NEW A2
100 CVE-2026-97785
The alert contains only the CVE summary; no information on active exploitation, affected versions, or attacker TTPs.
Critical
CVSS
10.0
EPSS
0%
What has changed?
Comparing 23 October 2026 with the previous day 22 October 2026.
Newly added
16 NEW Storm-0940 C3
85 Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
The report shows a China-linked actor automated an MSP supply-chain campaign with an AI-enabled penetration-testing tool and compromised more than 2,200 tenants , a strategic supply-chain risk beyond patch management.
Critical
NEW Sandworm / UAC-0099 (Earth Sirrush) C3
85 Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The report shows that Sandworm, together with UAC-0099, is using a new mesh-network backdoor for destructive wiper attacks on logistics targets, making the state-sponsored threat to European supply chains more concrete.
Critical
NEW China APT C3
83 China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
The report adds to patch information the insight that a Chinese state actor is using an AI-powered pentest tool to compromise hundreds of organizations via ConnectWise remote-access/MSP channels.
Critical
NEW Sandworm C3
83 Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The report shows that Sandworm, together with UAC-0099, deployed a new mesh network backdoor in a destructive attack on a Ukrainian logistics company, demonstrating ongoing Russian cyber-warfare against supply chains.
Critical
NEW A2
81 CVE-2026-115723
The advisory adds to the bare patch information by describing the attack vector via the BSend length field, through which an active S7 partner can trigger buffer overflows in SCADA, HMI or gateway processes; active exploitation is not demonstrated.
Critical
CVSS
7.4
EPSS
0%
B3
80 AI-Powered Espionage Campaign Targets Government Linux Infrastructure
The report shows that AI is increasingly being used in state-sponsored espionage against Linux infrastructure, although the specific technical attack vector remains unclear in the excerpt.
Critical
NEW DataSuckers, Candiru F6
80 Risky Bulletin: Russia arrests DataSuckers hacking group
The report shows Russia taking action against its own hacking groups while North Korea and commercial spyware vendors like Candiru continue to operate globally.
Critical
NEW Prince of Persia C3
78 Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
The report shows that the Iranian APT group Prince of Persia is again operating command-and-control infrastructure via US shared hosting after a pause, indicating continued state-sponsored cyber activity and adjustments in operational security.
Critical
C3
20 Attackers exploit security vulnerabilities in Fortinet products and BeyondTrust
CISA confirms exploitation in the wild , these flaws are therefore no longer mere patch candidates but already active attack surfaces on edge and remote-access devices.
High
NEW C3
20 PwnEscape: Linux vulnerability allows attackers to escape from VMs
The report describes a VM escape vulnerability in the Linux network stack that, without a CVE or evidence of active exploitation, is primarily relevant to Linux-based virtualization hosts.
High
NEW C3
20 Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
The campaign shows that exposed FortiGate and GlobalProtect edge devices are actively targeted and that compromised credentials are used worldwide for further attacks, going beyond patch information.
High
NEW B3
14 Infostealer riding the AI Train
The report shows that AI themes are used as a lure for a modular infostealer that collects system, clipboard and browser data.
Medium
NEW A3
0 Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator: Multiple vulnerabilities enable unspecified attack
The advisory bundles several Fortinet vulnerabilities without CVE, version or exploitation details and therefore adds no independent insight for prioritisation beyond the vendor advisories.
Medium
NEW A3
0 [UPDATE] Google Chrome / Microsoft Edge: Multiple Vulnerabilities
The report aggregates several vulnerabilities in Chromium-based browsers without naming a concrete active exploitation or CVE details, so the patch status of the deployed browser versions is the decisive factor.
Medium
NEW A3
0 Google Chrome / Microsoft Edge: Multiple Vulnerabilities
The report lists no CVE IDs, CVSS scores, or active exploitation details; prioritization requires the Google and Microsoft advisories.
Medium
Newly KEV-listed
0No changes in this category.
Score moved
0No changes in this category.
No longer in report
11 NEW C3
90 Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
Microsoft attributes the ConnectWise supply-chain attack to a Chinese state actor using automated AI agents (ARTEX) and applying the same techniques globally against other organizations.
Critical
NEW Sandworm C3
85 Russian hackers teamed up to wipe data at Ukrainian grain firm
The collaboration of two state-backed groups in a purely destructive attack on a grain logistics company shows that Sandworm shares its wiper capabilities with partners and deliberately targets food-industry supply chains.
Critical
NEW Storm-0940 C3
85 China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
The use of an AI agent framework in a state-sponsored supply chain attack on ConnectWise Cloud Backup demonstrates the increasing automation of state cyber operations.
Critical
FAMOUS CHOLLIMA B3
85 U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
The report shows that North Korean state actors can infiltrate companies through IT-worker schemes and supply-chain access, and that U.S. authorities have disrupted the operation's infrastructure.
Critical
NEW APT41 B2
73 How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
APT41 is reviving a known UEFI bootkit technique through a Secure Boot flaw that has been patched for years, demonstrating that boot-level persistence still works without an updated Secure Boot database (Windows UEFI CA 2023).
High
CVSS
4.4
EPSS
7%
B2
56 ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
The flaw resides in Photoshop's PDF parsing and can be exploited via a crafted PDF file, which puts the document-based attack vector at the forefront.
Medium
CVSS
7.8
EPSS
0%
B2
56 ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI reports no active exploitation; relevance stems from direct exposure of Adobe Photoshop and a CVSS score of 7.8 with required user interaction.
Medium
CVSS
7.8
EPSS
0%
C3
20 Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
The incident shows that compromised credentials from a backup/MSP provider can serve as an entry point into Microsoft 365 tenants, demonstrating supply-chain risks beyond classic software vulnerabilities.
High
NEW A3
0 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
CISA publishes an ICS advisory on a Siemens SIMATIC S7-1500 CPU without listing CVE IDs, so the concrete scope of the vulnerability remains unclear.
Medium
NEW A3
0 Siemens SIMATIC S7 PLCs Web Server
The advisory highlights the attack surface of the integrated web servers in SIMATIC S7 controllers without providing specific CVE or patch information.
Medium
NEW A3
0 Siemens WinCC
The CISA advisory on Siemens WinCC does not list any CVE IDs, so severity and exploitability remain unclear.
Medium