Critical CVE-2026-103110 in Pexip Infinity Scores CVSS 9.8

🚨 ACTIVE EXPLOITATION

• ShinyHunters suspect arrested in the Netherlands
  A suspect linked to the ShinyHunters extortion group has been arrested in the Netherlands.
  • A suspect tied to the ShinyHunters data extortion group was arrested in the Netherlands.
  • The arrest was reported in Risky Business News episode 617, presented by Catalin Cimpanu.
  • The same bulletin also covered an Apple iOS zero-day fix, mass exploitation of recent Citrix zero-days, and NVIDIA's new AI sandboxing platform.
  Sources 📎 Coverage: risky.biz · 👁 via Risky Business News

🔓 CVEs & KEV

• CVE-2026-103110 — Pexip Infinity — CVSS 9.8 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper...

• CVE-2026-103105 — Pexip Infinity — CVSS 8.8 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper...

• CVE-2026-86134 — WatchGuard Fireware OS — CVSS 8.7 — Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial ...

• CVE-2026-103102 — Pexip Infinity — CVSS 8.6 — Pexip Infinity before 41.0 is affected by improper input validation in the si...

• CVE-2026-103101 — Pexip Infinity — CVSS 8.6 — Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input va...

• CVE-2026-84782 — OpenSSL — CVSS 8.2 — OpenSSL Fixes High-Severity Flaw That Can Leak Server Memory in Plaintext

• CVE-2026-103106 — Pexip Infinity — CVSS 7.8 — Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by imprope...

• CVE-2026-103109 — Pexip Infinity — CVSS 7.7 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper...

• CVE-2026-103108 — Pexip Infinity — CVSS 7.5 — Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by imprope...

• CVE-2026-103104 — Pexip Infinity — CVSS 7.5 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper...

• CVE-2026-103100 — Pexip Infinity — CVSS 7.5 — Pexip Infinity before 40.1 is affected by improper input validation in the si...

• CVE-2026-103099 — Pexip Infinity — CVSS 7.5 — Pexip Infinity before 41.1 is affected by improper input validation in the me...

📋 ADVISORIES

• OpenAI Launches Codex Security Cloud, an Always-On Application Security Service
  OpenAI has launched Codex Security Cloud, a cloud-hosted always-on application security service that scans repositories and prepares fixes for review.
  • Available as a research preview for ChatGPT Pro, Business, Enterprise, and Edu users via a plugin in Codex on desktop and web.
  • Scans entire GitHub repositories, continuously monitors new commits, and builds a project-specific threat model on the initial scan.
  • Validates candidate vulnerabilities in an isolated environment, deduplicates findings, and prepares proposed patches for human review.
  • Includes default access to cyber-capable Daybreak Blue models for defensive work, but only within the Cloud product.
  • Cloud execution allows scheduled assessments and commit checks to run even when a developer's laptop is closed.
  Sources 📄 Source: help.openai.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

• 📄 Source for Octopus Server flaw (CVE-2026-101169) lets authenticated users run code via insecure JSON deserialization — advisories.octopus.com