Daily brief, Wednesday, October 21, 2026

Breaking

Nothing spreading fast in technology large companies run.

Newly exploited in the wild

No CVEs added to CISA's known-exploited list.

New public exploit code

No new Nuclei templates, Metasploit modules, Exploit-DB or VulnCheck XDB entries.

New critical CVEs

• 9.8CVE-2026-109618 PHP Group PHPKEVexploit codeDetectionAn attacker gains ability to execute arbitrary code by opening a malicious PHP script.
• 9.8CVE-2026-96639 Python pillowAn attacker can cause memory corruption of the Python imaging library.
• 9.8CVE-2026-76473 Cisco Cisco Emergency Responder+2 more CVEs in the same releaseAn attacker can inject malicious code into affected Cisco products.
• 9.8CVE-2026-76466 Cisco Cisco TelePresence Video Communication Server (VCS) ExpresswayAn unauthenticated attacker can execute arbitrary operations on affected Cisco devices.
• 9.1CVE-2026-91403 Oracle Oracle Java SEAn attacker can bypass authentication and access Oracle Java SE.
• 9.0CVE-2026-20043 Cisco Cisco Cyber VisionThis vulnerability is related to memory corruption in Cisco Cyber Vision.
• 9.8CVE-2026-76301 Splunk Splunk EnterpriseAn attacker gains data access to Splunk Enterprise without authentication or user interaction.
• 9.8CVE-2026-113736 D-Link DHP-W610AVAn attacker can set an empty password on D-Link DHP-W610AV.
• 10.0CVE-2026-105944 Apache Apache Pulsar ManagerAn attacker can bypass authentication and access Pulsar Manager's user accounts.
• 10.0CVE-2026-114382 TOTOLINK EX200An attacker can execute arbitrary code on a TOTOLINK EX200 by manipulating the argument of the setStaticDhcpConfig function.
• 10.0CVE-2026-113744 Tenda AC19Product not on watchlist.
• 9.8CVE-2026-111183 GStreamer GStreamerAn attacker can execute arbitrary code on affected installations of GStreamer without authentication or user interaction.
• 9.1CVE-2026-114139 Getsentry sentry-javascriptAn attacker can bypass application middleware for every request path under a configured tunnelRoute in Sentry-Javascript.
• 9.9CVE-2026-71195 OpenStack ManilaAn attacker can bypass authentication and access public shares on OpenStack Manila before 23.0.1.
• 9.8CVE-2026-114119 Best Practice Software Bp PremierAn attacker can bypass authentication and access affected Bp Premier installations.
• 9.8CVE-2026-114108 HKUDS Vibe-TradingAn unauthenticated attacker can access the FastAPI surface of affected Vibe-Trading installations.
• 10.0CVE-2026-111813 Apache Apache Traffic ServerApache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, fro
• 9.4CVE-2026-113788 Uselagoon lagoonAn attacker can execute arbitrary code in lagoon.
• 10.0CVE-2026-111812 Apache Apache Traffic ServerApache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0
• 9.0CVE-2026-111811 Apache Apache Traffic ServerAn attacker can bypass authentication and read, write, and delete the shared proxy cache in Apache Traffic Server.

4 more critical CVEs in this window: see them on the dashboard.

Ransomware

37 victims posted to leak sites. Most active: N0n (9), BrainCipher (8), lamashtu (3), everest (3), akira (2).

Financial services hit: Adobe Insurance Brokers, LLC (pear).

New data breaches

No new breaches published.