Cyber Hose

In this digest

• Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
• Multiple VLC Media Player Vulnerabilities Allow Attackers to Corrupt or Read Heap Memory
• Magento StyleSmuggler RCE: Report Poisoning to Code Execution

In this digest

• CVE-2026-90553 — vLLM Remote Code Execution via LlavaOnevision2 processor
• CVE-2026-90555 — vLLM Denial of Service via Audio Header
• CVE-2026-90554 — vLLM Denial of Service via audio extraction

In this digest

• CVE-2026-78159 — The Events Calendar through 6.17.3 Unauthenticated Code Injection to RCE
• CVE-2026-78006 — The Events Calendar through 6.17.4 Unauthenticated PHP Object Injection to RCE

In this digest

• GitLab Unauthenticated Arbitrary File Read (CVE-2026-85706)
• WPBot WordPress plugin before 8.6.0 leaks chat visitor PII to unauthenticated attackers (CVE-2026-87916)
• Rox Appointment Booking WordPress plugin before 1.2.0 vulnerable to unauthenticated price manipulation

In this digest

• OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE
• GitLab EE Critical Credential Disclosure via GraphQL

In this digest

• Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems
• Deserialization of Untrusted Data in GitLab (CVE-2026-87719)
• QloApps through 1.7.0 vulnerable to reflected XSS in back-office list filter parameters (CVE-2026-89268)

In this digest

• Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says
• Memory Integrity to expand to all Windows Operating Systems (Oct 2026)
• stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands

In this digest

• Palo-Alto are calling resellers and asking them to call customers to tell them to update their Palo-Alto PA and VM...
• OpenStack Ironic through 38.0.0 may send a username and password to an unexpe...
• GetSimple CMS: Unauthenticated Admin Account Creation (CVE-2026-53952)

In this digest

• Hackers abused Claude to extract secrets from 1.8M Android apps
• KEV: CVE-2026-85706 — GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
• Suspected TLS downgrade attack on Edmonton airport's free WiFi

In this digest

• Florida DMV's DAVID database breached using stolen police credentials
• GitLab's critical flaw is already drawing internet-wide probes
• Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks