https://blueteaminsider.com/Security news, verified and fastenWed, 21 Oct 2026 18:12:19 +0000https://blueteaminsider.com/section/cyber-attacks/bronze-sandcastle-abuses-sandboxie-and-other-apps/https://blueteaminsider.com/section/cyber-attacks/bronze-sandcastle-abuses-sandboxie-and-other-apps/Wed, 21 Oct 2026 17:45:30 +0000Cyber AttacksChina-linked actors place malicious libraries next to trusted software to steal credentials and install backdoors across Asia and Africa.https://blueteaminsider.com/section/vulnerabilities/code-injection-in-mindsdb-openbbtable-allows/https://blueteaminsider.com/section/vulnerabilities/code-injection-in-mindsdb-openbbtable-allows/Wed, 21 Oct 2026 17:35:47 +0000VulnerabilitiesA high-severity flaw in MindsDB lets authenticated attackers run arbitrary Python code via the OpenBBtable class, requiring immediate review of access controls.https://blueteaminsider.com/section/vulnerabilities/f5-patches-critical-nginx-heap-overflow-and-use/https://blueteaminsider.com/section/vulnerabilities/f5-patches-critical-nginx-heap-overflow-and-use/Wed, 21 Oct 2026 09:58:30 +0000VulnerabilitiesF5 released out-of-band fixes for three critical NGINX vulnerabilities that allow remote code execution or denial-of-service attacks on systems with non-default configurations.https://blueteaminsider.com/section/vulnerabilities/pillow-jpeg-buffer-overflow-arbitrary-memory/https://blueteaminsider.com/section/vulnerabilities/pillow-jpeg-buffer-overflow-arbitrary-memory/Wed, 21 Oct 2026 08:24:44 +0000VulnerabilitiesA critical buffer overflow in Pillow's JPEG decoder affects versions up to 12.3.0, allowing arbitrary memory writes via standard lossless image files.https://blueteaminsider.com/section/cloud-security/connectwise-disables-services-after-stolen-entra/https://blueteaminsider.com/section/cloud-security/connectwise-disables-services-after-stolen-entra/Wed, 21 Oct 2026 08:05:11 +0000Cloud SecurityConnectWise disabled services after attackers stole application credentials to access Microsoft 365 tenants, prompting an investigation into the breach.https://blueteaminsider.com/section/cyber-attacks/iq-lvbs-alleges-unauthorized-access-attempts-from/https://blueteaminsider.com/section/cyber-attacks/iq-lvbs-alleges-unauthorized-access-attempts-from/Wed, 21 Oct 2026 04:14:30 +0000Cyber AttacksStartup claims rival’s IP targeted its sign-in system and driving model during a private beta phase in October.https://blueteaminsider.com/section/vulnerabilities/freerdp-heap-buffer-overflow-in-rdpsnd-channel/https://blueteaminsider.com/section/vulnerabilities/freerdp-heap-buffer-overflow-in-rdpsnd-channel/Wed, 21 Oct 2026 02:38:21 +0000VulnerabilitiesA heap-based buffer overflow in FreeRDP’s audio channel allows malicious RDP clients to execute code on servers running versions prior to 3.32.1.https://blueteaminsider.com/section/vulnerabilities/adm-zip-uncaught-exception-crashes-node-js-on/https://blueteaminsider.com/section/vulnerabilities/adm-zip-uncaught-exception-crashes-node-js-on/Wed, 21 Oct 2026 01:14:54 +0000VulnerabilitiesA missing error handler in adm-zip before 0.6.1 allows unauthenticated attackers to crash Node.js processes via corrupted DEFLATE data, rated High severity.https://blueteaminsider.com/section/vulnerabilities/adm-zip-cve-2026-114104-inconsistent-entry/https://blueteaminsider.com/section/vulnerabilities/adm-zip-cve-2026-114104-inconsistent-entry/Wed, 21 Oct 2026 01:08:28 +0000VulnerabilitiesA high-severity flaw in adm-zip allows attackers to write unvalidated data to disk by exploiting duplicate entries in ZIP archives.https://blueteaminsider.com/section/vulnerabilities/textream-websocket-server-lacks-origin-check/https://blueteaminsider.com/section/vulnerabilities/textream-websocket-server-lacks-origin-check/Tue, 20 Oct 2026 22:44:09 +0000VulnerabilitiesA missing origin validation in the local WebSocket server of the Textream macOS app allows cross-site hijacking until version 1.5.1 is installed.https://blueteaminsider.com/section/vulnerabilities/wordpress-cherry-plugin-path-traversal-allows/https://blueteaminsider.com/section/vulnerabilities/wordpress-cherry-plugin-path-traversal-allows/Tue, 20 Oct 2026 21:11:14 +0000VulnerabilitiesA high-severity flaw in the Cherry Plugin lets attackers download sensitive files like database credentials without logging in.https://blueteaminsider.com/section/vulnerabilities/npm-launch-editor-and-vite-command-injection-on/https://blueteaminsider.com/section/vulnerabilities/npm-launch-editor-and-vite-command-injection-on/Tue, 20 Oct 2026 20:45:54 +0000VulnerabilitiesAttackers can bypass file existence checks in npm packages to inject OS commands on Windows systems using crafted path suffixes.https://blueteaminsider.com/section/vulnerabilities/npm-mcp-server-cve-2026-111770-cross-client-data/https://blueteaminsider.com/section/vulnerabilities/npm-mcp-server-cve-2026-111770-cross-client-data/Tue, 20 Oct 2026 20:39:04 +0000VulnerabilitiesA high-severity vulnerability in the npm Model Context Protocol server allows cross-client data leakage when multiple clients share a single server instance over HTTP.https://blueteaminsider.com/section/vulnerabilities/apache-couchdb-cve-2026-86471-allows-admins-to/https://blueteaminsider.com/section/vulnerabilities/apache-couchdb-cve-2026-86471-allows-admins-to/Tue, 20 Oct 2026 18:14:45 +0000VulnerabilitiesA critical flaw in Apache CouchDB lets administrators run arbitrary shell commands as the system user, requiring an immediate upgrade to version 3.5.3.https://blueteaminsider.com/section/cyber-attacks/windows-11-update-bug-blocks-smart-app-control/https://blueteaminsider.com/section/cyber-attacks/windows-11-update-bug-blocks-smart-app-control/Tue, 20 Oct 2026 15:09:50 +0000Cyber AttacksA glitch in the latest Windows 11 update prevents users from enabling Smart App Control, though a registry workaround temporarily restores the blocked security setting.https://blueteaminsider.com/section/cyber-attacks/generative-ai-enables-custom-malware-creation-and/https://blueteaminsider.com/section/cyber-attacks/generative-ai-enables-custom-malware-creation-and/Tue, 20 Oct 2026 14:24:57 +0000Cyber AttacksAttackers use AI to rewrite scripts and evade signature-based detection, complicating ransomware defense efforts.https://blueteaminsider.com/section/cloud-security/google-cloud-compute-and-sql-failures-in-london/https://blueteaminsider.com/section/cloud-security/google-cloud-compute-and-sql-failures-in-london/Tue, 20 Oct 2026 11:50:00 +0000Cloud SecurityDozens of Google Cloud products in the London region failed, causing Revolut to halt card payments and app access for millions of users across Europe.https://blueteaminsider.com/section/cyber-attacks/aomei-update-hijacking-delivers-crossroad-via/https://blueteaminsider.com/section/cyber-attacks/aomei-update-hijacking-delivers-crossroad-via/Tue, 20 Oct 2026 06:16:22 +0000Cyber AttacksAttackers briefly altered AOMEI server settings to serve backdoors, bypassing integrity checks by modifying checksums in configuration files.https://blueteaminsider.com/section/vulnerabilities/signal-ringrtc-queue-saturation-blocks-call/https://blueteaminsider.com/section/vulnerabilities/signal-ringrtc-queue-saturation-blocks-call/Tue, 20 Oct 2026 05:26:26 +0000VulnerabilitiesA critical flaw in Signal’s RingRTC library allows remote peers to jam call teardown processes, risking persistent audio or video streams in affected versions.https://blueteaminsider.com/section/vulnerabilities/pillow-heap-overflow-in-tiff-handling-exposes/https://blueteaminsider.com/section/vulnerabilities/pillow-heap-overflow-in-tiff-handling-exposes/Tue, 20 Oct 2026 03:01:20 +0000VulnerabilitiesA critical heap buffer overflow in the Pillow library allows attackers to execute code when saving compressed TIFF images to in-memory buffers.https://blueteaminsider.com/section/vulnerabilities/archibus-report-upload-flaw-enables-remote-code/https://blueteaminsider.com/section/vulnerabilities/archibus-report-upload-flaw-enables-remote-code/Tue, 20 Oct 2026 01:57:46 +0000VulnerabilitiesUnauthenticated attackers can chain an auth bypass with a report upload bug in Eptura Archibus to execute arbitrary commands on servers before version 2025.02.https://blueteaminsider.com/section/vulnerabilities/db-gpt-0-8-2-hardcoded-mysql-root-password/https://blueteaminsider.com/section/vulnerabilities/db-gpt-0-8-2-hardcoded-mysql-root-password/Tue, 20 Oct 2026 01:51:10 +0000VulnerabilitiesA critical flaw in DB-GPT’s default Docker setup allows unauthenticated remote access to the root database account, granting full administrative privileges to anyone reaching the exposed port.https://blueteaminsider.com/section/vulnerabilities/h3c-magic-nx15-rpc-interface-code-injection-cve/https://blueteaminsider.com/section/vulnerabilities/h3c-magic-nx15-rpc-interface-code-injection-cve/Tue, 20 Oct 2026 00:23:26 +0000VulnerabilitiesRemote code injection in H3C Magic NX15 RPC interface exposes networks to public exploit targeting specific firmware versions.https://blueteaminsider.com/section/vulnerabilities/linux-kvm-guest-triggered-smm-mmio-cache-bug-lets/https://blueteaminsider.com/section/vulnerabilities/linux-kvm-guest-triggered-smm-mmio-cache-bug-lets/Mon, 19 Oct 2026 16:40:51 +0000VulnerabilitiesA guest-triggerable bug in Linux KVM allows bypassing write tracking via stale SMM MMIO cache entries, potentially letting a virtual machine modify backing pages without detection.https://blueteaminsider.com/section/vulnerabilities/bentoml-dockerfile-injection-vulnerability-allows/https://blueteaminsider.com/section/vulnerabilities/bentoml-dockerfile-injection-vulnerability-allows/Mon, 19 Oct 2026 15:00:32 +0000VulnerabilitiesAttackers can inject malicious RUN commands into Docker builds via crafted YAML files, risking secret exposure and image tampering in BentoML environments.https://blueteaminsider.com/section/vulnerabilities/checkcle-default-config-flaw-lets-attackers-wipe/https://blueteaminsider.com/section/vulnerabilities/checkcle-default-config-flaw-lets-attackers-wipe/Mon, 19 Oct 2026 14:22:27 +0000VulnerabilitiesUnauthenticated access to CheckCle endpoints allows attackers to steal tokens, disable alerts, and delete records due to empty API rules in default configurations.https://blueteaminsider.com/section/cloud-security/connectwise-cloud-backup-halted-after-app/https://blueteaminsider.com/section/cloud-security/connectwise-cloud-backup-halted-after-app/Mon, 19 Oct 2026 11:20:53 +0000Cloud SecurityConnectWise halted Cloud Backup, SaaS Security, and Cloud Management after detecting unauthorized access to application identities within its infrastructure.https://blueteaminsider.com/section/threat-intel/dark-web-search-engines-uncovering-reality-behind/https://blueteaminsider.com/section/threat-intel/dark-web-search-engines-uncovering-reality-behind/Mon, 19 Oct 2026 05:46:05 +0000Threat IntelligenceDark web search engines do not index the entire hidden web, instead relying on static directories and user submissions that leave massive gaps.https://blueteaminsider.com/section/cyber-attacks/fake-it-support-calls-on-microsoft-teams-and-how/https://blueteaminsider.com/section/cyber-attacks/fake-it-support-calls-on-microsoft-teams-and-how/Mon, 19 Oct 2026 05:34:02 +0000Cyber AttacksAttackers exploit pre-established organizational trust on collaborative platforms by impersonating internal help desks to manipulate employees.https://blueteaminsider.com/section/threat-intel/tor-browser-privacy-risks-incident-response-steps/https://blueteaminsider.com/section/threat-intel/tor-browser-privacy-risks-incident-response-steps/Mon, 19 Oct 2026 05:18:38 +0000Threat IntelligenceLeaving an exposed Tor session running allows active adversaries to correlate live network traffic and extract local circuit states from system memory.https://blueteaminsider.com/section/vulnerabilities/broadcom-sdk-wi-fi-bug-lets-attackers-run-code-on/https://blueteaminsider.com/section/vulnerabilities/broadcom-sdk-wi-fi-bug-lets-attackers-run-code-on/Mon, 19 Oct 2026 00:54:18 +0000VulnerabilitiesA vulnerability in Broadcom’s 802.11 implementation allows attackers to execute code on routers without credentials, posing a persistent risk to unpatched devices.https://blueteaminsider.com/section/vulnerabilities/anthropic-oss-scanner-floods-teams-with/https://blueteaminsider.com/section/vulnerabilities/anthropic-oss-scanner-floods-teams-with/Sun, 18 Oct 2026 10:47:31 +0000VulnerabilitiesAnthropic’s new AI scanner identifies thousands of flaws, creating a massive triage backlog for security teams managing open-source dependencies.https://blueteaminsider.com/section/cyber-attacks/north-korean-it-identity-fraud-scheme-targets-us/https://blueteaminsider.com/section/cyber-attacks/north-korean-it-identity-fraud-scheme-targets-us/Sun, 18 Oct 2026 00:35:27 +0000Cyber AttacksFederal raids in Texas expose a multi-year operation using stolen identities to infiltrate American corporate networks via remote access.https://blueteaminsider.com/section/vulnerabilities/unauthenticated-rce-in-werss-1-5-3-via-template/https://blueteaminsider.com/section/vulnerabilities/unauthenticated-rce-in-werss-1-5-3-via-template/Sat, 17 Oct 2026 22:11:46 +0000VulnerabilitiesAttackers execute OS commands on WeRSS instances through a template parameter flaw that bypasses security filters on public endpoints.https://blueteaminsider.com/section/vulnerabilities/gpac-mp4box-divide-by-zero-flaw-crashes-media/https://blueteaminsider.com/section/vulnerabilities/gpac-mp4box-divide-by-zero-flaw-crashes-media/Sat, 17 Oct 2026 20:19:46 +0000VulnerabilitiesA medium-severity vulnerability in GPAC allows attackers to crash MP4Box by supplying files with invalid fractional denominators, requiring local access.https://blueteaminsider.com/section/vulnerabilities/netdisk-fast-download-exposes-user-credentials/https://blueteaminsider.com/section/vulnerabilities/netdisk-fast-download-exposes-user-credentials/Sat, 17 Oct 2026 19:00:05 +0000VulnerabilitiesAn unauthenticated flaw in the open-source tool allows attackers to decrypt cloud drive tokens using a static AES key embedded in the code.https://blueteaminsider.com/section/vulnerabilities/mage-oss-cve-2026-111823-oauth-validation-gap-in/https://blueteaminsider.com/section/vulnerabilities/mage-oss-cve-2026-111823-oauth-validation-gap-in/Sat, 17 Oct 2026 19:00:05 +0000VulnerabilitiesMage OSS through version 0.9.80 allows session initialization with unverified OAuth providers, creating a high-risk authentication bypass vector.https://blueteaminsider.com/section/vulnerabilities/freebsd-use-after-free-bug-in-file-descriptor/https://blueteaminsider.com/section/vulnerabilities/freebsd-use-after-free-bug-in-file-descriptor/Sat, 17 Oct 2026 16:00:32 +0000VulnerabilitiesA high-severity flaw in FreeBSD allows local attackers to gain root access via a use-after-free error in file descriptor handling.https://blueteaminsider.com/section/cyber-attacks/bash-bashrc-manipulation-steals-sudo-passwords/https://blueteaminsider.com/section/cyber-attacks/bash-bashrc-manipulation-steals-sudo-passwords/Fri, 16 Oct 2026 13:38:10 +0000Cyber AttacksAttackers modified Bash startup files to intercept sudo commands and steal passwords from government and infrastructure targets, according to Unit 42 research.https://blueteaminsider.com/section/vulnerabilities/gocsaf-csaf-provider-resource-exhaustion-bug/https://blueteaminsider.com/section/vulnerabilities/gocsaf-csaf-provider-resource-exhaustion-bug/Fri, 16 Oct 2026 13:17:23 +0000VulnerabilitiesAn unauthenticated remote vulnerability in gocsaf csaf_provider allows attackers to cause high CPU load and denial of service via resource exhaustion.