Daily digest,
CVE-2026-112377: TLS Relay Vulnerability Disclosed (+7 more)
Vulnerabilities
CVE-2026-112377: TLS Relay Vulnerability Disclosed
CVE-2026-112377 was published on October 19, 2026, detailing a flaw in CCC Attestation SIG's attested-tls-poc. The vulnerability allows attackers to relay valid attestation Evidence from a genuine attester by exploiting a failure to bind early attestation Evidence to the TLS connection. Attackers with an extracted attested TLS private key can impersonate the attested workload and intercept sensitive data. The risk is deemed high-impact but conditional, as the urgency of the threat remains unconfirmed due to the lack of KEV, SSVC, EPSS, and PoC status. Teams using remote-attestation-based TLS in test environments are particularly vulnerable. Mitigation steps include restricting access to attestation services and applying the maintainer's handshake-binding fix. The CVSS score is 9.1, indicating a severity level.
Vulnerability · 2 sources · score 75 · CVE-2026-112377
CVE-2026-12665: IBM MQ Vulnerability Allows Remote Code Execution
IBM MQ has a vulnerability (CVE-2026-12665) that could enable remote attackers to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. This flaw affects queue managers, particularly those exposed to the internet or partner networks, and could compromise the confidentiality, integrity, and availability of business messaging. Successful exploitation may disrupt transaction flows, alter queued data, or provide attackers with a foothold in the MQ host. The CVSS score for this vulnerability is 8.1, indicating a high severity. Currently, there are no confirmed reports of active exploitation or proof-of-concept code available. IBM has not yet released specific indicators of compromise (IOCs) or exploitation activity. Organizations are advised to prioritize remediation by upgrading to fixed releases and restricting channel exposure.
Vulnerability · 2 sources · score 65 · CVE-2026-12665
High-Risk CVE-2026-10574 Discovered in IBM MQ
IBM MQ has a vulnerability (CVE-2026-10574) that allows authenticated attackers to cause denial of service or execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. This vulnerability is rated as high risk (CVSS 8.8) and requires expedited remediation for exposed deployments. Organizations running MQ brokers in container platforms or enterprise integration environments are particularly affected, especially where clients or partner networks can reach broker interfaces. The attack requires network access and a low-privilege account to submit messages, with no victim action needed. The scope of impact includes potential disruption of message flows and unauthorized data alterations. Current exploitation activity is uncertain, as no proof-of-concept or active exploitation has been reported. Organizations are advised to monitor for unusual MQPUT/MQPUT1 activity and review their security configurations.
Vulnerability · 2 sources · score 64 · CVE-2026-10574
High-Risk CVE-2026-10572 Discovered in IBM MQ
A new vulnerability, CVE-2026-10572, has been identified in IBM MQ, allowing authenticated attackers to potentially execute arbitrary code or cause a denial of service via a heap buffer overflow during MQPUT operations with malformed message options. This flaw is classified as high severity with a CVSS score of 8.8. Affected systems include containerized queue managers and clusters managed by an operator, especially those exposed to untrusted networks. Attackers need network access and a low-privilege authenticated account to exploit this vulnerability. While the risk is significant, there is currently no evidence of active exploitation or a proof of concept available. IBM has released fixed versions, and users are advised to upgrade their systems promptly. Until patched, restricting network access to trusted clients is recommended.
Vulnerability · 2 sources · score 63 · CVE-2026-10572
Breaches
Stolen UpdraftCentral Keys Compromise Over 100 WordPress Sites
An attacker has exploited stolen UpdraftCentral dashboard keys to install backdoor plugins on connected WordPress sites. The campaign, confirmed by TeamUpdraft, began on October 18 and has affected over 100 sites, with attacks still ongoing. The commands sent by the attacker are encrypted and signed with legitimate keys, bypassing security checks in the UpdraftPlus plugin. The only mitigation currently available for site owners is to delete their UpdraftCentral keys. TeamUpdraft has acknowledged the breach and is working on an emergency update to disconnect compromised keys. The incident has been rated 9.8 on the CVSS scale by Patchstack, but no CVE has been issued as the plugin itself is not vulnerable. Nethemba, a Slovak security firm, first detected the campaign on their infrastructure. The breach does not expose payment details, but other sensitive customer data was accessed.
Vulnerability · 3 sources · score 72 · CVE-2026-10795
Bullhorn Staffing Platform Offline Due to Cyberattack
Bullhorn, an online recruitment platform, experienced a cyberattack that caused a system-wide outage starting October 16, 2026. The company confirmed the incident on October 16 and took its systems offline to contain the threat. Bullhorn is working with CrowdStrike for a forensic investigation and has not yet determined if customer data was exfiltrated. As of October 19, services have been restored, but customers are warned to be vigilant against potential social engineering attacks. The outage affected various services, including ATS/CRM and automation tools, impacting over 10,000 customers globally. Users are required to reset passwords, and API passwords will also need rotation. The company has not provided a timeline for full service restoration.
Phishing · 2 sources · score 56
Threat actors and malware
Chinese Crime Ring Hacks Staples, Issues $5 Million in Fraudulent Gift Cards
A Chinese organized crime group hacked Staples, generating over 15,000 fraudulent gift cards worth more than $5 million. The attack exploited a customer support tool called Nexus, which was believed to be accessible only internally. Hackers used heap dump requests to capture data from the application, allowing them to impersonate logged-in customer service representatives and issue gift cards to their own email accounts. The stolen gift cards were then used to purchase electronics at various retailers, including Target and Sephora, with significant transactions occurring in New Hampshire. Investigators identified thousands of cards redeemed across multiple states, indicating a widespread operation. The hack highlights vulnerabilities in retail cybersecurity and the sophistication of organized crime operations targeting U.S. retailers.
APT · 2 sources · score 54
Also worth knowing
Jaguar Land Rover Cyber Attack: £1.9 Billion Impact on UK Economy
In September 2025, Jaguar Land Rover (JLR) suffered a significant cyber attack that halted car production for nearly six weeks, marking it as the costliest cyber incident in UK history. The attack led to an estimated £1.9 billion loss for the UK economy, with JLR's revenue falling 24% year-on-year and a reported loss of £485 million. While the exact attack vector remains undisclosed, the incident has raised concerns about the vulnerability of critical infrastructure and supply chains. The UK government has noted an increase in hostile cyber activities, emphasizing the need for businesses to bolster their cybersecurity measures. The Cyber Monitoring Centre declared JLR fully recovered by January 2026, but the ramifications of the attack continue to affect the economy and industry operations.
Critical Infrastructure · 2 sources · score 54
New on leak sites
31 victims listed on ransomware leak sites by 14 groups in the 24 hours before this issue. The most active:
Also moving
- Malware: Pegasus, Atomic Stealer, ClickFix, CloudSyncD, DarkSword
- CVEs: CVE-2026-99999, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452, CVE-2026-102764
- Campaigns: Anthropic Cyber Mission, ANZ Cybercrime Hackathon, Apex Accelerator, Bayonet Quest 26, City-Forum Campaign
- APT groups: Chinese APT
- Vulnerabilities: GHSA-7554-gx6g-xx77
- Ransomware groups: Lockbit, Lockbit Ransomware
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.