Threat Advisories & Vulnerability Intelligence

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command (CVE-2026-109390)

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

CRITICALOctober 12, 2026

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it.

MEDIUMOctober 12, 2026

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak (CVE-2026-109082)

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user.

MEDIUMOctober 12, 2026

A flaw has been found in permission filters in the foreman package (CVE-2026-107193)

A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller’s permission.

MEDIUMOctober 12, 2026

A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak (CVE-2026-107623)

A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.

MEDIUMOctober 8, 2026

16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys. “The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to

MEDIUMOctober 8, 2026

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers (CVE-2026-33586)

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH’s default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated dom

MEDIUMOctober 7, 2026

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning (CVE-2026-97331)

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user’s email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

MEDIUMOctober 7, 2026

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress wordpress allows Retrieve Embedded Sensitive Data.This issue affects (CVE-2026-66666)

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress wordpress allows Retrieve Embedded Sensitive Data.This issue affects WordPress: from n/a through 7.1.2.

MEDIUMOctober 6, 2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforce

HIGHOctober 4, 2026

A flaw was found in 389-ds-base (CVE-2026-86345)

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client’s own pending operation’s response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.

CRITICALOctober 2, 2026

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. […]

HIGHSeptember 29, 2026

Cookie	Duration	Description
__cfduid	1 month	The cookie is used by CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information.
cookielawinfo-checkbox-advertisement	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Advertisement".
cookielawinfo-checkbox-analytics	1 year	This cookies is set by GDPR Cookie Consent WordPress Plugin. The cookie is used to remember the user consent for the cookies under the category "Analytics".
cookielawinfo-checkbox-functional	1 year	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	1 year	No description
cookielawinfo-checkbox-performance	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
pll_language	1 year	The cookie stores the language code of the last browsed page.

Cookie	Duration	Description
_clck	1 year	Used by Microsoft Clarity to store a unique user ID
_clsk		Microsoft Clarity analytics application
_ga	2 years	This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors.
_ga_L2RPNQR0FJ	2 years	This cookie is set by Google Analytics 4 to persist session state and count sessions for this property.
_gat_gtag_UA_44752404_1	1 minute	No description
_gid	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form.
_lfa	2 years	This cookie is set by the provider Leadfeeder. This cookie is used for identifying the IP address of devices visiting the website. The cookie collects information such as IP addresses, time spent on website and page requests for the visits.This collected information is used for retargeting of multiple users routing from the same IP address.
CLID	1 year	Microsoft Clarity
of.tracking	1 year
ofs
SL_C_23361dd035530_KEY		Outfunnel Campaign
SL_C_23361dd035530_SID		Outfunnel Campaign
SL_C_23361dd035530_VID		Outfunnel Campaign
SM	session	Used in synchronizing the MUID across Microsoft domains.
SRM_B	1 year 24 days	Identifies unique web browsers visiting Microsoft sites
vuid	2 years	This domain of this cookie is owned by Vimeo. This cookie is used by vimeo to collect tracking information. It sets a unique ID to embed videos to the website.

Cookie	Duration	Description
_gcl_au	3 months	This cookie is set by Google Tag Manager and Google Ads to measure how well advertising performs and to attribute conversions to ad clicks.
ANONCHK	10 minutes	This cookie is used for storing the session ID for a user. This cookie ensures that clicks from advertisement on the Bing search engine are verified and it is used for reporting purposes and for personalization.
MUID	1 year 24 days	Used by Microsoft as a unique identifier. The cookie is set by embedded Microsoft scripts. The purpose of this cookie is to synchronize the ID across many different Microsoft domains to enable user tracking.

Threat advisories that tell you what to do next

Latest threat advisories

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command (CVE-2026-109390)

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak (CVE-2026-109082)

A flaw has been found in permission filters in the foreman package (CVE-2026-107193)

A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak (CVE-2026-107623)

16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers (CVE-2026-33586)

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning (CVE-2026-97331)

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress wordpress allows Retrieve Embedded Sensitive Data.This issue affects (CVE-2026-66666)

CISA Adds One Known Exploited Vulnerability to Catalog

A flaw was found in 389-ds-base (CVE-2026-86345)

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Get in touch