Two CVE records for Dify, the open-source LLM app development platform from LangGenius, were published on 5 October 2026 from its GitHub advisories. GHSA-8235-vv5j-mmvg (CVE-2026-105762, CVSS 3.1 8.3): before 1.13.0, the /console/api/remote-files/upload endpoint took an attacker-supplied URL without authentication and made the Dify server fetch it, so a remote attacker could use the server to send requests to internal services or cloud metadata endpoints and as a network pivot. GHSA-ccrj-frp2-c945 (CVE-2026-105761, 7.1): before 1.16.0, the PUT endpoint for an app's MCP server looked up the server by a client-supplied ID without checking that it belonged to that app and tenant, so an authenticated workspace member could change another app's MCP server status and settings, potentially redirecting data or disabling the service. The advisories do not report exploitation. (sources: Dify GitHub security advisories; CVE records)
Dify GHSA-8235-vv5j-mmvg — Unauthenticated SSRF in /console/api/remote-files/upload (CVE-2026-105762)
MediaTek published its October 2026 Product Security Bulletin on 5 October 2026, covering 31 vulnerabilities in its smartphone, tablet, IoT and automotive chipsets: 2 Critical, 9 High and 20 Medium. The two Critical bugs, CVE-2026-20519 and CVE-2026-20520, are out-of-bounds writes in the modem firmware caused by missing bounds checks; the CVE records say a device that connects to a rogue base station controlled by an attacker could suffer remote escalation of privilege with no user interaction and no extra execution privileges. Both affect a long list of 4G/5G modem chipsets (including the MT68xx and MT69xx Dimensity families and MT87xx/MT88xx parts) and were found internally. The High-rated issues include more modem out-of-bounds writes (for example CVE-2026-20526, which needs user interaction), out-of-bounds writes in the video decoder and encoder (CVE-2026-20586, CVE-2026-20589), a stack overflow in the Video HAL (CVE-2026-20521), and flaws in the NeuroPilot and APU AI-accelerator components. MediaTek says device makers received the patches at least two months before publication and that it is not aware of active exploitation. End users get the fixes only through their phone or tablet maker's security update, which often lands with or after the matching Android monthly patch.
MediaTek — Product Security Bulletin, October 2026 (published 5 Oct 2026)
Fortbridge published a working exploit chain on 5 October 2026 that turns an ordinary WordPress Media Library upload into code execution on the web server. WordPress hands uploaded HEIC images to ImageMagick, which decodes them with libheif. The chain first uses the derived-item and pixel-plane out-of-bounds read in libheif advisory GHSA-2jg2-4ch7-h545 (fixed in 1.23.2) to leak library and heap addresses through the JPEG thumbnails WordPress generates, then triggers the heap overflow in GHSA-x8r2-mggj-j6wr, a flaw in libheif's uncompressed (unci) decoder when the two chroma channels declare different bit depths, to hijack a C++ virtual call and run commands as the www-data PHP-FPM account. It needs a logged-in user with the upload_files capability (Author or higher by default); Fortbridge did not test guest uploads and validated it only on two exact Ubuntu and Debian stacks (6 of 8 and 22 of 24 runs succeeded). The libheif advisory, credited to Alex Thomas of Wordfence working with an agentic AI assessment framework, rates the overflow Critical (CVSS 3.1 9.8) and has no CVE yet. This is lab research, not an observed campaign. (source: Cyber Security News)
Fortbridge — WordPress libheif RCE research (5 Oct 2026)
AhsayCBS is the central management console for Ahsay's cloud backup software, used mainly by managed service providers (MSPs) and system integrators. Two flaws were published on 4 October 2026 (CNA VulDB, with public exploit code): CVE-2026-105133, an authentication bypass in the checkSysPwd function of the API (CVSS 3.1 7.3), and CVE-2026-105134, an OS command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do (CVSS 3.1 10.0, CVSS 4.0 9.3), where a random token can stand in for valid credentials. The CVE records list versions up to 10.3.2 and point to 10.3.4 as the fix, but Huntress said on 8 October that 10.3.4 is also vulnerable and that it has told Ahsay. Huntress first saw exploitation at 23:20 UTC on 7 October and had seen five organisations targeted by 8 October: attackers chained the two bugs to run code as NT AUTHORITY\SYSTEM, set up a malicious replication receiver, dropped a JSP webshell into the CBS web directory, ran reconnaissance, installed XMRig cryptominers disguised as Microsoft Edge, kept them running with a renamed NSSM service posing as Edge Update, loaded the vulnerable WinRing0x64.sys driver, and added an apparently AI-written PowerShell script that closes Task Manager if it stays open overnight. (sources: Huntress; SecurityWeek) UPDATE 14–15 October: Ahsay published an updated critical security alert saying its earlier patches, v9.15.2.59 and v10.3.4.0, did not fully fix CVE-2026-105133 and CVE-2026-105134. Partners on v10 should apply the AhsayCBS v10.3.4.45 hotfix and partners on v7, v8 or v9 the v9.15.2.70 hotfix (both behind the partner portal), then reboot the server. Huntress says it independently verified that 10.3.4.45 blocks the initial entry point of the attack chain. CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 14 October with a 17 October deadline for US federal agencies.
Huntress — Threat actors exploit critical AhsayCBS flaws to drop webshells and XMRig cryptominer (8 Oct 2026, updated 8 Oct 6pm ET)
Have I Been Squatted researchers Ian Muscat and Leanne Briffa published research on 3 October 2026 showing two edge cases in the internationalised domain name (IDN) spoofing checks used by Chromium-based browsers such as Chrome and Edge. First, Chromium's whole-script confusable check only shows the encoded Punycode form when every character in a single-script Cyrillic label is on its list of Latin lookalikes; Cyrillic ө (a Kazakh, Mongolian and Tatar letter) is not on the list, so аррӏө.com, a lookalike of apple.com that Verisign's .com Cyrillic table allows to be registered, displays in Unicode. Other 'breaker' characters such as ү also work. Second, the top-domain comparison reduces names to a 'skeleton', but a hooked letter such as ƙ, and the bar on ө, survive as combining marks, so oƙta.com does not reduce to okta.com and no match is found. Chromium's navigation-time Safety Tips only fire for matches within one edit and for targets of five or more characters, so short brands such as Okta, Nike, Sky and VK get no near-match protection. The researchers registered 20 lookalike domains (including Cyrillic versions of openai.com, skype.com, sharepoint.com, shell.com and kaspersky.com) and say all showed in Unicode in the Chrome 154 address bar with valid certificates. They found 161,894 lookalike pairs among 733,509 IDNs in the .com zone, which are possible imitations, not confirmed typosquats. In webmail tests Gmail showed all 20 IDN sender domains in Unicode, while Outlook Web showed all of them as Punycode, even harmless ones. Chromium added one more Cyrillic character (м) to its list on 11 September, after Chrome 155 branched; earlier, Chrome 148 closed the ҏ and ӿ breakers. No CVE or Google fix for ө or ƙ has been announced, and no in-the-wild abuse is reported in the research. (source: The Register)
Have I Been Squatted — Turning IDN edge cases into typosquats (3 Oct 2026)
NVD record CVE-2026-71885 (published 3 October 2026; CNA CVSS 4.0 9.2 Critical; CWE-287 / CWE-295) and the Legion of the Bouncy Castle advisory page: the Messaging Layer Security (MLS, RFC 9420) implementation in Bouncy Castle for Java before 1.86 never tied an X.509 credential to the LeafNode signature_key. LeafNode.verify() checked the leaf's signature against the key carried in the leaf itself, and the credential's certificate chain was stored but never parsed or compared, so RFC 9420 section 5.3's binding was not enforced. A party could present someone else's certificate as its credential and sign the leaf and KeyPackage with an unrelated key, and be accepted under that person's identity. Where a deployment publishes GroupInfo and the ratchet tree for external joins and passes external commits to Group.handle() without its own credential-admission check, an unauthenticated attacker could join as the victim, evict them, derive the current epoch, read later group messages, and send messages accepted as the victim. Deployments using only basic credentials are unaffected. Fixed in 1.86 (commit 77632a57ed; bcmls-jdk18on 1.86 on Maven Central): the leaf is rejected unless the end-entity certificate's public key equals signature_key; chain and identity validation to a trust anchor remain the application's job. Credit: Joshua Rogers and Khaled Suliman (AISLE Research). No exploitation reported; no Australian-specific notice found.
Update 16 Oct: the guest-to-host escape Vercel's CEO confirmed on 3 October now has a CVE and a public write-up. Researcher Paulos Yibelo of pwn.ai published 'PwnEscape' on 15 October and the Linux kernel CNA assigned CVE-2026-99999, rated 9.3 Critical (CVSS 3.1, local attack vector, scope changed); NVD had received but not yet analysed it. The bug is not in KVM or Firecracker but in the host kernel's IPv4 networking code: checksum metadata supplied by a guest could point into the IPv4 header, so skb_checksum_help could rewrite the header after the kernel had already validated it. Vercel's own findings post (14 Oct) says the host-memory leak was demonstrated against its production Sandbox: each packet a guest sent could carry back about 32 bytes of host memory, repeatably. Crashing the host with two crafted packets and getting root on the host were shown only on the researcher's own machines built to match Vercel's; he stresses this is not a claim of root in any provider's production. Vercel says no report showed anyone reading customer files, secrets or app data, and called it the challenge's only Critical finding. The fix is a single commit (6785011f8b16) by Red Hat's Michael S. Tsirkin, which its author calls a defence-in-depth check; fuller input validation is still being worked on. An attacker must already run code inside a guest. pwn.ai says the research used its Omega-Pwn harness with an AI model as the main reasoning engine. Earlier reporting (Rauch X post 3 Oct, Tech Insider and CSN 4 Oct) said Vercel paid US$50,000. UPDATE (20 Oct): Red Hat rates CVE-2026-99999 Important, CVSS 3.1 8.8 (it scores privileges required as low, unlike the CNA's 9.3), lists every tracked RHEL stream from 6 to 10 (kernel and kernel-rt), RHEL for NVIDIA and OpenShift 4 CoreOS as affected with fixes still in progress, and says no acceptable mitigation exists. WA's Cyber Security Unit issued advisory 20261019001 on 19 October and has seen no exploitation on WA Government networks. (sources: pwn.ai write-up; Vercel) UPDATE (29 Oct 2026): Red Hat has now shipped fixed kernels. Its CVE page lists RHEL 10 first (RHSA-2026:85321, released 06:09 on 20 October, Perth time), then RHEL 9 (RHSA-2026:86033, 21 October), RHEL 8 (RHSA-2026:89083, 25 October), RHEL 7 extended lifecycle support (22 October), RHEL 6 extended lifecycle support (28 October) and OpenShift Container Platform 4.12 to 4.22 CoreOS (27 to 28 October), along with EUS, SAP and NVIDIA streams. This supersedes the 20 October line saying fixes were still in progress. (source: Red Hat) UPDATE (29 Oct 2026; Red Hat and CISA KEV): Red Hat's CVE page, read on 29 October, says: 'Red Hat tracks this flaw as a KEV active-exploit case.' (source: Red Hat) CVE-2026-99999 is not in CISA's Known Exploited Vulnerabilities catalog as of 28 October 2026 (catalog version 2026.10.28). (source: CISA KEV) Correction (29 Oct 2026): an earlier version stated in the present tense that there is no known in-the-wild use of this flaw. (source: Red Hat; CISA KEV) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: pwn.ai; Vercel; Red Hat)
pwn.ai — PwnEscape: guest-to-host KVM escape (CVE-2026-99999) (15 Oct 2026); fix: Linux commit 6785011f8b16
Citrix Security Bulletin CTX697174 (published 3 Oct 2026; re-verified 5 Oct) assigns CVE-2026-88779 to the NetScaler SAML authentication crash/DoS tracked separately from CVE-2026-88771/88772. Description: memory overflow (CWE-119) leading to denial of service when NetScaler ADC or Gateway is configured as a SAML SP or SAML IdP. CVSSv4 base 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). Affected: NetScaler ADC/Gateway 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; ADC FIPS before 14.1-73.41 FIPS; ADC FIPS/NDcPP before 13.1-37.282. Patch to: 14.1-73.41+, 13.1-64.28+, 14.1-73.41 FIPS+, 13.1-37.282+. CISA added CVE-2026-88779 to KEV on 4 Oct 2026 (due 7 Oct; forensic triage Yes; BOD 26-04). ASD's ACSC Critical alert (last updated 3 Oct) already flagged the SAML issue as separate from 88771/88772 and reported impacts to Australian organisations — confirm whether SAML Gateway/AAA config is present, apply CTX697174 builds, preserve ns.log/core/support bundle if crashed, and report to ASD's ACSC if impacted. Press context (Cryptika/Heise 3 Oct): nsaaad crashes and pitboss reboots under crafted SAML traffic after 14.1-73.37 / 13.1-64.23. Distinct /n/citrix-netscaler-unpatched-rce-20260926 covers 88771/88772. Citrix credits JPMorgan Chase, Bishop Fox and watchTowr. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Citrix) Correction (03 Nov 2026): removed SecurityWeek as a source; removed details no other source gives. (source: Citrix)
Citrix Security Bulletin CTX697174 — CVE-2026-88779 NetScaler SAML memory-overflow DoS (3 Oct 2026)
IBM, which now acts as CVE numbering authority for Langflow OSS, published security bulletin 7290694 on 2 October 2026 covering 25 vulnerabilities in Langflow 1.0.0 through 1.12.2, the open-source visual builder for AI agents and workflows. The CVE records went public on 6 and 7 October. The two worst, CVE-2026-104334 (code injection) and CVE-2026-93674 (OS command injection), are rated 9.8 by IBM and need no login. Most of the rest need an authenticated user, which in Langflow usually means anyone who can build flows: several sandbox escapes and code-security-scanner bypasses that run code on the server (CVE-2026-97676, 97678, 97673, 97655, 97679, 88962, all 8.8), an OS command injection (CVE-2026-97674, 8.1), path traversal that writes files anywhere the service account can and reads configuration, secrets or database files (CVE-2026-97677, 8.1; CVE-2026-103360, 8.1), cross-user access to cached component results (CVE-2026-97680, 8.3), poorly protected stored credentials (CVE-2026-101331, 7.7), authorization bypasses (CVE-2026-93678, 7.6) and a ZIP extraction denial of service (CVE-2026-93679, 4.3). IBM lists no workarounds. This is a separate set from the Langflow MCP stdio flaws already on Cyberstack (fixed in 1.10.3), so a 1.10.3 install is still exposed. IBM does not report exploitation, but earlier Langflow code-injection flaws were exploited within days of disclosure. (source: IBM)
IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (2 Oct 2026)
AWS Security Bulletin 2026-125-AWS (Important; published 2 October 2026 PDT) and Amazon CNA CVE-2026-104019 disclose OS command injection (CWE-78) in the Studio Space startup validation script in Amazon SageMaker Distribution when used with Amazon SageMaker Unified Studio. On Space startup the script network-validates available SageMaker connections in a project; improper sanitization of connection details can let an authenticated project contributor (or higher) execute arbitrary commands in another project member’s Studio Space. With Trusted Identity Propagation enabled, that can yield the peer’s temporary execution-role credentials and calls to TIP-enabled AWS services on their behalf. CVSS 4.0 9.3 Critical (Amazon CNA; also CVSS 3.1 9.0). Fixed images: 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, 4.4.3; 4.5.x not affected; 2.8–2.13 and 3.3–3.8 EOL with no fix — move to a supported minor. AWS says the fix is deployed globally; Unified Studio Spaces pick up the latest patch of their minor line on restart (no version picker). No workarounds; no exploitation reported in the bulletin. (sources: AWS 2026-125-AWS; GitHub Advisory GHSA-w64x-664p-7w66)
AWS Security Bulletin 2026-125-AWS — SageMaker Distribution CVE-2026-104019 (2 Oct 2026)
AWS Security Bulletin 2026-124-AWS (Important; published 2 October 2026 PDT) covers three issues in Loom for AWS (AWS Labs open-source AI agent orchestration). CVE-2026-103956 (CVSS 4.0 10.0 / CVSS 3.1 10.0 Critical; CWE-306/1188): before 1.6.1, in deployments with no identity provider configured, any network client could obtain full administrative authority over the agent control plane — register tool servers, read stored integration credentials, rewrite IAM role policies on managed agent roles — via any application API request. Fixed in 1.6.1 (released 4 Aug 2026). CVE-2026-103957 (CVSS 4.0 8.2 High): before 1.7.0, authenticated mcp:write/a2a:write users could abuse OAuth2 discovery so the backend sent client secrets or another user’s access token to a third-party endpoint (1.6.1 blocked internal-address reach but not full token disclosure). CVE-2026-103958 (CVSS 4.0 8.3 High): before 1.7.0, same scopes could SSRF connection requests to internal locations including the container credential endpoint and read responses. Upgrade to 1.7.0; until then configure Cognito/external IdP before non-loopback exposure, leave LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV unset in deployed envs, and restrict mcp:write/a2a:write to trusted admins. After upgrade: rotate OAuth2 client secrets, revoke/reissue tokens, and if container role credentials may have been accessed rotate IAM session credentials and review CloudTrail. Acknowledgement: Kenneth Cox. No exploitation claimed in the bulletin. (source: AWS 2026-124-AWS)
AWS Security Bulletin 2026-124-AWS — Loom for AWS CVE-2026-103956/103957/103958 (2 Oct 2026)
Microsoft re-released the September 2026 Exchange Server security updates on 2 October 2026 as V2 solely to add CVE-2026-96940 (CVSS 3.1 8.8; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): weak authorisation allowing an authenticated attacker to elevate privileges over the network and gain unauthorised access to other users’ mailboxes (messages and attachments) within the same organisation — not across tenant boundaries. Microsoft discovered the flaw internally; MSRC lists it as not publicly disclosed and not exploited, with exploitation more likely. Anyone who installed the original September SU still needs the V2 package. Fixed builds/KBs (Security Update Guide / coverage): Exchange Server Subscription Edition RTM KB5129955 build 15.02.2562.053; Exchange 2019 CU15 KB5129956 15.02.1748.053; Exchange 2019 CU14 KB5129957 15.02.1544.048; Exchange 2016 CU23 KB5129958 15.01.2507.075. Exchange Online already protected; hybrid and Exchange Management Tools hosts must still patch on-prem. 2016/2019 fixes require Period 2 ESU (May–Oct 2026); otherwise migrate to SE. (sources: MSRC CVE-2026-96940; CybersecurityNews)
Microsoft MSRC — CVE-2026-96940 Exchange Server Elevation of Privilege (2 Oct 2026)
