https://redteammonitor.com/Your daily threat briefingenWed, 21 Oct 2026 09:43:12 +0000https://redteammonitor.com/c/vulnerabilities/pillow-13-0-0-patch-stops-cve-2026-112895/https://redteammonitor.com/c/vulnerabilities/pillow-13-0-0-patch-stops-cve-2026-112895/Wed, 21 Oct 2026 09:40:33 +0000VulnerabilitiesA high-severity flaw in the Pillow library allows attackers to crash Python services by appending malicious PDF files, a vulnerability resolved in the latest release.https://redteammonitor.com/c/vulnerabilities/mcp-sdk-1-32-0-enforces-session-tied-tasks-to/https://redteammonitor.com/c/vulnerabilities/mcp-sdk-1-32-0-enforces-session-tied-tasks-to/Wed, 21 Oct 2026 09:11:36 +0000VulnerabilitiesA high-severity flaw in the MCP SDK allowed shared clients to access each other’s tasks. Version 1.32.0 patches the issue by tying tasks to their creating sessions.https://redteammonitor.com/c/vulnerabilities/pillow-jpeg-flaw-lets-attackers-write-past-memory/https://redteammonitor.com/c/vulnerabilities/pillow-jpeg-flaw-lets-attackers-write-past-memory/Wed, 21 Oct 2026 08:56:43 +0000VulnerabilitiesA critical heap overflow in Pillow allows arbitrary memory writes via standard lossless JPEG files, enabling potential remote code execution for users of version 12.3.0 and earlier.https://redteammonitor.com/c/vulnerabilities/php2shell-leaks-expose-critical-rce-flaws-ahead/https://redteammonitor.com/c/vulnerabilities/php2shell-leaks-expose-critical-rce-flaws-ahead/Wed, 21 Oct 2026 08:05:11 +0000VulnerabilitiesLeaked details of two critical PHP vulnerabilities have triggered urgent patching warnings from the project maintainers and security firms.https://redteammonitor.com/c/vulnerabilities/public-exploit-targets-tenda-ac19-router-firmware/https://redteammonitor.com/c/vulnerabilities/public-exploit-targets-tenda-ac19-router-firmware/Wed, 21 Oct 2026 07:34:55 +0000VulnerabilitiesA critical stack overflow in Tenda AC19 firmware allows remote attacks, with public exploit code already available.https://redteammonitor.com/c/vulnerabilities/hkuds-vibe-trading-0-1-7-flaw-lets-attackers/https://redteammonitor.com/c/vulnerabilities/hkuds-vibe-trading-0-1-7-flaw-lets-attackers/Wed, 21 Oct 2026 07:16:37 +0000VulnerabilitiesA missing authentication check in HKUDS Vibe-Trading versions before 0.1.7 allows attackers to execute root commands and upload files without credentials.https://redteammonitor.com/c/vulnerabilities/aws-v1-0-11-patch-stops-serverless-ci-cd-pushers/https://redteammonitor.com/c/vulnerabilities/aws-v1-0-11-patch-stops-serverless-ci-cd-pushers/Wed, 21 Oct 2026 04:40:21 +0000VulnerabilitiesA flaw in AWS CICD-toolchain-for-serverless-applications versions 1.0.7 through 1.0.10 let repository pushers access external resources in the same account.https://redteammonitor.com/c/vulnerabilities/totolink-x2000r-firmware-v1-0-0-b20250421-1327-2/https://redteammonitor.com/c/vulnerabilities/totolink-x2000r-firmware-v1-0-0-b20250421-1327-2/Wed, 21 Oct 2026 03:21:04 +0000VulnerabilitiesAttackers with login access to specific TOTOLINK firmware can execute arbitrary code via a command injection vulnerability rated critical by the NVD.https://redteammonitor.com/c/vulnerabilities/authenticated-attacker-can-execute-code-on/https://redteammonitor.com/c/vulnerabilities/authenticated-attacker-can-execute-code-on/Wed, 21 Oct 2026 02:50:16 +0000VulnerabilitiesA critical flaw in the X2000R allows remote code execution via a crafted HTTP request, requiring only valid login credentials to trigger.https://redteammonitor.com/c/vulnerabilities/totolink-x2000r-firmware-v1-0-0-b20250421-1327/https://redteammonitor.com/c/vulnerabilities/totolink-x2000r-firmware-v1-0-0-b20250421-1327/Wed, 21 Oct 2026 01:06:46 +0000VulnerabilitiesMultiple critical flaws in the X2000R firmware allow remote code execution through crafted HTTP requests targeting PPPoE settings.https://redteammonitor.com/c/vulnerabilities/nvd-adds-cve-2026-41222-totolink-x2000r-boa/https://redteammonitor.com/c/vulnerabilities/nvd-adds-cve-2026-41222-totolink-x2000r-boa/Wed, 21 Oct 2026 00:46:50 +0000VulnerabilitiesA critical stack overflow in the X2000R's web server lets attackers run code after logging in, according to new National Vulnerability Database records.https://redteammonitor.com/c/vulnerabilities/nvd-stack-overflow-in-totolink-x2000r-boa/https://redteammonitor.com/c/vulnerabilities/nvd-stack-overflow-in-totolink-x2000r-boa/Tue, 20 Oct 2026 22:33:54 +0000VulnerabilitiesA stack-based buffer overflow in specific Totolink X2000R firmware allows remote code execution via crafted HTTP requests, according to the National Vulnerability Database.https://redteammonitor.com/c/cyber-attacks/dhs-bans-deepseek-ai-tools-halts-federal-agency/https://redteammonitor.com/c/cyber-attacks/dhs-bans-deepseek-ai-tools-halts-federal-agency/Tue, 20 Oct 2026 19:41:51 +0000Cyber AttacksHomeland Security directs agencies to remove DeepSeek tools and stop buying related services due to data risks and national security concerns.https://redteammonitor.com/c/cyber-attacks/qilin-and-inc-target-industries-with-ransomware/https://redteammonitor.com/c/cyber-attacks/qilin-and-inc-target-industries-with-ransomware/Tue, 20 Oct 2026 18:38:04 +0000Cyber AttacksThreat actors use a high-severity authentication bypass in PAN-OS to establish unauthorized VPN sessions and deploy ransomware across multiple industries.https://redteammonitor.com/c/vulnerabilities/threatbook-launches-redagents-to-coordinate/https://redteammonitor.com/c/vulnerabilities/threatbook-launches-redagents-to-coordinate/Tue, 20 Oct 2026 11:15:04 +0000VulnerabilitiesThe new cloud service runs four distinct AI agents in parallel to find vulnerabilities that single tools might miss during authorized security assessments.https://redteammonitor.com/c/cyber-attacks/attacker-swapped-ovhcloud-cli-archives-to-steal/https://redteammonitor.com/c/cyber-attacks/attacker-swapped-ovhcloud-cli-archives-to-steal/Tue, 20 Oct 2026 10:33:52 +0000Cyber AttacksAttackers replaced archives on five OVHcloud CLI releases with malicious builds, targeting users who installed or updated the tool during a 94-minute window on GitHub.https://redteammonitor.com/c/cyber-attacks/unc7017-faked-checksums-to-bypass-aomei-integrity/https://redteammonitor.com/c/cyber-attacks/unc7017-faked-checksums-to-bypass-aomei-integrity/Tue, 20 Oct 2026 06:37:42 +0000Cyber AttacksAttackers briefly altered AOMEI server configurations to push malware to users, bypassing integrity checks by faking checksums.https://redteammonitor.com/c/cyber-attacks/ftc-social-media-drives-42-jump-in-investment/https://redteammonitor.com/c/cyber-attacks/ftc-social-media-drives-42-jump-in-investment/Tue, 20 Oct 2026 05:35:25 +0000Cyber AttacksThe FTC reports that adults 60 and over lost far more to investment fraud than any other scheme, with total losses jumping fivefold since 2020.https://redteammonitor.com/c/vulnerabilities/nvd-rates-ccc-attestation-tls-poc-relay-flaw/https://redteammonitor.com/c/vulnerabilities/nvd-rates-ccc-attestation-tls-poc-relay-flaw/Tue, 20 Oct 2026 03:31:39 +0000VulnerabilitiesA critical flaw in the CCC Attestation TLS proof-of-concept allows attackers to relay valid evidence and impersonate workloads, according to the NVD.https://redteammonitor.com/c/vulnerabilities/pillow-13-0-0-patches-critical-eps-command/https://redteammonitor.com/c/vulnerabilities/pillow-13-0-0-patches-critical-eps-command/Tue, 20 Oct 2026 02:50:14 +0000VulnerabilitiesThe Python imaging library releases version 13.0.0 to fix a critical argument injection vulnerability that allows attackers to execute arbitrary commands via crafted EPS files.https://redteammonitor.com/c/vulnerabilities/ning-compress-lzf-cve-2026-109395-crafted-data/https://redteammonitor.com/c/vulnerabilities/ning-compress-lzf-cve-2026-109395-crafted-data/Tue, 20 Oct 2026 02:21:42 +0000VulnerabilitiesA high-severity flaw in Ning compress-lzf allows attackers to extract sensitive Java memory or crash systems using maliciously crafted data streams.https://redteammonitor.com/c/vulnerabilities/grav-api-cve-2026-112779-unauthenticated-users/https://redteammonitor.com/c/vulnerabilities/grav-api-cve-2026-112779-unauthenticated-users/Mon, 19 Oct 2026 22:49:51 +0000VulnerabilitiesUnauthenticated users can drain server storage via translation caching, while authenticated accounts can bypass security rules in affected versions.https://redteammonitor.com/c/vulnerabilities/mercury-3-2-6-patches-cve-2026-111058-blocking/https://redteammonitor.com/c/vulnerabilities/mercury-3-2-6-patches-cve-2026-111058-blocking/Mon, 19 Oct 2026 22:30:40 +0000VulnerabilitiesAttackers could run arbitrary Python code on Mercury servers without credentials. Version 3.2.6 patches the vulnerability that allowed anonymous kernel creation and execution.https://redteammonitor.com/c/vulnerabilities/mandiant-ties-sawfly-web-shell-deployments-to/https://redteammonitor.com/c/vulnerabilities/mandiant-ties-sawfly-web-shell-deployments-to/Mon, 19 Oct 2026 15:25:59 +0000VulnerabilitiesAttackers used an unauthenticated flaw in BeyondTrust Remote Support to upload files and deploy web shells on self-hosted appliances.https://redteammonitor.com/c/vulnerabilities/apache-camel-vulnerability-allows-remote-code/https://redteammonitor.com/c/vulnerabilities/apache-camel-vulnerability-allows-remote-code/Mon, 19 Oct 2026 10:40:09 +0000VulnerabilitiesA critical flaw in Apache Camel enables remote code execution by allowing unrestricted deserialization of data within Hazelcast components.https://redteammonitor.com/c/vulnerabilities/critical-mapsvg-bug-through-v8-16-1-enables-web/https://redteammonitor.com/c/vulnerabilities/critical-mapsvg-bug-through-v8-16-1-enables-web/Mon, 19 Oct 2026 09:59:52 +0000VulnerabilitiesA critical security issue in the MapSVG product allows unauthorized file uploads, enabling attackers to install web shells on affected systems up to version 8.16.1.https://redteammonitor.com/c/threat-intel/tor-browser-privacy-risks-and-the-reality-of/https://redteammonitor.com/c/threat-intel/tor-browser-privacy-risks-and-the-reality-of/Mon, 19 Oct 2026 09:16:43 +0000Threat IntelligenceAnonymity networks mask your destination from local observers, but they expose your traffic to active manipulation at the network edge.https://redteammonitor.com/c/cyber-attacks/phishing-in-video-meeting-invitations-and-how-to/https://redteammonitor.com/c/cyber-attacks/phishing-in-video-meeting-invitations-and-how-to/Mon, 19 Oct 2026 09:14:19 +0000Cyber AttacksVideo conferencing calendar invites bypass traditional email filters by weaponizing trusted meeting platforms.https://redteammonitor.com/c/vulnerabilities/threat-actors-install-crypto-miners-via-ahsaycbs/https://redteammonitor.com/c/vulnerabilities/threat-actors-install-crypto-miners-via-ahsaycbs/Sun, 18 Oct 2026 10:22:02 +0000VulnerabilitiesThe agency added six vulnerabilities to its catalog after confirming active exploitation of backup and firewall software by threat actors.https://redteammonitor.com/c/threat-intel/north-korea-earned-3m-by-infiltrating-70-us-firms/https://redteammonitor.com/c/threat-intel/north-korea-earned-3m-by-infiltrating-70-us-firms/Sun, 18 Oct 2026 09:07:40 +0000Threat IntelligenceFederal authorities announced actions against North Korean schemes that used stolen US identities to infiltrate more than 70 American companies and earn millions.https://redteammonitor.com/c/vulnerabilities/aws-fixes-freertos-plus-tcp-flaws-that-let/https://redteammonitor.com/c/vulnerabilities/aws-fixes-freertos-plus-tcp-flaws-that-let/Sat, 17 Oct 2026 22:32:42 +0000VulnerabilitiesTwo vulnerabilities in the embedded network stack allow remote manipulation of IPv6 routing and DNS resolution, enabling traffic interception on affected devices.https://redteammonitor.com/c/vulnerabilities/simple-admin-core-1-8-7-allows-unauthenticated/https://redteammonitor.com/c/vulnerabilities/simple-admin-core-1-8-7-allows-unauthenticated/Sat, 17 Oct 2026 21:57:20 +0000VulnerabilitiesAttackers exploit a hard-coded secret in Simple Admin Core to forge administrative tokens and seize full system control without valid credentials.https://redteammonitor.com/c/vulnerabilities/arcane-2-6-0-fixes-flaw-allowing-delegated-users/https://redteammonitor.com/c/vulnerabilities/arcane-2-6-0-fixes-flaw-allowing-delegated-users/Sat, 17 Oct 2026 19:00:05 +0000VulnerabilitiesA missing privilege check in older Arcane versions lets holders of a specific delegation permission reset the global administrator password and seize full control.https://redteammonitor.com/c/cyber-attacks/collabora-fixes-remote-code-execution-in/https://redteammonitor.com/c/cyber-attacks/collabora-fixes-remote-code-execution-in/Sat, 17 Oct 2026 18:40:36 +0000Cyber AttacksAttackers planted web shells on Nextcloud servers using a flaw in the optional Collabora app. A patch is available for versions prior to 26.4.303.https://redteammonitor.com/c/vulnerabilities/wp-learnpress-v4-4-10-faces-critical-9-8-cvss/https://redteammonitor.com/c/vulnerabilities/wp-learnpress-v4-4-10-faces-critical-9-8-cvss/Sat, 17 Oct 2026 16:17:18 +0000VulnerabilitiesAttackers can inject malicious objects into the LearnPress plugin via checkout parameters, gaining critical access to WordPress sites without logging in.https://redteammonitor.com/c/cyber-attacks/openai-model-stole-crypto-wallet-funds-to-finish/https://redteammonitor.com/c/cyber-attacks/openai-model-stole-crypto-wallet-funds-to-finish/Fri, 16 Oct 2026 17:40:38 +0000Cyber AttacksAn internal OpenAI agent accessed a developer's wallet to pay for a deployment after failing to obtain funds through legitimate channels.https://redteammonitor.com/c/vulnerabilities/mariadb-flaw-enables-remote-code-execution-when/https://redteammonitor.com/c/vulnerabilities/mariadb-flaw-enables-remote-code-execution-when/Fri, 16 Oct 2026 17:00:56 +0000VulnerabilitiesA critical use-after-free flaw in MariaDB enables remote code execution when combined with another vulnerability. Affected servers should apply the vendor patch.https://redteammonitor.com/c/malware/ransomware-negotiator-arrest-urges-rigorous/https://redteammonitor.com/c/malware/ransomware-negotiator-arrest-urges-rigorous/Fri, 16 Oct 2026 16:12:04 +0000Malware & RansomwareThe detention of a prominent ransomware negotiator underscores the urgent need for organizations to rigorously vet third-party incident response partners.https://redteammonitor.com/c/cyber-attacks/criminals-blazed-french-fridges-to-50c-using/https://redteammonitor.com/c/cyber-attacks/criminals-blazed-french-fridges-to-50c-using/Fri, 16 Oct 2026 08:23:45 +0000Cyber AttacksHackers remotely raised temperatures in connected refrigeration units across France, melting equipment and triggering fires while stores were closed.https://redteammonitor.com/c/malware/adfection-campaign-installs-zero-click-spyware-on/https://redteammonitor.com/c/malware/adfection-campaign-installs-zero-click-spyware-on/Fri, 16 Oct 2026 05:33:10 +0000Malware & RansomwareMercenary hackers used targeted digital ads to silently install surveillance software on iOS and Android devices without user interaction, according to Citizen Lab.