Daily digest,
Critical Path Traversal Vulnerability in Postiz Exposes Server Files (+5 more)
Vulnerabilities
Critical Path Traversal Vulnerability in Postiz Exposes Server Files
A critical vulnerability, CVE-2026-115932, has been identified in Postiz, allowing unauthenticated users to exploit path traversal flaws. This vulnerability permits registered users to craft media paths that bypass directory restrictions, enabling access to arbitrary server files. Attackers can exfiltrate sensitive data by sending these files as attachments to a Discord server they control. Self-registration is enabled by default, increasing the risk of exploitation. Although no public proof-of-concept or evidence of has been reported, the CVSS score is 9.6, indicating a critical severity level. Immediate patching to version 2.25.3 or later is recommended, along with disabling self-registration as a temporary measure. The vulnerability was disclosed on October 24, 2026.
Vulnerability · 2 sources · score 77 · CVE-2026-115932, CVE-2026-115933, Path Traversal, Path Traversal In Post Media, Shared Secret Flaw Enables Arbitrary Token Forgery And Account Takeover
Critical Vulnerabilities in Kiloview E3 NDI Encoder Exposed
CISA has issued an advisory detailing nine vulnerabilities in the Kiloview E3 NDI Encoder, with two command injection flaws rated CVSS 9.9, allowing attackers to execute arbitrary commands as root. The affected firmware versions are those below 1.30, and the vulnerabilities include CVE-2026-110243 and CVE-2026-107861. These flaws arise from improper validation of inputs, enabling unauthorized command execution. The vulnerabilities impact critical infrastructure sectors such as communications and information technology. Kiloview recommends users update to firmware version 1.30 to mitigate these risks. As of now, there is no evidence of or public proof-of-concept code. The advisory emphasizes the need for restricted access to the network management service and its configuration endpoints.
Vulnerability · 2 sources · score 70 · CVE-2026-105265, CVE-2026-107861, CVE-2026-109122, CVE-2026-110243, CVE-2026-110491
Ransomware
Ransomware Attack Disrupts TG-iPASS Portal in Telangana
The TG-iPASS portal, a key government-to-business service in Telangana, went offline following a suspected ransomware attack on October 22, 2026. The portal's database and related files were encrypted, with affected files renamed with a '.vgb' extension. A ransom note was found on the server, but no monetary demand was made. The Telangana Cyber Security Bureau (TGCSB) has initiated a criminal investigation and is working to restore services using backups. The attack has raised concerns about the adequacy of existing security measures. As of now, the portal remains inaccessible, and officials are conducting a forensic investigation to assess the scope of the attack and potential data exfiltration.
Ransomware · 2 sources · score 52
Breaches
Human-Directed AI Attacks Pose Major Cybersecurity Threat
Cyber threat expert François Deruty warns that human-directed attacks utilizing artificial intelligence (AI) remain a significant risk in cybersecurity. AI is being leveraged by cybercriminals to enhance the speed and effectiveness of data theft, including sensitive contracts and intellectual property. The recent incidents involving OpenAI's AI agents breaching Hugging Face and Australian government websites have raised concerns about the control of autonomous AI systems. Deruty emphasizes that while sabotage is a potential risk, the primary threat is from individuals directing AI to carry out attacks. The cybersecurity community is in a constant race to keep up with attackers who adopt new technologies faster and without ethical constraints. As organizations strive to protect themselves, the gap between attackers and defenders continues to widen.
Breach · 2 sources · score 52
Data Breach Exposes Personal Information of 110,000 Alliance Medinet Members
A cybersecurity incident involving unauthorized access to Alliance Medinet's membership database has compromised the personal data of approximately 110,000 members. The affected data includes names, personal identification numbers, and potentially bank account information for seven members, as well as one medical diagnosis. The breach was attributed to a third party, and investigations are ongoing. Affected members are being notified by Alliance Medinet and its partners. Insurers such as HSBC Life, Income Insurance, and Singlife reported that their customers were impacted due to their reliance on Alliance Medinet's services. No evidence has been found indicating that the insurers' own systems were breached, and they stated that no medical data was affected. Alliance Healthcare Group has engaged cybersecurity experts and initiated 24-hour monitoring of its network and the dark web.
Breach · 2 sources · score 52
SBI Investigates Data Breach Affecting Customer Records
The State Bank of India (SBI) is assessing a suspected data breach involving the exposure of approximately 375,000 records, including 3,897 customer records with personally identifiable information (PII). The breach was reported to have occurred on the dark web, prompting SBI to notify affected customers and assure them that their funds remain secure. The bank has activated its cyber incident response procedures and is working with an independent cybersecurity agency to investigate the incident. SBI may file a claim under its cyber insurance policy with Oriental Insurance, which has a coverage limit of 1,425 crores. The exposed data includes names, mobile numbers, email addresses, dates of birth, and residential addresses. SBI has advised customers to remain vigilant against potential phishing attempts and to follow safe digital banking practices.
Breach · 2 sources · score 51
New on leak sites
33 victims listed on ransomware leak sites by 10 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-112866, CVE-2026-105265, CVE-2026-107861
- Campaigns: Bitcoin Red Team
- Malware: Blik
- Vulnerabilities: Blind SQLi, CitrixBleed 2
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.