Patchstack said on 8 October 2026 that attackers are exploiting CVE-2026-85097, a critical flaw in Bricksforge, a commercial add-on for the Bricks visual site builder on WordPress that adds Pro Forms, animations and dynamic data features. Bricksforge is sold outside WordPress.org, so sites will not see it in the usual plugin directory alerts. The plugin checks a file's MIME type when it is first uploaded, but on form submission it trusts the file metadata the browser sends and does not validate the 'url' field in the temporaryFileUploads parameter. Wordfence, which assigned the CVE, describes the chain: an attacker with no account gets a valid nonce from the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot that passes the image check, then submits a form whose server-side path points at the validated GIF while the url ends in .php, so the file is written as PHP and can be run. That gives full control of the site: web shells, content changes, data theft and persistence. Patchstack first saw attacks at 21:47 UTC on 7 October (8 October, 5:47am Perth). All but one request went to POST /wp-json/bricksforge/v1/form_submit; the other used /wp-admin/admin-ajax.php with the bricksforge_form_submit action. Most payloads targeted /wp-content/uploads/bricksforge/tmp/, some dropped login_admin_*.php files into normal uploads folders such as /wp-content/uploads/2026/10/, and attackers tried alternate extensions (.php5, .php7, .phtml), mixed case and URL-encoded extensions to get past filters. Patchstack logged 63 source IPs across datacentre, cloud, VPN and residential ranges, including one cluster of 44 IPs sending identical payloads within seconds, which points to automated mass exploitation; no actor has been named and no count of compromised sites published. Version note: Patchstack and Wordfence list versions up to and including 3.1.8.9 as affected and 3.1.8.10 as fixed. The vendor's public changelog has no 3.1.8.10 entry; it lists 4.0.0 (17 September) and then 4.0.1 (8 October), 'Security fix for the Pro Forms file upload', which it says affects every site with Pro Forms active, even forms with no upload field. Whether 4.0.0 is affected is not stated, so move to 4.0.1 or later. Scores differ: Patchstack rates it CVSS 10.0; the CVE record and Wordfence give 9.8. (source: Patchstack)
Patchstack — Critical unauthenticated arbitrary file upload vulnerability exploited in Bricksforge plugin (8 Oct 2026)
Japanese karaoke operator Daiichi Kosho said on 8 October 2026 that Nippon Columbia Group (NCG), which handles customer personal data on its behalf, found malware on one employee's PC between 1 and 2 October and cut that PC off the network on 2 October; NCG told Daiichi Kosho on 5 October. Personal data from work Daiichi Kosho had outsourced was temporarily stored on that PC, so leakage cannot be ruled out. About 8,724,000 records may be exposed: roughly 8,631,000 customers who registered or booked at its venues (about 5,558,000 Big Echo, 3,462,000 DK Dining, 74,000 Karaoke CLUB DAM, 43,000 Mega Big, 5,000 Banana Club and 4,000 B-GARAGE, less about 515,000 duplicates) and about 93,000 employees. The data is registered name, gender, date of birth, email address and phone number; passwords are not included and the company says points cannot be used with this data alone. Daiichi Kosho says it has not confirmed any actual leak or misuse, its own systems were not affected, NCG has reset passwords and other credentials, and NCG and outside specialists are still investigating. It opened a free-call enquiry line on 9 October. BleepingComputer (11 October) could not find a public statement from NCG. Lesson: a contractor laptop holding a working copy of a customer database is the breach; keep outsourced data on controlled systems, not endpoints. (source: Daiichi Kosho notice)
Daiichi Kosho — possible personal-data leak at a contractor (8 Oct 2026, Japanese)
Cisco Talos reported on 8 October 2026 a spear-phishing campaign it tracks as UAT-11985, seen in mid-2026 against people linked to Taiwan research organisations. The emails invite targets to plausible public events, borrowing real event details and the names of institutions such as the Taiwan European Union Centre, the NCCU Institute of International Relations and Taiwan Research Institute, but the named senders could not be confirmed by any of those organisations. The three emails Talos studied share an almost identical three-part structure, flattery and policy jargon, which Talos says points strongly to AI-assisted templating, while noting that language alone cannot prove a large language model wrote them. Registration links display a legitimate-looking Google Forms address but point to a fake form hosted elsewhere, which forces a jump to a copy of the Google sign-in page. Some emails attached real event posters with the QR code swapped for a malicious one, so anyone who scans a printed copy on a noticeboard can also be phished. The sign-in kit is operator-driven: it sends browser details, the account name and the password to the attacker's server over HTTP POST, the server replays them to Google in real time, and a WebSocket channel tells the fake page which next screen to show, including password, passkey or the specific MFA challenge Google asks for, so the attacker ends up with a fully signed-in session. Talos assesses with moderate confidence that the kit's interface was first written in Simplified Chinese; it supports only Simplified Chinese, Traditional Chinese and English. Talos published ClamAV and Snort detections and indicators. No Australian targeting was reported. (source: Cisco Talos)
Cisco Talos — UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing (8 Oct 2026)
Patchstack published an advisory on 8 October 2026 for an incorrect privilege assignment flaw in WooCommerce, the Automattic e-commerce plugin for WordPress, and the CVE record (Patchstack as CVE numbering authority) followed on 10 October. Versions 9.8.0 through 11.1.2 are affected. Patchstack says the attacker needs a Shop manager account, the built-in WooCommerce role many stores hand to staff or contractors for orders and products, and that the flaw lets that account escalate privileges; it rates the issue CVSS 3.1 7.2 (network, low complexity, high privileges required, high impact on confidentiality, integrity and availability) and medium priority. The researcher, Ananda Dhakal of Patchstack, reported it on 25 August. Patchstack lists 11.2.0 as the patched version. No technical write-up or exploitation has been reported. The risk is mainly to stores where shop manager logins are shared, weakly protected or held by outside parties, since a takeover of one of those accounts could become a full site takeover. (sources: Patchstack advisory; CVE record)
Patchstack — WooCommerce 9.8.0–11.1.2 Privilege Escalation (CVE-2026-106608, published 8 Oct 2026)
Zenity Labs disclosed AgentCorruption on 8 October 2026 at SecTor in Toronto. Researchers sent one prompt to a public-facing Amazon Bedrock AgentCore agent that had a common tool able to make outbound web requests, telling it to call the instance metadata service from inside its microVM. That returned temporary credentials for the agent's default execution role, and the role was not scoped to that agent: it carried region-wide AgentCore permissions. With it the researchers found other agents' IDs through CloudWatch log groups, pulled their container images (and source code) from ECR, invoked internal agents they were never meant to reach (bedrock-agentcore:InvokeAgentRuntime), read private conversations across agents and sessions (ListEvents), planted memories that redirected agents to send future conversations to an attacker (CreateEvent on AgentCore Memory), and read API keys, OAuth tokens and secrets (GetResourceApiKey, secretsmanager:GetSecretValue). Zenity reported the metadata access to AWS on 25 December 2025 and the role scope on 12 January 2026. AWS made IMDSv2 (MMDSv2) the default for new AgentCore runtimes and cut the default execution role's permissions; Zenity confirmed by 29 September that agent-to-agent invocation, chat reading and Secrets Manager access had been removed, and says the issues are fixed. AWS, per Cyber Security News, disputes calling it a vulnerability: it says an agent reaching its own execution-role credentials is expected and documented, and its guidance warns that any code inside the microVM can call the metadata endpoint. Existing agents built with the older broad default roles may still carry them. No in-the-wild abuse reported. (sources: Zenity press release; Zenity Labs write-ups)
Zenity — Zenity Labs discloses AgentCorruption, a chain of AWS AgentCore flaws (8 Oct 2026)
CISA published ICS advisory ICSA-26-281-01 on 8 October 2026 for Red Lion Controls N-Tron 700 Series managed Ethernet switches (Red Lion is part of Sweden's HMS Networks), used worldwide in critical manufacturing, communications and commercial facilities. Firmware 3.11.0 and earlier and bootloader 2.0.6.1 and earlier are affected by seven CVEs: SNMP can retrieve configuration files, change user accounts and settings and start firmware or bootloader upgrades or downgrades without authentication (CVE-2026-33367, CVSS 3.1 8.1); usernames and passwords, including factory defaults, sit in plaintext in the configuration file and can be exported by TFTP, which SNMP can trigger without logging in (CVE-2026-39460, 8.1); browsing to a particular URL on the web server reboots the switch, which can be scripted for a constant reboot loop (CVE-2026-39453, 8.3); credentials are stored with weak, recoverable encryption (CVE-2026-28745, 7.5); firmware and bootloader updates need no authentication and N-Tron devices can be found and pushed new firmware over SNMP/TFTP (CVE-2026-29797, 7.1); factory administrator credentials stay active even after other admin accounts are set up (CVE-2026-32645, 6.0); and someone with physical access can boot to factory settings and log in with the defaults (CVE-2026-33272, 4.9). CISA lists no known public exploitation. (sources: CISA advisory; HMS Networks cybersecurity page)
CISA ICS advisory ICSA-26-281-01 — Red Lion Controls N-Tron 700 Series (8 Oct 2026)
CISA published ICS advisory ICSA-26-281-02 on 8 October 2026 for Grid Protection Alliance's openPDC (a phasor data concentrator for synchrophasor/PMU data in power grids) and openHistorian (a time-series historian). CVE-2026-100730 (CVSS 3.1 9.8): a service console interface deserialises client-supplied data; with Windows Authentication it needs a logged-in user, without it an unauthenticated network attacker can trigger deserialisation of an arbitrary object graph. CVE-2026-105278 (9.8): the published openPDC Docker image ships a fixed administrative credential with no forced change. CVE-2026-104629 (8.8): the component loader will build and run any specified type, so an authenticated user who can drop a file on the host can run code as the service account. CVE-2026-105281 (7.5) and CVE-2026-85479 (5.3): the internal and STTP data publishers accept unauthenticated connections by default, exposing the device and measurement topology or data exchange. CVE-2026-101022 (4.3): the Modbus connection feature can be pointed at any internal host to map the network. The new defaults bind the publishers to loopback only on new installs; upgraded systems keep their old settings. The vendor has not published fixes to the Docker image and advises against running those images in live environments. CISA lists no known public exploitation. (source: CISA advisory)
CISA ICS advisory ICSA-26-281-02 — Grid Protection Alliance openPDC and openHistorian (8 Oct 2026)
Flashpoint published an analysis on 8 October 2026 of CastleStealer, a C# information stealer first seen in April 2026 in a ClickFix campaign that ran a Python script to launch a loader called CastleLoader. By June it was spreading through malicious search ads for Node.js that led to fake installer sites, where a batch file pulled down an in-house loader called OXLOADER that decrypts itself in several rounds, hides its API calls, checks for sandboxes and runs in memory. Newer samples skip Russian-language systems, send a handshake with a build ID to their command server, then collect Chromium browser logins, cookies, history, form data and extension storage. They now get past Chrome's App-Bound Encryption by abusing the browser's IElevator COM interface, a trick other modern stealers also use. A basic remote shell lets an operator run commands, push a file to run or have the malware download another payload, so an infection does not end once passwords are taken. Stolen data leaves in small AES-encrypted chunks over raw TCP rather than one big archive, which Flashpoint says may avoid alerts for large transfers; the malware then deletes itself. Flashpoint has not yet seen wide uptake by criminals. (sources: Flashpoint; Cyber Security News)
Flashpoint — CastleStealer: an emerging infostealer growing more sophisticated (8 Oct 2026)
Gen Threat Labs (Gen Digital) published an analysis on 8 October 2026 of Warden Stealer, a Windows information stealer sold as malware-as-a-service and written in Rust. First builds appeared in early May 2026 and it has been advertised on Russian-language forums since August; within months it became one of the most common stealers in Gen's user base. Gen previously tracked it as CallbackBeaver and has now linked it to the Warden brand. Each operator configures their own build, targets and command-and-control servers, and the kit includes its own loader and a clipboard clipper that swaps copied cryptocurrency wallet addresses. Builds are heavily obfuscated and re-shaped ('morphed') to beat signature detection, and Gen documents how it bypasses Chrome's Application-Bound Encryption. Beyond browsers, wallets, messengers, password managers and VPN clients, many builds collect configuration files and local data from AI assistants and coding agents, which can hold access and refresh tokens, MCP credentials, prompt histories and project traces; version 1.9, announced on 29 September 2026, made AI coding agent token theft an official feature. Operators spread it through ClickFix fake-verification pages, malicious ads, cracked software and fake game cheats (per Cyber Security News). (sources: Gen Threat Labs; Cyber Security News)
Gen Threat Labs — Warden Stealer: from attribution to a technical breakdown of a Rust infostealer (8 Oct 2026)
CERT Polska published CVE-2026-103663 on 8 October 2026 for Ollama, the popular tool for running large language models locally. The /api/pull endpoint, used to download model layers, did not properly check layer digests in its digestToPath function, so an unauthenticated remote attacker can supply a digest containing a path traversal sequence and have a malicious file written outside the model store. If the server process can write to /usr/lib/ollama, which is the default in most Ollama Docker images, the planted file is loaded and executed on the next server restart, giving code execution as root. CERT Polska rates it CVSS 4.0 9.4 (the vector requires some user interaction, such as a pull being triggered). Ollama fixed it in version 0.35.0, released on 28 September 2026 (UTC). The bug was reported by Bartłomiej Dmitruk (striga.ai). No exploitation has been reported, but exposed Ollama servers are already being hunted by botnets such as PoeLLM. (source: CERT Polska)
CERT Polska — CVE-2026-103663 vulnerability in Ollama (8 Oct 2026)
LAVA published research on 8 October 2026 about CVE-2026-47483, a flaw it reported in NVIDIA's DCGM Exporter, the tool that publishes GPU health and usage metrics (typically on port 9400) for systems such as Prometheus. The exporter exposed Go's /debug/pprof profiling endpoints without authentication, and enough concurrent profiling requests can exhaust memory and crash it, blinding operators to GPU health and possibly slowing training or inference on the same host (CWE-770; NVIDIA rates it 8.2, denial of service and information disclosure). LAVA reproduced the behaviour with NVIDIA's official container unmodified. In four internet scans it found more than 2,000 hosts exposing the exporter without authentication, reporting over 12,000 unique GPUs including Blackwell Ultra B300, H200 and H100 parts as well as RTX 5090 and 4090 cards; many sat on customer infrastructure at GPU cloud providers such as Voltage Park, Lambda, Northern Data and DigitalOcean, which helped notify customers. LAVA did not test the crash against public systems. NVIDIA's July 2026 bulletin fixed the issue in the release pairing DCGM 4.5.3 with DCGM Exporter 4.8.2, which makes pprof opt-in (--enable-pprof or DCGM_EXPORTER_ENABLE_PPROF). No exploitation has been reported. (sources: NVIDIA bulletin; LAVA; SecurityWeek)
IBM published two security bulletins on 8 October 2026 for IBM Guardium Data Protection, the database activity monitoring platform whose collectors sit on the network and inspect database traffic. The Sniffer bulletin (versions 12.0, 12.1 and 12.2) fixes CVE-2026-75875 (CVSS 9.8, path traversal allowing remote code execution), CVE-2026-80381 (9.8) and CVE-2026-81932 (8.6, unauthenticated SQL injection), and several memory-corruption bugs in the traffic parsers, including a MongoDB SCRAM username overflow (CVE-2026-82335, 8.1) and a Microsoft SQL Server TDS PRELOGIN overflow (CVE-2026-84058, 8.1) that a remote attacker could trigger simply by sending crafted packets across a network the collector monitors. The Edge bulletin fixes CVE-2026-84272 (9.8): the edge-controller in 12.1 and 12.2.2 lacks authentication, so an unauthenticated remote attacker could run arbitrary container images and take control of managed edge clusters. The CVE records were published on 8 October; a related September bulletin also fixed CVE-2026-84249 (9.8, missing authentication for management operations in 12.2 and 12.2.2). IBM lists no workarounds and no exploitation. (source: IBM)
IBM — Security Bulletin: multiple vulnerabilities addressed in the Sniffer component of IBM Guardium Data Protection (8 Oct 2026)
