Comparing 22 October 2026 with the previous day 21 October 2026.
Microsoft attributes the ConnectWise supply-chain attack to a Chinese state actor using automated AI agents (ARTEX) and applying the same techniques globally against other organizations.
The collaboration of two state-backed groups in a purely destructive attack on a grain logistics company shows that Sandworm shares its wiper capabilities with partners and deliberately targets food-industry supply chains.
The use of an AI agent framework in a state-sponsored supply chain attack on ConnectWise Cloud Backup demonstrates the increasing automation of state cyber operations.
The report shows that North Korean state actors can infiltrate companies through IT-worker schemes and supply-chain access, and that U.S. authorities have disrupted the operation's infrastructure.
APT41 is reviving a known UEFI bootkit technique through a Secure Boot flaw that has been patched for years, demonstrating that boot-level persistence still works without an updated Secure Boot database (Windows UEFI CA 2023).
The flaw resides in Photoshop's PDF parsing and can be exploited via a crafted PDF file, which puts the document-based attack vector at the forefront.
ZDI reports no active exploitation; relevance stems from direct exposure of Adobe Photoshop and a CVSS score of 7.8 with required user interaction.
The incident shows that compromised credentials from a backup/MSP provider can serve as an entry point into Microsoft 365 tenants, demonstrating supply-chain risks beyond classic software vulnerabilities.
CISA publishes an ICS advisory on a Siemens SIMATIC S7-1500 CPU without listing CVE IDs, so the concrete scope of the vulnerability remains unclear.
The advisory highlights the attack surface of the integrated web servers in SIMATIC S7 controllers without providing specific CVE or patch information.
The CISA advisory on Siemens WinCC does not list any CVE IDs, so severity and exploitability remain unclear.
No changes in this category.
No changes in this category.
The report shows that exploitation of CVE-2024-47575 does not end with patching: PEERSTITCH masquerades as a legitimate service and serves long-term credential collection across managed FortiGate devices.
The report shows that China-linked APTs are actively exploiting zero-days in remote support appliances to gain root access and credentials , a risk for indirectly exposed service providers.
The report adds to the patch information by describing active exploitation by a suspected advanced actor and the use of memory-resident malware that operates on FortiGate VPN gateways without file artifacts.
The report merely describes a low-severity Chrome vulnerability and provides no indication of active exploitation or new attack techniques.
This NVD advisory contains no indication of active exploitation, exploit code, or advanced TTPs; it merely documents a medium-severity Chrome vulnerability.
The alert contains no information beyond the CVE description, in particular no indication of active exploitation or a public exploit.
Pure NVD patch notice with no indication of active exploitation, PoC or attacker TTPs , the added value is limited to version number 156.0.8078.47.
The report provides no details beyond patch information; active exploitation is not documented.
The report contains no indication of active exploitation or new attack techniques and merely supplements the patch information for a medium-severity Chrome vulnerability.
The alert contains no indication of active exploitation or a public exploit; it merely documents a medium-severity use-after-free vulnerability in Chrome that is fixed by patching.
The NVD entry contains no indication of active exploitation, exploit code, or a campaign and therefore does not go beyond patch information.
The report merely describes a medium-severity Chrome vulnerability without any indication of active exploitation, threat actor groups, or a campaign.
Beyond the patch information, the alert contains no indication of active exploitation, an exploit, or a targeted campaign.
A pure vulnerability disclosure with no indication of active exploitation or public exploit code; the attack vector is limited to a user visiting a crafted web page.
No insights beyond the patch information; the report contains no evidence of active exploitation.
This report contains no information beyond the patch advisory regarding active exploitation, exploits, or attack tactics.
Beyond the patch information, the alert provides no indication of an exploit or active exploitation; the only relevant point is that the memory corruption sits in the ANGLE graphics module of Chromium browsers and therefore also affects Edge.
The report contains no information beyond the CVE description; it mentions neither active exploitation nor specific attack tactics.
Beyond the patch information, there is no indication of active exploitation, a public exploit, or KEV inclusion.
Beyond the patch information, the NVD entry contains no evidence of active exploitation, specific victim groups, or TTPs.
The report only contains NVD patch information about a Chrome vulnerability; there are no indications of active exploitation or new TTPs.
The alert only provides the CVE description; there is no information on active exploitation, targeted victims, or additional TTPs.
The alert provides no information beyond the patch details about active exploitation, attacker TTPs, or affected sectors.
This NVD entry only describes a high-severity Chrome V8 memory-corruption flaw; it contains no indication of active exploitation or new TTPs.
Beyond the patch information, the report contains no indications of active exploitation, attack tactics, or affected victim sectors.
The report contains no indication of active exploitation or new attack techniques and does not go beyond the patch information already included in the Chrome update.
The advisory details a high-severity use-after-free in ANGLE that enables code execution inside the Chrome sandbox via a crafted HTML page; no active exploitation is reported.
The report contains no information beyond the pure patch information regarding active exploitation or specific attackers.
The report only adds patch information: a high-severity input validation vulnerability in ANGLE potentially allows code execution outside the sandbox; active exploitation is not mentioned.
The NVD entry mainly provides CVE and patch information; it contains no indication of active exploitation or a specific campaign.
The alert contains no information beyond the patch details about active exploitation, attacker TTPs, or specific victim groups.
No additional insights beyond the patch; the report contains no indication of active exploitation or attacker TTPs.
Beyond the patch information, the alert contains no indications of active exploitation, specific attacker TTPs, or affected sectors.
The alert adds no indication of active exploitation, an exploit, or affected sectors beyond the pure patch information.
The report contains no insights beyond patch information; active exploitation is not documented.
The report provides no indication of active exploitation or attacker TTPs and does not go beyond patch information for CVE-2026-113293.
The report adds only the High severity rating of the Chromium vulnerability to the patch information; active exploitation is not evidenced.
The report provides the NVD description of a critical Chrome vulnerability but no indication of active exploitation or an attack campaign.
The report contains no indication of active exploitation or additional TTPs; it merely confirms a medium-severity use-after-free vulnerability in Chrome for which an update is available.
The advisory provides no indication of active exploitation or new attack techniques; it merely documents a high-severity memory-corruption flaw in Chrome's ANGLE component.
The report only provides CVE and patch information; there are no indications of active exploitation, specific attackers, or affected sectors.
Beyond the patch information, the NVD advisory contains no indications of active exploitation, exploit code, or an attacker campaign.
The report merely provides the NVD description of a medium-severity Chrome memory corruption; it contains no indications of active exploitation, attacker TTPs, or affected sectors.
The report only confirms a medium-severity Chrome vulnerability with no indication of active exploitation or new attack techniques.
The NVD entry describes a medium-severity Chrome sandbox vulnerability with no indication of active exploitation, exploit code, or attacker TTPs.
The report only provides patch information for a medium-severity Chrome vulnerability; there are no indications of active exploitation or a strategic threat.
The BeyondTrust Remote Support zero-day was actively exploited by a China-nexus actor starting August 29, 2026, and fits a broader pattern of attacks on exposed edge appliances,a strategic signal for nation-state targeting of enterprise infrastructure.
The report shows a state-aligned actor scaling an MSP supply-chain campaign with automated AI attack orchestration, putting identity environments under broad pressure.
The report provides details on a new Lazarus campaign with an updated malware chain and selective spear-phishing targeting, offering TTPs for detecting nation-state attacks beyond patch information.
APT29 specifically steals OAuth/Entra ID tokens from the token broker cache; the identity compromise often occurs without any malware payload, thereby evading classic endpoint signatures.
Lazarus uses post-quantum cryptography to secure malware delivery and thus evade conventional detection , a new TTP standard for state actors.
The use of agentic AI attack frameworks compresses the time from initial targeting to privileged cloud access to under three hours, and compromise of a single MSP tool acts as a springboard into hundreds of customer tenants.
The report shows that APT-associated attackers use Linux edge systems and SMTP as a covert C2 channel to bypass perimeter controls.
The report describes a local privilege escalation in Windows that is exploitable only after low-privileged code execution; no active exploitation or KEV status is mentioned.
The flaw sits in Acrobat Pro DC's JPEG handling and is therefore reachable via email attachments or web downloads , a classic entry point for targeted attacks on office environments.
The advisory adds patch information about a pre-authenticated RCE flaw in Windows IKEv2, whose practical relevance depends heavily on the IPsec configuration in use.
The vulnerability affects the Linux kernel and therefore also Ubuntu servers; however, exploitation requires already elevated local privileges, which reduces the risk for exposed systems.
A local attacker who already has code execution can escalate to SYSTEM privileges via a race condition in the kernel graphics driver , the value lies primarily in the post-exploitation phase.
The report contains no information about active exploitation or an attacker; it merely describes a vulnerability that requires timely patching.
Beyond the patch information, the alert provides no evidence of active exploitation, an exploit, or a strategic campaign.
Beyond the plain patch information, the report shows that a Windows Shell vulnerability is already being actively exploited, while two further flaws (.NET Framework, MessagePack-CSharp) are publicly known and attacks on them may be imminent.
Beyond the patch reminder, the report provides no indication of active exploitation, specific CVEs, or attacker TTPs.
CISA quantifies SafePay for the first time with over 600 victims since 2024, confirming a scaled double-extortion operation with data theft rather than an isolated incident.
Phishing kits and credentials for Microsoft and Google cloud environments are traded as commodities on a Chinese-language marketplace, letting attackers run large-scale credential phishing without building anything themselves.
The EDR-killer trade has become a commercialised, tiered market, and because the same vulnerable driver is used by multiple unrelated ransomware crews, attribution by driver hash groups the suppliers rather than the gangs.
A 0-day LPE in Windows HTTP Proxy elevates privileges for attackers who already have local code execution; the exact attack vector remains undisclosed in the ZDI advisory.
The report describes only a medium-severity Chromium vulnerability with no indication of active exploitation, affected sectors, or attacker TTPs.
The quarterly report provides an aggregated ICS/OT threat overview that goes beyond individual patch disclosures for assessing risk in industrial automation environments.
The BSI update provides neither CVE IDs nor CVSS or KEV details, so prioritization must rely solely on the kernel patch level.
The advisory summarises multiple vulnerabilities in Ubiquiti UniFi without listing individual CVE IDs or evidence of active exploitation; a timely review of deployed UniFi firmware versions is therefore required.
The report adds to patch information the insight that several different error classes occur combined in Lightroom Classic and enable arbitrary code execution.
The report highlights the ongoing risk of malicious Office documents opened in Outlook and the need to treat email attachments as an attack vector.
The BSI advisory remains unspecific: without CVE IDs or exploit status, the actual likelihood of exploitation cannot be prioritized.
The alert provides no CVE IDs or exploitation details; the key question is therefore whether the glibc version used by the Ubuntu systems is affected.
The report summarizes multiple Chrome and Edge vulnerabilities without CVE IDs; concrete exploitation details or KEV status are missing, so practical prioritization remains open.