Daily brief, Monday, October 26, 2026

Breaking

Emerging

Critical bugs in widely used enterprise tech, not spreading widely yet.

Newly exploited in the wild

• 9.8CVE-2026-109618 PHP Group PHPCISA KEVDetectionAn attacker gains ability to execute arbitrary code by opening a malicious PHP script.
• 8.1CVE-2026-109619 PHP Group PHPCISA KEVDetectionPHP has a memory corruption vulnerability that can be exploited by an attacker.

New public exploit code

• 9.3CVE-2026-102782 Ordasoft.Com OrdaSoft Simple Membership extension for JoomlaNuclei templateDetectionCVE published Oct 7, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request param
• 8.1CVE-2026-102878 Hangwin mcp-chrome-bridgeNuclei templateDetectionCVE published Sep 29, 2026mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser

1 older CVE (published more than 7 days earlier) with new exploit code, below the bar (CVSS under 9, not widely used enterprise tech): CVE-2026-59707 (8.6).

New critical CVEs

• 9.8CVE-2026-116485 Huangxd- danmu apiexploit codeDetectionAffected: danmu_api before 1.21.7. Attacker gains: Ability to modify server environment configuration. Recommended action: Update danmu_api to version 1.21.7 or later.
• 9.8CVE-2026-107656 Fortinet FortiSandboxAn attacker can bypass authentication on Fortinet FortiSandbox.
• 9.9CVE-2026-116506 TOTOLINK A950RGAn attacker can execute arbitrary code on the TOTOLINK A950RG router by injecting malicious commands remotely.
• 9.9CVE-2026-116504 TOTOLINK A950RGAn attacker can execute arbitrary code on the TOTOLINK A950RG router by injecting malicious commands remotely.
• 9.8CVE-2026-112346 OpenHands OpenHands Software Agent SDKAn attacker can execute code remotely without authentication on OpenHands Software Agent SDK.
• 9.8CVE-2026-107092 An attacker can access files via directory traversal on NexoPOS.
• 9.9CVE-2026-115188 An attacker can upload arbitrary files to a publicly accessible directory on Mautic 7.
• 9.1CVE-2026-116235 Oray Pugongying X5 ProA flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The
• 10.0CVE-2026-116508 TOTOLINK TOTOLINKAn attacker can cause remote code execution in TOTOLINK A950RG.
• 9.1CVE-2026-116234 Oray Pugongying X5 ProA vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched rem
• 9.1CVE-2026-116233 Oray Pugongying X5 ProA security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has bee
• 9.8CVE-2026-10757 Esri ArcGIS ServerA remote attacker can access the service and potentially execute SQL commands on ArcGIS Server.
• 9.9CVE-2026-116231 Oray Pugongying X5 ProAn attacker can inject malicious code on Oray Pugongying X5 Pro 7.6.1 via a remote attack.
• 9.9CVE-2026-116232 Oray Pugongying X5 ProAn attacker can inject malicious code on Oray Pugongying X5 Pro 7.6.1 via a remote attack.
• 9.9CVE-2026-110720 HashiCorp ToolingAn attacker can obtain elevated Consul privileges on the HashiCorp Tooling server without authentication.
• 9.5CVE-2026-115905 Zip-Rs zip2## Summary A critical architectural parser differential exists in the `zip` crate (`<= 9.0.4`) between random-access archive readers (`ZipArchive`) and streaming readers (`ZipStreamReader`). `ZipArchive` considers the Central Directory File Header (CDFH) autho

Ransomware

33 victims posted to leak sites. Most active: qilin (16), payload (3), Whitearmor (3), emperador (2), rhysida (1).

Financial services hit: Power Funding (qilin).

New data breaches

No new breaches published.