Red Hat CVE-2026-96659 (published 1 October 2026; Red Hat CVSS 3.1 9.1 Important; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L): authorization weakness (CWE-267) in Foreman template-preview endpoints used by Red Hat Satellite. An authenticated low-privileged user with only the Viewer role can submit crafted requests and retrieve sensitive host attributes that should be admin-only — including host root passwords. If template Safemode protections are disabled or circumvented, Red Hat warns the same flaw class can escalate to arbitrary command execution as the Foreman service account. Affects Satellite/Foreman deployments that expose the vulnerable preview path; companion Critical safemode-bypass CVE-2026-96658 (see /n/foreman-safemode-96658-20261001) shipped in the same 1 Oct RHSA train. Fixed via RHSA-2026:74503 / 74504 / 74505 / 74506 (Satellite 6.16–6.19 trains per Red Hat CVE page). (sources: Cyber Security News; Red Hat CVE-2026-96659)
Red Hat — CVE-2026-96659 (Satellite/Foreman template preview authz; 1 Oct 2026)
SEC Consult Vulnerability Lab blog (1 October 2026; researcher Timo Longin) details two From-header smuggling flaws in Apple iCloud’s outbound SMTP processing that let an authenticated free iCloud account send mail appearing to come from arbitrary @icloud.com addresses (examples include high-value identities such as tim.cook@icloud.com or no-reply@icloud.com) while receiving systems still recorded SPF, DKIM, and DMARC pass. Root cause: inconsistent parsing between iCloud’s outbound validators and later cleanup/relay stages (carriage-return / line-break tricks in the From: header; SMTP dot-stuffing / “dot-peeling” discrepancies). SPF passed because Apple’s legitimate infrastructure sent the message; DKIM passed because iCloud signed after the affected stage; DMARC passed on icloud.com alignment. Carriage-return issue first reported to Apple 21 May 2024; Apple adjusted handling; researchers found a second bypass; final fixes confirmed December 2025; public write-up 1 Oct 2026. Apple Security Bounty awarded US$15,000. No CVE id assigned in the SEC Consult blog. (sources: SecurityWeek “In Other News”; SEC Consult blog)
SEC Consult — From: anyone@icloud.com — Spoofing Arbitrary Apple iCloud Identities (1 Oct 2026)
Broadcom Symantec Threat Intelligence (1 October 2026) reports the China-nexus operator behind Warlock ransomware — tracked by Symantec as Longlegs (aka Storm-2603; linked to CL-CRI-1040 / CamoFei / ChamelGang) — continues exploiting Microsoft SharePoint flaws against critical infrastructure, government and education. Past two months: at least four victim organisations in Portuguese- and Spanish-speaking countries spanning Europe, Africa and Latin America, including a water utility, a telecommunications provider, a regional government body and a university. One intrusion disabled security software on ≥40 systems then ran Warlock on ≥33. Typical chain after SharePoint access: webshell, ASP.NET machine-key theft, forced-signed RCE payload; DLL sideloading / LOTL; abuse of legitimate file-sharing hosts and a vulnerable driver to blunt EDR. Warlock rose on the 2025 ToolShell SharePoint exploit chain; Symantec says those flaws likely remain in the group's arsenal, alongside newer SharePoint flaws that CISA warned about in an advisory published in July 2026. No Australian victim named in this report. (source: Symantec/security.com) Correction (27 Oct 2026): removed a list of six 2026 SharePoint CVE numbers credited to Symantec; Symantec's post refers only to newer SharePoint flaws covered by a July 2026 CISA advisory and does not list them. (source: Symantec, security.com) Correction (27 Oct 2026): removed the SecurityWeek link and credit; the card rests on Symantec's report. (source: Symantec, security.com)
Symantec / security.com — Warlock ransomware attackers hit water and telecom operators (1 Oct 2026)
Dell Security Advisory DSA-2026-448 (article 000515771; initial release 1 October 2026) patches multiple critical flaws in Dell Container Storage Modules (CSM), which connect Dell PowerStore/PowerScale/PowerFlex/PowerMax/Unity XT arrays to Kubernetes via CSI. Headline proprietary issues in CSM Authorization 2.4.0: CVE-2026-63688 (CVSS 3.1 10.0; AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) missing authentication on the csm-authorization-storage gRPC server lets an unauthenticated remote attacker obtain storage-backend administrator credentials for all registered arrays and fully bypass the CSM authorization model; CVE-2026-63692 (CVSS 10.0, same vector) missing authentication on the authorization proxy/tenant service enables unauthenticated elevation to administrative control across tenants. Same advisory also covers CVE-2026-67269 (CVSS 9.9) CSM Operator 1.12.0 privilege escalation to root on cluster nodes; CVE-2026-54472 (9.8) hard-coded credentials enabling forged admin tokens; CVE-2026-61421 (9.8) archived karavi-authorization JWT demo secret ("supersecret"); CVE-2026-67273 (9.6) template-engine issue granting cluster-wide Secrets read / RBAC tamper; plus additional High/Medium issues. Affected: CSM versions prior to 1.17.0. Remediated: CSM 1.18.0 or later. No workarounds. Dell has not reported active exploitation of these CSM flaws. (sources: Dell DSA-2026-448; BleepingComputer)
Red Hat CNA CVE-2026-96658 (published 1 October 2026; CVSS 3.1 9.9 Critical AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): authenticated low-privilege attacker can achieve remote code execution by bypassing the Foreman templating safemode sandbox — improper handling of delegated methods lets an attacker append unauthorised functions to the allowed execution list and run arbitrary commands on the hosting server. Red Hat Product Security rates Critical because a user with minimal read/view permissions can RCE the underlying Satellite host where Foreman relies on the sandbox to render templates. Fixed packages shipped 1 Oct via RHSA-2026:74506 (Satellite 6.16 el8/el9 rubygem-safemode 0:1.5.0-2), RHSA-2026:74504 (Satellite 6.18 el9 rubygem-safemode), and RHSA-2026:74503 (Satellite Utils 6.19 el9 foreman 0:3.18.0.14-1). Bugzilla 2534185. (source: Red Hat CVE)
Red Hat — CVE-2026-96658 Foreman safemode bypass RCE (1 Oct 2026)
Wind River CNA CVE-2026-104018 (published 1 October 2026; CVSS 3.1 8.8 High AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): improper privilege management (CWE-269) in the VxWorks 7 command shell when per-user command privileges are enforced. Under certain shell operations a command may run without the usual privilege check, so an authenticated low-privilege user can execute unauthorised commands — confidentiality/integrity/availability impact on the device. Affects all VxWorks 7 versions prior to 26.09; fixed in 26.09 (per Wind River CVE text). CISA SSVC on NVD: exploitation none / not automatable at publication. (sources: Wind River CVE page)
Wind River Support — CVE-2026-104018 VxWorks 7 privilege management
Proofpoint Threat Research (1 October 2026) publicly debuts TA419, a China-aligned espionage actor running credential phishing against US and Japan think tanks, defence contractors, universities and law firms since at least April 2025. July 2026 wave (from 8 Jul) impersonated Lynne Edwards Parker (former White House OSTP Principal Deputy Director) and economist Heidi Crebo-Rediker with benign “AI Policy Advisory Committee” / Senate Foreign Relations AI export-control report lures, then shortened links into Cloudflare Turnstile → Frameless BitB AitM against Microsoft 365 / Entra ID (OfficeHome client_id) capturing password, MFA and session cookies. February 2026: same actor impersonated a senior Anthropic employee (“Request for Feedback on Military Integration of Claude”) against a US think-tank AI policy analyst. Domains include driftshare[.]co → globalfileshareplatform[.]com (July) plus file-share themed infra; NameSilo + Cloudflare CDN; VPS TLS fingerprint O=Castro Inc. Assessed collection on US AI policy/regulatory landscape amid US–China competition. No product CVE. (sources: Proofpoint; CyberScoop) UPDATE (Reuters via iTnews, 2 Oct): Proofpoint says the July targeting involved fewer than 10 people at a handful of organisations, suggesting intelligence interest in US policymaking rather than technology theft alone; Reuters identified one recipient, former White House official Alex Engler, who received a fake invitation from “Parker” to join an AI policy project, and Parker said she knew of two such messages sent in her name in early July.
Proofpoint — Hallucinating Credibility: TA419 US AI policy phishing (1 Oct 2026)
NSA press release (1 October 2026) announces expanded post-quantum cryptography (PQC) initiatives for National Security Systems (NSS), the Department of War, and the Defense Industrial Base, aligned with Executive Order 14412 and CNSSP-15. Starting in 2027, all new commercial NSS must support quantum-resistant (CNSA 2.0) algorithms; legacy systems that cannot support quantum-resilient algorithms are to be phased out by 2030. NSA highlights adversary “harvest now, decrypt later” and “trust now, exploit later” risks and points stakeholders to Cybersecurity Collaboration Center DIB services and Zero Trust implementation guidelines. (source: NSA press release)
NSA — Post-Quantum Cryptography Measures for NSS (1 Oct 2026)
Fortinet PSIRT FG-IR-26-175 (published / revised 1 October 2026; FortiGuard IR RSS + advisory) discloses CVE-2026-104286, a Critical CVSSv3 9.8 path-traversal (CWE-22) plus improper NULL-byte neutralization (CWE-158) flaw in the FortiMail management interface that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Impact: execute unauthorised code or commands. Attack type: unauthenticated. Known exploited: Yes (Fortinet). Affected: FortiMail 8.0.0–8.0.1 (upgrade to upcoming 8.0.2+), 7.6.0–7.6.6 (upcoming 7.6.7+), 7.4.0–7.4.8 (upcoming 7.4.9+), 7.2.0–7.2.9 (upgrade to 7.4 branch or later). Discovered internally by Fortinet Product Security. Workarounds until patches land: disable IBE (`config system encryption ibe` / `set status disable`) and/or remove internet exposure of the FortiMail management interface (trusted networks only). BleepingComputer (1 Oct) reports Fortinet IoCs (added/modified files under /data and /bin, SHA-256 hashes, attacker IPs 79.141.169.187 and 45.129.0.192, archive234 remote-archive config, cron/migadmin and IBE Base64 decode failure log patterns) and notes Fortinet is coordinating with government agencies including CISA. CISA added CVE-2026-104286 to KEV on 1 Oct 2026 (FCEB due 4 Oct 2026 per BleepingComputer). (sources: FortiGuard Labs PSIRT; BleepingComputer)
Fortinet PSIRT FG-IR-26-175 — FortiMail CVE-2026-104286 (1 Oct 2026)
Wordfence CNA CVE-2026-1581 (published 19 Feb 2026; CVSS 3.1 7.5 High AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): unauthenticated time-based SQL injection in the WordPress wpForo Forum plugin via the ‘wpfob’ parameter in all versions up to and including 2.4.14 (insufficient escaping/preparation on SQL). Vendor changelog: 2.4.15 (10 Feb 2026) lists “Security: Vulnerability - Unauthenticated Time-Based SQL Injection” (current trunk Stable tag 3.2.2). UPDATE 1 Oct 2026: The Hacker News (bundled with SC backdoor coverage) cites Previdian telemetry — fewer than 20 exploitation attempts since 3 July 2026 from five unique IPs (Bulgaria, Switzerland, France, US, Yemen). (source: Wordfence/MITRE CVE record)
Microsoft’s 2026 Digital Defense Report (MDDR; aka.ms/MDDR2026) argues cyber attackers are currently benefiting from AI faster than defenders: AI is compressing time/expertise/cost for vulnerability discovery, customised malware generation, and post-compromise work (exfiltration, secret discovery) while remediation lags. Microsoft expects attacker–defender equilibrium to re-establish eventually, but near-term “attackers are reaching to advantages first.” Report warns of a multi-year period where known-but-unpatched vulnerability counts spike, and well-funded adversaries may stockpile AI-discovered zero-days; median time from in-the-wild discovery to weaponisation has fallen “well below 24 hours.” Separate takeaway: attackers already treat AI systems as another attack surface. (sources: Microsoft MDDR 2026 hub; BleepingComputer)
Microsoft — Digital Defense Report 2026 hub (aka.ms/MDDR2026)
