Daily digest,
Critical OS Command Injection Vulnerability Discovered in Vertiv… (+5 more)
Vulnerabilities
Critical OS Command Injection Vulnerability Discovered in Vertiv Avocent ACS8000
A critical vulnerability, CVE-2026-65184, has been identified in the Vertiv Avocent ACS8000 appliance. The flaw arises from the root-privileged `wsserver` terminal-bridge daemon, which improperly constructs shell commands from unvalidated WebSocket inputs. This allows unauthenticated attackers to execute arbitrary OS commands with root privileges remotely. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature. Currently, there is no public proof-of-concept or confirmed exploitation reported. Users are advised to update to version 2.32.5 or later and restrict network access to the affected daemon. The vulnerability was published on October 26, 2026, by multiple sources, including Feedly and Sploitus.
Vulnerability · 2 sources · score 77 · CVE-2026-113345, CVE-2026-65184, OS Command Injection
Remote Code Execution Exploit for PHP 8.4.26 Disclosed
Security researcher KillaBoi released a proof-of-concept (PoC) script, stealmybitcoin_poc.py, that exploits a vulnerability in Alpine PHP 8.4.26. The exploit targets memory exhaustion through multipart uploads, allowing attackers to recover sensitive memory addresses and execute arbitrary commands via PHP's zif_system function. The PoC script is designed to work with a specific server configuration and requires precise memory layout knowledge. It has been confirmed to successfully execute commands, including printing a nonce and the SHA-256 hash of a binary. The exploit is particularly relevant for systems running Alpine PHP 8.4.26 CLI servers behind nginx. The release of this PoC raises concerns about potential exploitation in the wild, although no has been confirmed yet. The vulnerability is significant due to the ease of execution and the specific conditions required for the exploit to succeed.
Vulnerability · 2 sources · score 52
Breaches
Cyberattack Disrupts UNM Health Services, Diverts Ambulances
On October 26, 2026, the University of New Mexico Health Sciences Center experienced a significant cybersecurity incident that led to the cancellation of all appointments and the diversion of ambulance traffic to other hospitals. The attack affected the entire UNM Health system, prompting the cancellation of classes at the School of Medicine, College of Pharmacy, College of Nursing, and College of Population Health. Hospital officials reported that the IT team took immediate steps to contain the incident and notified law enforcement. During the incident, a message was reportedly broadcast to hospital workers' computers, threatening to compromise sensitive data. By 2:30 p.m., operations began to resume in phases as systems were brought back online. Classes and outpatient services were canceled for the following day, October 27, 2026. The full scope of the attack and the specific attack vector remain under investigation.
Vulnerability · 4 sources · score 54
Lawsuit Filed Against Park24 for Data Breach Affecting 6.62 Million Accounts
A group of over 100,000 customers is set to file a lawsuit against Park24 Co., the operator of the Times Car vehicle-sharing service, following a significant data breach. The breach, disclosed in late September 2026, compromised personal information from 6.62 million accounts due to unauthorized access to the company's web system. Among the leaked data are 1.46 million images of users' identification documents, including driver's licenses. The affected customers are seeking damages of 30,000 to 50,000 yen each for emotional distress. Park24 has offered a consolation payment of 3,000 yen per person but has not commented on the impending lawsuit. The legal action is expected to be filed by the end of the year, as the lawyer, Yuki Makino, aims to hold the company accountable for its handling of personal information protection.
Breach · 2 sources · score 52
SBI Investigates Dark Web Data Exposure of Customer Records
The State Bank of India (SBI) is investigating the suspected exposure of customer data on the dark web, with 3,897 records containing personally identifiable information identified among approximately 375,000 records. The bank received alerts from its threat intelligence service provider, the Defence Cyber Agency, and CERT-In on October 16, 2026. Preliminary findings do not confirm that all records belong to SBI customers, and the investigation is ongoing to determine the authenticity and source of the data. SBI has activated its cyber incident response protocols and engaged an independent cybersecurity agency. The exposed data includes names, birth dates, and loan-related metadata, suggesting a potential link to loan-sourcing or lead-management systems rather than core banking systems. SBI has launched a cybersecurity centre, CyRIS, to enhance its digital security capabilities in response to this incident.
Breach · 3 sources · score 51
Also worth knowing
AI and Deepfakes Fueling Account Takeover Fraud
Cybercriminals are increasingly using AI and deepfake technology to facilitate account takeover attacks, as reported by Microblink. Their data indicates that 30% of fraud failures involved fake U.S. identity documents, which help criminals impersonate legitimate users. The Javelin Strategy & Research's 2026 Identity Fraud Study highlights that even partial data leaks can lead to identity theft. Traditional identity verification methods are becoming inadequate, as they assume trust remains constant over time. Microblink emphasizes the need for businesses to adapt their security measures to account for evolving fraud tactics. Meanwhile, Individual Centricity Corporation (IC-Corp) has received patent approval for a new identity verification technology designed to combat deepfake fraud by authenticating users based on their individual devices rather than centralized databases. This technology aims to enhance security by ensuring that the identity of the user remains consistent throughout interactions.
Disinfo & Influence · 2 sources · score 51
New on leak sites
61 victims listed on ransomware leak sites by 16 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-113380, CVE-2017-9841
- Malware: Baohuo, uCreator, Amadei
- Campaigns: Operation Economic Outcast
- Vulnerabilities: XSS, Brotli Flaw, Buffer overflow
- APT groups: Candiru, China APT
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.