerability.
The alert contains no information beyond the CVE description, in particular no indication of active exploitation or a public exploit.
Pure NVD patch notice with no indication of active exploitation, PoC or attacker TTPs , the added value is limited to version number 156.0.8078.47.
The report provides no details beyond patch information; active exploitation is not documented.
The report contains no indication of active exploitation or new attack techniques and merely supplements the patch information for a medium-severity Chrome vulnerability.
The alert contains no indication of active exploitation or a public exploit; it merely documents a medium-severity use-after-free vulnerability in Chrome that is fixed by patching.
The NVD entry contains no indication of active exploitation, exploit code, or a campaign and therefore does not go beyond patch information.
The report merely describes a medium-severity Chrome vulnerability without any indication of active exploitation, threat actor groups, or a campaign.
Beyond the patch information, the alert contains no indication of active exploitation, an exploit, or a targeted campaign.
A pure vulnerability disclosure with no indication of active exploitation or public exploit code; the attack vector is limited to a user visiting a crafted web page.
No insights beyond the patch information; the report contains no evidence of active exploitation.
This report contains no information beyond the patch advisory regarding active exploitation, exploits, or attack tactics.
Beyond the patch information, the alert provides no indication of an exploit or active exploitation; the only relevant point is that the memory corruption sits in the ANGLE graphics module of Chromium browsers and therefore also affects Edge.
The report contains no information beyond the CVE description; it mentions neither active exploitation nor specific attack tactics.
Beyond the patch information, there is no indication of active exploitation, a public exploit, or KEV inclusion.
Beyond the patch information, the NVD entry contains no evidence of active exploitation, specific victim groups, or TTPs.
The report only contains NVD patch information about a Chrome vulnerability; there are no indications of active exploitation or new TTPs.
The alert only provides the CVE description; there is no information on active exploitation, targeted victims, or additional TTPs.
The alert provides no information beyond the patch details about active exploitation, attacker TTPs, or affected sectors.
This NVD entry only describes a high-severity Chrome V8 memory-corruption flaw; it contains no indication of active exploitation or new TTPs.
Beyond the patch information, the report contains no indications of active exploitation, attack tactics, or affected victim sectors.
The report contains no indication of active exploitation or new attack techniques and does not go beyond the patch information already included in the Chrome update.
The advisory details a high-severity use-after-free in ANGLE that enables code execution inside the Chrome sandbox via a crafted HTML page; no active exploitation is reported.
The report contains no information beyond the pure patch information regarding active exploitation or specific attackers.
The report only adds patch information: a high-severity input validation vulnerability in ANGLE potentially allows code execution outside the sandbox; active exploitation is not mentioned.
The NVD entry mainly provides CVE and patch information; it contains no indication of active exploitation or a specific campaign.
The alert contains no information beyond the patch details about active exploitation, attacker TTPs, or specific victim groups.
No additional insights beyond the patch; the report contains no indication of active exploitation or attacker TTPs.
Beyond the patch information, the alert contains no indications of active exploitation, specific attacker TTPs, or affected sectors.
The alert adds no indication of active exploitation, an exploit, or affected sectors beyond the pure patch information.
The report contains no insights beyond patch information; active exploitation is not documented.
The report provides no indication of active exploitation or attacker TTPs and does not go beyond patch information for CVE-2026-113293.
The report adds only the High severity rating of the Chromium vulnerability to the patch information; active exploitation is not evidenced.
The report provides the NVD description of a critical Chrome vulnerability but no indication of active exploitation or an attack campaign.
The report contains no indication of active exploitation or additional TTPs; it merely confirms a medium-severity use-after-free vulnerability in Chrome for which an update is available.
The advisory provides no indication of active exploitation or new attack techniques; it merely documents a high-severity memory-corruption flaw in Chrome's ANGLE component.
The report only provides CVE and patch information; there are no indications of active exploitation, specific attackers, or affected sectors.
Beyond the patch information, the NVD advisory contains no indications of active exploitation, exploit code, or an attacker campaign.
The report merely provides the NVD description of a medium-severity Chrome memory corruption; it contains no indications of active exploitation, attacker TTPs, or affected sectors.
The report only confirms a medium-severity Chrome vulnerability with no indication of active exploitation or new attack techniques.
The NVD entry describes a medium-severity Chrome sandbox vulnerability with no indication of active exploitation, exploit code, or attacker TTPs.
The report only provides patch information for a medium-severity Chrome vulnerability; there are no indications of active exploitation or a strategic threat.
The BeyondTrust Remote Support zero-day was actively exploited by a China-nexus actor starting August 29, 2026, and fits a broader pattern of attacks on exposed edge appliances,a strategic signal for nation-state targeting of enterprise infrastructure.
The report shows a state-aligned actor scaling an MSP supply-chain campaign with automated AI attack orchestration, putting identity environments under broad pressure.
The report provides details on a new Lazarus campaign with an updated malware chain and selective spear-phishing targeting, offering TTPs for detecting nation-state attacks beyond patch information.
APT29 specifically steals OAuth/Entra ID tokens from the token broker cache; the identity compromise often occurs without any malware payload, thereby evading classic endpoint signatures.
Lazarus uses post-quantum cryptography to secure malware delivery and thus evade conventional detection , a new TTP standard for state actors.
The use of agentic AI attack frameworks compresses the time from initial targeting to privileged cloud access to under three hours, and compromise of a single MSP tool acts as a springboard into hundreds of customer tenants.
The report describes a local privilege escalation in Windows that is exploitable only after low-privileged code execution; no active exploitation or KEV status is mentioned.
The advisory adds patch information about a pre-authenticated RCE flaw in Windows IKEv2, whose practical relevance depends heavily on the IPsec configuration in use.
The vulnerability affects the Linux kernel and therefore also Ubuntu servers; however, exploitation requires already elevated local privileges, which reduces the risk for exposed systems.
The report contains no information about active exploitation or an attacker; it merely describes a vulnerability that requires timely patching.
Beyond the patch information, the alert provides no evidence of active exploitation, an exploit, or a strategic campaign.
Beyond the patch reminder, the report provides no indication of active exploitation, specific CVEs, or attacker TTPs.
CISA quantifies SafePay for the first time with over 600 victims since 2024, confirming a scaled double-extortion operation with data theft rather than an isolated incident.
Phishing kits and credentials for Microsoft and Google cloud environments are traded as commodities on a Chinese-language marketplace, letting attackers run large-scale credential phishing without building anything themselves.
The EDR-killer trade has become a commercialised, tiered market, and because the same vulnerable driver is used by multiple unrelated ransomware crews, attribution by driver hash groups the suppliers rather than the gangs.
A 0-day LPE in Windows HTTP Proxy elevates privileges for attackers who already have local code execution; the exact attack vector remains undisclosed in the ZDI advisory.
The report describes only a medium-severity Chromium vulnerability with no indication of active exploitation, affected sectors, or attacker TTPs.
The BSI update provides neither CVE IDs nor CVSS or KEV details, so prioritization must rely solely on the kernel patch level.
The advisory summarises multiple vulnerabilities in Ubiquiti UniFi without listing individual CVE IDs or evidence of active exploitation; a timely review of deployed UniFi firmware versions is therefore required.
The report adds to patch information the insight that several different error classes occur combined in Lightroom Classic and enable arbitrary code execution.
The BSI advisory remains unspecific: without CVE IDs or exploit status, the actual likelihood of exploitation cannot be prioritized.
The alert provides no CVE IDs or exploitation details; the key question is therefore whether the glibc version used by the Ubuntu systems is affected.
The report summarizes multiple Chrome and Edge vulnerabilities without CVE IDs; concrete exploitation details or KEV status are missing, so practical prioritization remains open.
No changes in this category.
No changes in this category.
The October Patch Tuesday includes CVE-2026-96951, an already actively exploited Windows security bypass, but the report provides no details on attacks, TTPs, or affected sectors.
The report documents that a China-linked actor (Flax Typhoon) is actively exploiting vulnerabilities that CISA classifies as exploited in the wild , this is more than a patch note and points to ongoing state-sponsored attacks against exposed infrastructure.
The report describes only the vulnerability itself; there are no indications of active exploitation, public exploit code, or attribution to a threat actor.
The joint warning confirms ongoing state-sponsored Chinese cyber espionage targeting sensitive data worldwide, underlining the strategic threat to European industrial companies.
Star Blizzard has refined its detection evasion through large-scale phishing campaigns and the novel RedFlick technique, marking a significant shift in the Russian state actor's operational tradecraft.
The BSI confirms an active compromise campaign against German institutions, indicating a targeted threat for the DACH region.
The report highlights that North Korea continues to systematically infiltrate Western companies with IT workers under false identities to evade sanctions and generate foreign currency for its weapons program,a risk that also affects DACH companies when hiring remote IT staff.
The flaw resides in Acrobat Reader DC's annotation handling and requires user interaction (opening a malicious file or visiting a malicious page), which makes it particularly attractive for targeted phishing.
Beyond the patch information, the advisory provides no indication of active exploitation or a public exploit.
Beyond the bare patch information: exploitation requires user interaction, and there are so far no indications of active exploitation in the wild.
There is no evidence of active exploitation or KEV inclusion; exploitation requires user interaction.
ZDI describes a use-after-free flaw in Acrobat Reader DC's annotation processing; there is no evidence of active exploitation.
The advisory describes another flaw in Photoshop's image parser; beyond patch information it contains no indication of active exploitation, a public exploit, or a new attack technique.
The vulnerability allows remote code execution with user interaction; an exploit is not publicly known at this time.
The report describes CVE-2026-66804 as an incomplete fix for a Windows LPE vulnerability, with a public exploit leveraging a dangling COM registration.
The vulnerability requires user interaction (opening a crafted file or web page) and is therefore primarily exploitable via email attachments and drive-by scenarios.
Beyond the plain patch information, the advisory contains no indication of active exploitation; what matters is that the flaw in the PDF parser allows code execution outside the sandbox, turning a browser bug into a full system-compromise vector.
The report merely describes a critical vulnerability without indications of active exploitation, exploit code, or a threat actor.
The report describes a pure information-disclosure vulnerability in 7-Zip that requires opening a crafted SquashFS archive; there are no indications of active exploitation or a strategic dimension.
The vulnerability requires user interaction and has a low CVSS score of 3.3; it only allows information disclosure, which limits the risk.
The low CVSS score of 3.3 and the required user interaction limit the risk; no active exploit is known.
The vulnerability is only exploitable with user interaction and has a low severity score of CVSS 3.3, which lowers the priority for immediate action.
The vulnerability has a low CVSS score (3.3), requires user interaction, and there is no indication of active exploitation.
The campaign shows how customized phishing kits are operated at industrial scale and how coordinated disruption by vendors and partners can strike criminal infrastructure.
No insights beyond the patch information; no active exploitation or attack campaign is known.
The report provides no details beyond patch information, in particular no indication of active exploitation or a threat actor.
The report contains no information beyond the patch advisory regarding active exploitation or attack tactics.
Beyond the pure patch information, the report contains no indications of active exploitation, attack campaigns, or specific attacker TTPs.
Pure patch notification with no indication of active exploitation or attacker TTPs; the flaw allows code execution but is described as remaining confined within the Chrome sandbox.
The report provides no information beyond the pure CVE description, in particular no indications of active exploitation or attack campaigns.
The alert contains no information beyond the pure CVE description, in particular no evidence of active exploitation or a strategic campaign.
This report contains no information beyond the patch details, particularly no indication of active exploitation or attack campaigns.
The report contains no details beyond the patch information, in particular no indications of active exploitation or attackers.
The vulnerability requires prior local access, which limits exploitability compared to remotely exploitable flaws.
The vulnerabilities in Ubiquiti UnifiOS allow code execution and privilege escalation, thus directly affecting the network infrastructure.
The BSI report does not contain CVE IDs or CVSS scores, making prioritization of the vulnerabilities difficult.
The rating narrowly misses the critical threshold, underscoring the urgency despite the absence of an active exploitation report.
The consolidated advisory bundles multiple vulnerabilities across several SIMATIC S7 product lines, indicating a broad attack surface in the PLC environment, with no active exploitation reported so far.
The BSI alert summarises multiple vulnerabilities in Windows and Windows Server without naming CVE IDs, exploitation status, or specific threat actors.
The report summarizes multiple vulnerabilities in Microsoft SQL Server without specifying CVEs, making prioritization difficult.
The BSI report provides no CVE IDs and no affected product versions, leaving unclear which UniFi components must actually be updated; the critical factor is the attack surface of the central network management interface, which is anonymously reachable from the network.
Microsoft's October Patch Tuesday fixes 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day, underscoring the urgency of patch management.
The Wazza phishkit screens visitors through a multi-stage routing chain and only then delivers an Adobe-themed device-code phishing page, bypassing MFA protection and making URL-based detection significantly harder.
The report shows how PAYLOAD ransomware uses Group Policy Objects for distribution, posing a direct threat to Active Directory environments.
This is not merely a patch notice: the FortiMail zero-day is already being actively exploited and allows full compromise without authentication; no patch exists yet, and Fortinet only provides workarounds and IOCs.
The ZDI-26-607 vulnerability in Microsoft Office has no CVE entry, complicating tracking and prioritization for defenders.
The vulnerability requires existing local access in the LOCAL SERVICE context and was published without a CVE ID, which complicates prioritization.
The report provides no information beyond the patch details about active exploitation, exploit code, or targeted victims.
The report provides no indication of active exploitation or attacker TTPs, only the availability of patches for Veeam Backup & Replication.
An AI-powered turnkey package (phishkit, admin console, and victim tracking) drastically lowers the barrier to account takeover, letting even low-skill actors run session-hijacking attacks against cloud accounts.
BSI updates its advisory on multiple OpenSSH vulnerabilities without naming specific CVEs or indications of active exploitation.
The alert is a generic patch notice without new concrete vulnerabilities or exploit details.
The BSI advisory summarises several vulnerabilities in Adobe Acrobat and Reader but provides neither CVE IDs nor exploitation status; the concrete patch and version details must be taken from Adobe's own vendor bulletin.
The attack requires either two tap gestures on a controlled website or opening a malicious Office file.
The alert provides neither CVE IDs nor affected versions, so targeted prioritisation or patch verification is not possible.
The BSI report summarises several vulnerabilities in Adobe Bridge and Substance 3D without listing CVE IDs, CVSS scores or evidence of active exploitation, making it primarily a patch reminder rather than a warning about an ongoing campaign.
The vulnerability only allows a local denial of service; there is no evidence of remote exploitation or active attacks.