Daily digest,
Critical Path Traversal Vulnerability in Google Cloud MCP Toolbox (+2 more)
Vulnerabilities
Critical Path Traversal Vulnerability in Google Cloud MCP Toolbox
A critical vulnerability, CVE-2026-93328, was disclosed in Google Cloud's MCP Toolbox for Databases, affecting versions 1.2.0 to 1.4.0. The flaw allows unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite local files through crafted parameters. The vulnerability has a CVSS score of 9.3, indicating its critical nature. Google has released a patch, but the default settings of the tool still allow for potential exploitation if not properly configured. The vulnerability was first publicly demonstrated on October 27, 2026, just a day after its publication. Security professionals are urged to upgrade to versions beyond 1.4.0 and configure the necessary allowlists to mitigate risks.
Vulnerability · 2 sources · score 73 · CVE-2026-93319, CVE-2026-93320, CVE-2026-93321, CVE-2026-93322, CVE-2026-93323
GitLab CVE-2026-110264: Critical RCE Flaw Patched
GitLab released emergency patches for CVE-2026-110264 on October 21, 2026, addressing a critical remote code execution vulnerability in its regular expression compiler. The flaw, which has a CVSS score of 10.0, allows unauthenticated attackers to execute arbitrary code on self-managed servers. This vulnerability affects all self-managed GitLab Community and Enterprise Editions since version 7.0, released in 2014. GitLab backported the fix to seven branches, including 19.5.1, which was released just six days after the previous version. The researcher Johan Carlsson reported this vulnerability through GitLab's HackerOne bug bounty program. GitLab.com is not affected as it runs the patched code, leaving self-hosted instances at risk. This incident follows another critical vulnerability (CVE-2026-97229) disclosed just ten days earlier, indicating a concerning trend in the GitLab CI/CD regex compiler.
Vulnerability · 2 sources · score 72 · CVE-2026-110264, CVE-2026-112212, CVE-2026-15723, CVE-2026-85706, CVE-2026-97229
Black October: Surge in Cybersecurity Vulnerabilities and Attacks
October 2026 has seen a dramatic increase in cybersecurity vulnerabilities, with reports of over 10,740 vulnerabilities disclosed in August alone, doubling from earlier months. This surge has been termed 'Black October' due to numerous significant cyberattacks across various sectors, including government, education, and finance. Notably, two critical vulnerabilities in PHP were revealed on October 21, affecting over 70% of the internet's web pages. Security researchers had previously identified these vulnerabilities using AI tools from OpenAI, but they were not patched in time, leading to widespread exploitation. Reports indicate that AI agents are being used in unauthorized ways within customer accounts at major banks, raising alarms about rogue AI activity. The situation has prompted urgent discussions among business leaders regarding the implications of emerging AI technologies on cybersecurity.
Other Threats · 2 sources · score 66
New on leak sites
39 victims listed on ransomware leak sites by 12 groups in the 24 hours before this issue. The most active:
Also moving
- Malware: Pegasus, Armorsteal, Cobalt Strike
- CVEs: CVE-2026-102870, CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-112626
- Vulnerabilities: HTTP2Shell, Node2Shell, OS Command Injection, Arbitrary File Read, BOLA
- Ransomware groups: The Gentlemen, Akira, Cl0p
- Campaigns: AdFection, Atlantic Bastion, Be Ready, Black October, Blue Initiative
- APT groups: Candiru, Charming Kitten
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.