HPE's security bulletin HPESBNW05162 rev.1, released 22 October 2026, lists 72 CVEs in the HPE Networking Wireless Operating Systems AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways and Access Points. HPE rates eight of them 10.0 under CVSS 3.1: CVE-2026-79844 and CVE-2026-79850 (authentication bypass leading to remote code execution in AOS-10 and AOS-8), CVE-2026-79845 (authentication bypass in the PAPI protocol of AOS-10 allowing unauthorised access and modification of sensitive data), CVE-2026-79846 (unauthenticated command injection in AOS-8), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection allowing remote code execution in AOS-8), and CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows leading to remote code execution in AOS-10). A further 25 are rated between 9.0 and 9.8, among them unauthenticated command and SQL injection in the PAPI protocol and an authentication bypass in the AOS-8 SSH daemon. HPE lists affected versions as AOS-10.8.x.x: 10.8.1.1 and below, AOS-10.7.x.x: 10.7.2.6 and below, AOS-10.4.x.x: 10.4.1.13 and below, AOS-8.13.x.x: 8.13.3.0 and below and AOS-8.10.x.x: 8.10.0.23 and below. It recommends upgrading to AOS-10.8.x.x: 10.8.1.2 and above, AOS-10.7.x.x: 10.7.2.7 and above, AOS-10.4.x.x: 10.4.1.14 and above, AOS-8.13.x.x: 8.13.3.1 and above or AOS-8.10.x.x: 8.10.0.24 and above. HPE says versions that have reached End of Maintenance are presumed to be affected and are not covered by the advisory. HPE says the vulnerabilities were generally discovered by its internal security research and that it 'is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory'. It adds: 'Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.' Until patches are applied, HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with firewall policies at layer 3 and above. HPE published CVE records citing the bulletin on 22 October (UTC), and CISA's ADP enrichment on the seven 10.0-rated HPE records lists exploitation as none. When checked on 23 October, the CVE list entry for CVE-2026-79845 was an unrelated record assigned by VulDB, not an HPE record. (sources: HPE security bulletin; HPE CVE records) Updated 23 Oct 2026: BleepingComputer reported the bulletin, noting that ArubaOS powers Aruba Networking enterprise wireless infrastructure. (source: BleepingComputer)
HPE — HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8) (22 Oct 2026)
Security firm V12 said on 22 October 2026 that it found 25 vulnerabilities in the x402 codebase, the open standard that lets software such as AI agents pay for an API call inside an ordinary HTTP exchange (a server answers 402 Payment Required, the client signs a payment and retries). V12 described three it rated critical. First, the documented default client setup enforced no per-payment limit or total budget, so, according to V12, a hostile API could turn a routine request into a request for the wallet's full balance of a compatible token, and with an automatic signer and no application-supplied policy the client could sign it. Second, the TypeScript Solana facilitators did not check the instruction type, so a token approval, which moves no tokens, was accepted as a payment in V12's local test; V12 called it "a complete payment bypass" and says the test did not submit a live transaction. Third, the Sign-In-With-X client signed login messages without checking that the website named in them was the one it had contacted, which V12 says could let a malicious server log in to another site as the agent's wallet. V12 says it reported the 3 critical and 13 high-severity findings to the x402 team on 12 August 2026 and that the 3 critical flaws were fixed by 20 August. The x402 Foundation's TypeScript changelogs for 2.23.0 list the matching changes: client spendControls that by default allow only recognised pegged assets with a $1 USD cap, a required origin check before signing Sign-In-With-X messages, and a validation guard for TransferChecked in the Solana package. (sources: V12; x402 Foundation changelog) Updated 23 Oct 2026: according to The Hacker News, neither V12 nor the x402 Foundation has publicly reported attacks using the flaws, the foundation has published no security advisory for them, and npm audit and PyPI listed no advisories for the last releases before the fixes as of 23 October. (source: The Hacker News)
V12 — 25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-97785, 'AAD App Proxy Elevation of Privilege Vulnerability': improper authentication (CWE-287) in AAD App Proxy allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and the CVE record names the affected product Microsoft Entra application proxy. Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. (sources: Microsoft Security Response Center; CVE record) Updated 24 Oct 2026: this card previously covered six Microsoft cloud-service CVEs published the same day; the other five now have their own cards (Azure Kubernetes Configuration Service CVE-2026-83938, VM Inspector for Azure Virtual Machines CVE-2026-110063, Azure Pipelines CVE-2026-105014, Azure AI Foundry CVE-2026-108456 and Exchange Online CVE-2026-96185). (source: Microsoft Security Response Center)
Microsoft Security Response Center — CVE-2026-97785, AAD App Proxy Elevation of Privilege Vulnerability (22 Oct 2026)
Cisco published a critical advisory (cisco-sa-vcs-static-cred-hr7EWZ8t) on 21 October 2026 at 16:00 GMT (22 Oct 00:00 Perth) for CVE-2026-76466 in the database service feature of Cisco Expressway Series. According to Cisco, an unauthenticated, remote attacker with network access to an Expressway device could run arbitrary operating system commands as root. Cisco says the flaw is due to the use of persistent cookies, and that client certificates are not validated when TLS Verify Mode is set to Enabled for clustering; an attacker who has the cookies could connect to the database service and invoke specific remote procedure call (RPC) commands. Cisco rates it CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-798 (use of hard-coded credentials), bug CSCww27732. It affects Expressway-C and Expressway-E, virtual and appliance, only when the devices are configured in a cluster. Cisco lists X15.5.20 as the first fixed release for X15.5.3 and earlier, says X14 and earlier must migrate to a fixed release, and says there are no workarounds; the fix is also part of the 'Cisco Expressway Series Security Hardening Release: October 2026'. Cisco's PSIRT says it is not aware of any public announcements or malicious use. Cisco credits Stefan Aleksic of Jane Street. The advisory is part of Cisco's bundled publication of 21 October 2026 16:00 GMT (22 Oct 00:00 Perth). Source: Cisco security advisory cisco-sa-vcs-static-cred-hr7EWZ8t (22 Oct 2026 Perth). Correction (27 Oct 2026): the card date moved from 21 to 22 October 2026; Cisco's advisory shows 'First Published: 2026 October 21 16:00 GMT', which is 00:00 on 22 October in Perth (AWST). (source: Cisco)
Cisco — Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t, 22 Oct 2026)
ESET researchers Anton Cherepanov and Peter Strýček published research on 22 October 2026 on MythicRatatoskr, a previously unknown Go-based backdoor that reaches a command-and-control server hosted inside Yggdrasil, a decentralised, experimental IPv6 mesh network. According to ESET, UAC-0099 gained initial access to a grain logistics company in Ukraine on 16 July 2025 through a spearphishing email with a malicious attachment that led to its MATCHBOIL downloader and MATCHWOK backdoor; the next day MythicRatatoskr was deployed, and ESET believes it was later used to deliver a SOCKS5 server. ESET says data-wiping activity followed on 17 September 2025, carried out by deploying the SDelete utility through Active Directory Group Policy, which it calls standard Sandworm tactics. ESET attributes the initial stage to UAC-0099 and the wiping to Sandworm with high confidence and assesses with high confidence that UAC-0099 handed off access to Sandworm, but says it cannot yet tell which group operated MythicRatatoskr. ESET says it has not seen the backdoor anywhere else, found indications that a Linux variant may exist, and notes Yggdrasil is not designed to provide anonymity; it says blocking the public peer addresses is a viable mitigation. ESET presented the findings at LABScon on 18 September 2026 and Virus Bulletin on 16 October 2026. Source: ESET WeLiveSecurity (22 Oct 2026). Updated 23 Oct 2026: according to Reuters (as published by iTnews), ESET said it had not previously observed state-linked attacks using the network and could not confirm whether the attack disrupted grain operations, and a Microsoft spokesperson said SDelete is a legitimate administrative utility that can be misused by attackers who already have access. (source: iTnews)
ESET WeLiveSecurity — MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration (22 Oct 2026)
Capcom Co., Ltd. said in a press release on 22 October 2026 that certain customer information tied to CAPCOM ID, the unified account used for its web services and needed to play some Capcom games online, was subject to unauthorised access by a third party. Capcom says the affected information (as of 22 October) is 11,774,247 records worldwide of email addresses plus system identifiers (account creation date and time, last login date and time, number of logins and the client IP address used at the last login); 43 of those records also included date of birth, gender, country/region and nickname, and login passwords on 196 accounts were changed without authorisation and have since been reset. Capcom says it has not confirmed any compromise of passwords originally set by customers and that credit card information was not included. According to Capcom's timeline, it detected suspicious activity on 19 October and confirmed unauthorised access the same day, set up an incident response headquarters on 20 October and confirmed customer information was affected, and reported the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. Capcom says it has identified and addressed the attack method, without saying what it was; services that use CAPCOM ID, including games, remain available; it will notify affected customers and has set up dedicated support channels by region, including Asia (excluding Japan) and Oceania. Capcom warns that the information could be misused for fraudulent emails or messages impersonating Capcom. BleepingComputer reported the disclosure on 22 October. Source: Capcom press release (22 Oct 2026); report: BleepingComputer (22 Oct).
Capcom — Notice and Apology Regarding Customer Information Affected Through Unauthorized Access (press release, 22 Oct 2026)
Trend Micro's Zero Day Initiative (ZDI) lists two Linux vulnerabilities, ZDI-CAN-33549 and ZDI-CAN-33774, each rated CVSS 9.0 and reported to the vendor on 21 October 2026. According to The Hacker News (22 Oct), both are remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, and were sent to public mailing lists without patches. The Hacker News says ZDI-CAN-33774 needs no authentication and exposes any server running KSMBD on port 445: a race in how KSMBD assigns its handler table lets a burst of short SMB1 packets followed by an SMB2 packet make workers read past the end of a buffer, with a path to writing past it once an attacker has access to a share. It says ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path that needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share and a client negotiating SMB Direct. According to The Hacker News, as of Thursday 22 October neither flaw had a named fix in the mainline kernel or linux-next, and neither has a CVE, since the kernel assigns CVEs only after a stable-tree fix. Phoronix (22 Oct) says a patch for ZDI-CAN-33549 sits in a Git branch intended for Linux 7.5, and that the reports appear to have been sent to the public list by mistake. The Hacker News says Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's documentation. No exploitation has been reported. Sources: ZDI upcoming advisories; The Hacker News (22 Oct); Phoronix (22 Oct).
Zero Day Initiative — Upcoming advisories (ZDI-CAN-33549 and ZDI-CAN-33774, Linux, CVSS 9.0, reported 21 Oct 2026)
CISA said on 22 October 2026 that it, the Canadian Centre for Cyber Security (Cyber Centre) and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience, to help organisations understand and manage token usage. CISA says unmanaged token consumption may contribute to rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks. The Cyber Centre's version (ITSM.00.125) describes a denial-of-tokens attack as threat actors deliberately generating excessive AI usage to exhaust token allocations, consume budgets or trigger rate limits, and a denial-of-wallet attack as exploiting usage-based pricing to cause financial harm, for example with complex prompts or AI loops. The authoring agencies recommend a tiered model that ranks token allocation by business impact, with cyber defence, incident response and threat intelligence in the mission-critical tier, and risk assessments before letting AI agents operate autonomously. They also recommend monitoring unusual increases in token consumption as a potential indicator of data exfiltration, feeding AI token telemetry into a SIEM alongside identity, cloud and API logs, progressive usage alerts (the guide's example: 70%, 80% and 90% of quota), multi-provider architectures, and planning for reduced AI availability in critical infrastructure, including keeping non-AI and manual capabilities. Sources: CISA (22 Oct 2026); Canadian Centre for Cyber Security ITSM.00.125 (October 2026).
CISA — Managing AI Token Consumption for Operational Resilience (22 Oct 2026)
Arista Security Advisory 0199 (22 October 2026) documents CVE-2026-114625, an SQL injection flaw (CWE-89) in on-premises VeloCloud Orchestrator (VCO), the management portal for VeloCloud SD-WAN. Arista says any authenticated user can gain operator privileges and masquerade as a local 'superuser operator' user, reaching functionality meant for internal use only, and that successful exploitation may compromise the confidentiality, integrity and availability of the orchestrator and the data it manages. An attack needs network access to the VCO web interface and a valid authenticated session; the minimum role is Enterprise Read Only, the lowest built-in tenant role, and Arista says no configuration prevents the exposure. Arista says the issue was detected by Arista and is known to be actively exploited, and that Hosted (including Dedicated) VCO was impacted and has already been patched. Arista rates it CVSS 3.1 9.9 and CVSS 4.0 9.4. Affected on-prem releases: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12; end-of-support versions were not assessed. Arista lists two IP addresses seen conducting the attacks (74.82.197.86 and 38.54.50.151) and advises blocking them and checking logs for them. VeloCloud Gateway, VeloCloud Edge and Arista EOS-based products are listed as not affected. This is a separate flaw from the actively exploited VCO bug CVE-2026-93952 that Arista disclosed in September (see Cyberstack's card). BleepingComputer reported the advisory on 22 October. Source: Arista Security Advisory 0199 (22 Oct 2026); report: BleepingComputer (22 Oct). UPDATE (24 Oct 2026): CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on 23 October 2026 (catalog version 2026.10.23), with a remediation due date of 26 October 2026 for US federal civilian agencies and forensic triage required. (source: CISA KEV)
The city of Columbia, the capital of South Carolina (about 150,000 residents), said it is responding to a cyberattack that has shut down several government systems, according to The Record from Recorded Future News (22 Oct). A city spokesperson told The Record that the city's IT department recently identified suspicious activity and contacted the South Carolina Law Enforcement Division (SLED), which is now leading the investigation. According to The Record, the affected systems include the MyColaSC platform residents use to pay utility bills, report non-emergency issues and reach other city services, as well as Geographic Information Systems and systems supporting animal services; residents were asked to phone in concerns such as potholes, fallen trees and broken streetlights while MyColaSC is down. A city official told The Record that critical public safety and utility systems remain operational, including the Columbia Police Department, Columbia-Richland Fire Department, 911 communications, Columbia Water systems and the Payment Center, including online payment services. The city has not said what kind of attack it was, and The Record says no hacking group had taken credit for the incident as of Wednesday. No Australian impact. Source: The Record (22 Oct).
The Record (Recorded Future News) — South Carolina officials offer assistance after state capital hit with cyberattack (22 Oct 2026)
INTERPOL announced on 22 October 2026 the results of Operation Serengeti III, which it describes as one of Africa's largest cybercrime enforcement operations. INTERPOL says investigators from 21 countries, under its coordination, targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion between 29 June and 31 August 2026, arresting 1,462 suspects, disrupting 10,909 malicious networks and recovering more than US$105 million in illicit funds. INTERPOL says authorities identified 65,929 victims and linked the criminal activity to losses exceeding US$385 million. INTERPOL's highlights: in Uganda, two transnational fraud rings were dismantled and 365 foreign nationals arrested over online investment and pension fraud targeting victims across Asia; in Angola, two illegal cryptocurrency mining centres were dismantled, nine suspects arrested and more than 2,000 mining devices seized; in Nigeria, a suspect was arrested over a large-scale phishing and business email compromise operation that harvested software credentials and amassed about 2.1 million email addresses. INTERPOL says partners including Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta and the Global Anti-Scam Alliance supported the operation, and that several investigations remain active. The participating countries INTERPOL lists are 20 African nations and the United States; INTERPOL names no Australian victims.
INTERPOL — Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million (22 Oct 2026)
Oracle, as the CVE numbering authority, published CVE-2026-91403 on 21 October 2026 at 21:23 UTC (22 October, 5:23 am Perth) for a vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. The CVE record says the flaw is easily exploitable by an unauthenticated attacker with network access via multiple protocols, and that successful attacks can result in unauthorised creation, deletion or modification of critical data or all data accessible to these products, as well as unauthorised access to critical data or complete access to all accessible data. Oracle scores it CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The supported versions the record lists as affected are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, Oracle GraalVM for JDK 17.0.21 and 21.0.13, and Oracle GraalVM Enterprise Edition 21.3.20. The record says the flaw can be exploited through APIs in the component, for example through a web service that supplies data to them, and also applies to sandboxed Java Web Start applications or applets that load and run untrusted code. The CVE record does not describe the underlying bug, list fixed versions or say whether the flaw has been exploited. Correction (26 Oct 2026): This card earlier described the contents of Oracle's two Security Alert pages, including that the Java updates distrust or remove eMudhra-related CA certificates, along with fixed-build and support-policy details. Those pages cannot be read by Cyberstack, and the CVE records do not mention eMudhra, distrust or removal, so those statements have been removed; the card now rests on the CVE records alone. The card date has also moved from 21 to 22 October, the first CVE record's publication date in Perth time. (source: CVE record CVE-2026-91403) Updated 25 Oct 2026: Oracle published a second CVE record, CVE-2026-114820, on 24 October at 18:42 UTC (25 October, 2:42 am Perth), for a JSSE vulnerability in the same three products with the same description and the same CVSS 3.1 score of 9.1 (same vector). The supported versions it lists as affected are Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and Oracle GraalVM Enterprise Edition 21.3.20.0.2. (source: CVE record CVE-2026-114820)
CVE Program — CVE-2026-91403 record (CNA: Oracle; published 21 Oct 2026 21:23 UTC, 22 Oct Perth)
