Today's video briefings
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Oct 12, 2026 · The Hacker News
Browse advisories by date
Pick a day to see its advisories. Older video briefings live on our YouTube channel.
▶ = has a video briefing · • = advisories only · dates in IST
Advisories
100 advisories published · filtered: 100
FBI Arrests Another Suspected ShinyHunters Hacker Linked to FBIJobs.gov Breach
The FBI has arrested another suspected ShinyHunters co-conspirator as investigators pursue the group believed to be behind the FBIJobs.gov breach. Director Kash Patel announced the arrest on October 9, saying the incident affected a third-party-managed platform. The announcement follows several recent actions against suspected members of the hacking network. “Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group,” Patel said.
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
CISA has added a long-standing Apache Struts flaw, tracked as CVE-2016-3081, to its Known Exploited Vulnerabilities catalog after confirming that attackers are using it in real-world attacks. The issue is a command injection vulnerability in Apache Struts that can allow a remote attacker to run code on a vulnerable server when Dynamic Method Invocation is enabled. CISA added the vulnerability on October 8, 2026, and gave U.S. federal civilian agencies until October 11 to address it under Binding Operational Directive 26-04.
NVIDIA DCGM Exporter Bug Exposes GPU Servers to Resource Exhaustion Attacks
NVIDIA patched high-severity flaw CVE-2026-47483 in DCGM Exporter that allows unauthenticated remote attackers to exhaust server resources, crash GPU monitoring, and disrupt AI workloads. DCGM Exporter is a common monitoring tool for GPU servers and Kubernetes clusters. It reads details such as GPU model, temperature, memory use, power draw, errors, and workload activity, then serves the data in a Prometheus-friendly format over HTTP. A unique UUID also lists each GPU.
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. ReliaQuest reports that multiple threat groups, including Qilin and Settra, are using the flaw to create unauthorized VPN sessions and enter internal networks through trusted remote access services. The activity presents a serious detection challenge because attackers connect through an organization’s own VPN.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
FBI Arrests Founder of Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]
New Agentic AI Red Team Checklist Adds 222 Tests Across 20 Attack Categories
A free agentic AI red-team checklist offers 222 tests across 20 attack categories to assess autonomous AI systems beyond prompt injection, covering infrastructure, cloud access, tools, memory, and agent communications. The checklist targets a common testing gap. Teams may spend days trying to manipulate a model while overlooking an exposed MLflow server, a reachable cloud metadata endpoint, or a missing customer-isolation filter. These weaknesses can expose credentials and private records without requiring a complex attack against the model itself.
Let’s Encrypt Cuts TLS Certificate Lifetimes From 90 to 64 Days Starting February 2027
Let’s Encrypt will cut its default TLS certificate lifetime from 90 days to 64 days on February 10, 2027, giving website operators less time between renewals. The change applies to certificates issued or renewed from that date, while subscribers can still choose shorter certificate profiles offering 45 days or roughly six days. Let’s Encrypt Certificate Lifetime According to the October 7 announcement published by Let’s Encrypt, the nonprofit certificate authority confirmed the schedule.
New Anthropic OSS Scanner Tool to Scan Open-source Repositories for Vulnerabilities
Anthropic has introduced OSS Scanner, a free service that checks critical open-source repositories for security vulnerabilities and sends findings directly to project maintainers. The opt-in program uses the company’s strongest AI models to run repeated scans, giving developers a faster route to potential flaws without waiting for human review. According to Anthropic’s service overview, OSS Scanner builds on its work with Project Glasswing. The company says it had reviewed more than 6,000 vulnerability reports by October 2026 through its existing disclosure process.
Citrix warns admins to patch new NetScaler RCE flaw immediately
Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. [...]
React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request
A high-severity denial-of-service flaw (CVE-2026-23870) in React Server Components can allow a remote attacker to freeze vulnerable Next.js servers by sending a specially crafted POST request to a Server Function endpoint. The issue has a CVSS score of 7.5 and affects React Server Components packages used by React 19.x applications, including many Next.js deployments using Server Actions. The vulnerability stems from the way React rebuilds submitted form data before a Server Action runs. An attacker does not need to break into the application or access protected data.
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. [...]
Anthropic Cyber Mission to Support Defenders with Tools, Research, and Resources
Anthropic launched its Anthropic Cyber Mission on October 8, 2026, to help security teams protect critical infrastructure and open-source software. The effort combines advanced Claude models, engineers, threat research, and funding, with an emphasis on fixing weaknesses rather than simply producing more vulnerability reports. The launch introduces the Critical Infrastructure Defense Program and OSS Scanner, a free service for participating open-source projects. Anthropic says the mission builds on Project Glasswing, where faster bug discovery exposed a difficult problem.
Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability
Citrix has urged customers to patch a critical security flaw in NetScaler ADC and NetScaler Gateway that could allow remote code execution or cause a denial of service. Tracked as CVE-2026-107406, the memory overflow vulnerability carries a CVSS v4.0 score of 9.5 and affects appliances with specific SAML settings. The security bulletin, CTX697191, was published on October 8, 2026. Citrix said it was not aware of any unmitigated exploits when the bulletin was published. That statement should not be read as proof that every deployment is safe.
FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
The FBI and U.S. Justice Department have seized seven domains tied to Microscan and FishHub, two hacking tools allegedly operated by China-based Integrity Technology Group. Announced on October 8, 2026, the court-authorized action aims to cut access to systems used to scan critical infrastructure, support spear phishing, and steal files from compromised networks. Court documents unsealed in the Western District of Pennsylvania link the activity to Flax Typhoon, a hacking group tracked by security researchers.
FBI disrupts Chinese hacking tools used to breach critical infrastructure
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
[CVE-2023-22894] Strapi Strapi — Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
[CVE-2016-3081] Apache Struts — Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
[CVE-2015-5477] ISC BIND — ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
DarkSword operators are using Coruna malware to steal cryptocurrency wallet recovery phrases from iPhones, turning browser exploits into a ready-to-use theft service. Exposed server directories revealed wallet modules, command systems, and records of stolen data, giving researchers a closer look at how the platform works beyond its initial exploit chain. A copy of one production server contained 11 victim recovery phrases, 179 device loot directories, and a roster of 75 operator accounts. Those records point to a commercial operation with agents, commissions, and device limits.
Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts
Scanning and remote code execution attempts targeting video surveillance devices in Ukraine rose between September 21 and October 1, 2026. Most activity focused on CVE-2021-36260, a critical command injection flaw in unpatched Hikvision products. The surge occurred alongside Russian missile and drone strikes, but researchers have not established a connection between the cyber activity and those attacks. The findings highlight renewed interest in an older vulnerability that can let attackers control exposed cameras and recording equipment without signing in.
Cisco warns of critical flaws allowing Nexus switch takeover
Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. [...]
PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution
A public PoC targets a critical Zammad flaw, CVE-2026-102489, allowing unauthenticated remote users to steal active session cookies and potentially execute code on vulnerable servers. The issue was associated with a breach reported in September at the Dutch Institute for Vulnerability Disclosure (DIVD), where two zero-day flaws in Zammad were reportedly exploited to gain access and escalate privileges.
PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution
A proof-of-concept (PoC) exploit has been released for a critical vulnerability in LMCache that can allow unauthenticated remote code execution on exposed distributed deployments. Tracked as CVE-2026-105192, the flaw has a CVSS score of 9.8 and affects LMCache versions beginning with 0.3.9. As of October 7, JFrog Security Research reported no fixed release. The vulnerability, identified by Yuval Moravchick of the JFrog Security Research Team, exists in LMCache’s multiprocess mode, also known as distributed mode.
Critical Sungrow Inverter Vulnerability Lets Attackers Access Solar Plants Without Passwords
A critical Sungrow inverter vulnerability could have allowed attackers to log in to the company’s iSolarCloud management platform without a valid password. The flaw affected the cloud service used to manage solar plants, inverters, and battery storage systems, creating a serious risk for customers and energy operators in Europe, China, Australia, and other regions. Sungrow Inverter Vulnerability According to research published by Jakkaru, the flaw was a business-logic error in iSolarCloud’s login process.
Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data
Hackers are exploiting CVE-2026-88771, a critical Citrix NetScaler vulnerability, to run commands, install web shells, and collect appliance configuration data. The activity goes beyond simple testing, with malicious scripts designed to maintain access and send stolen files to attacker infrastructure. The flaw affects NetScaler ADC and NetScaler Gateway and allows command execution before authentication. Citrix rates it 9.5 under CVSS 4.0 and says vulnerable default deployments are exposed without any extra feature enabled.
wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass
wolfSSL has released wolfSSH 1.6.0 to fix five security flaws, including a critical host key verification bypass that could let an attacker impersonate an SSH server. Published on October 6, 2026, the update addresses Windows privilege escalation, unauthenticated key exchange abuse, unauthorized forwarding channels, and an SFTP memory corruption bug. The release rates one flaw critical, one high, and three medium. The most serious issue, CVE-2026-16516, affects wolfSSH through version 1.5.0.
Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF
Gitea has released security updates addressing 27 reported flaws across versions 28.0.0 and 28.1.0, including a critical SSH authentication bypass and server-side request forgery (SSRF) weaknesses. The fixes cover account access, repository permissions, automated workflows, and connections to internal systems. Administrators should treat the update as an urgent priority for their development infrastructure. Released on September 30, Gitea 28.0.0 lists 20 CVEs in its security notes. The reported total of 27 spans that release and the follow-up 28.1.0 update, rather than 28.0.0 alone.
Top 10 Best SCA Tools in 2026 [Ranked & Scored]
Nine-tenths of the average codebase arrived via package manager, and attackers noticed years ago. With modern breaches increasingly originating from upstream software supply chain attacks targeting open-source registries, scanning third-party dependencies is no longer optional. We scored ten SCA options with triage quality reachability, malicious-package awareness, fix automation weighted highest, because alert volume without signal is how programs die. Snyk takes 1; Sonatype and Endor Labs complete the podium.
Top 10 Best SCA Tools in 2026 [Ranked & Scored]
Nine-tenths of the average codebase arrived via package manager, and attackers noticed years ago. With modern breaches increasingly originating from upstream software supply chain attacks targeting open-source registries, scanning third-party dependencies is no longer optional. We scored ten SCA options with triage quality reachability, malicious-package awareness, fix automation weighted highest, because alert volume without signal is how programs die. Snyk takes 1; Sonatype and Endor Labs complete the podium.
Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges
Cisco has released security updates for three critical vulnerabilities in Nexus 3000 and 9000 Series switches that could let remote attackers run code with root privileges without logging in. The flaws affect the Next Generation Operation, Administration, and Maintenance feature, known as NGOAM, in Cisco NX-OS Software. Successful attacks could also crash processes, force switches to reload, and disrupt network services. Published on October 7, 2026, Cisco’s security advisory covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. The advisory carries a CVSS base score of 9.8.
Top 10 Best SCA Tools in 2026 [Ranked & Scored]
Nine-tenths of the average codebase arrived via package manager, and attackers noticed years ago. With modern breaches increasingly originating from upstream software supply chain attacks targeting open-source registries, scanning third-party dependencies is no longer optional. We scored ten SCA options with triage quality reachability, malicious-package awareness, fix automation weighted highest, because alert volume without signal is how programs die. Snyk takes 1; Sonatype and Endor Labs complete the podium.
Top 10 Best ASPM Platforms in 2026 [Ranked & Scored]
Application security’s real crisis isn’t missing findings it’s five scanners producing five contradictory backlogs nobody owns. Instead of treating software risks as disconnected alerts, leading organizations unify their scanners into enterprise vulnerability management workflows that trace issues directly to the engineers who wrote the code. We scored ten ASPM platforms with remediation outcomes weighted highest, and read the acquisition tape honestly: the giants (Wiz, CrowdStrike, Snyk, Palo Alto) have been buying this category into their platforms.
Top 10 Best Software Supply Chain Security Tools in 2026 [Ranked & Scored]
The supply chain is four attack surfaces wearing one buzzword dependencies, pipelines, artifacts, and base images and no vendor covers all four. We scored ten tools with surface-coverage honesty weighted highest. With modern threat actors executing sophisticated software supply chain attacks targeting developer environments, evaluating platforms alongside the Top 10 Best Supply Chain Intelligence Security Companies demonstrates that static checklists can no longer safeguard the modern software development lifecycle (SDLC).
Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland
On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. [...]
Elastic Fixes 14 Security Flaws Including One That Lets Attackers Intercept Other Users’ Data
Elastic published 14 security advisories covering Elasticsearch, Kibana, and Elastic Agent/Endpoint, including a high-severity Kibana flaw that lets delegated Fleet users intercept data from other users or teams. Tracked as CVE-2026-102406, the Kibana flaw carries a CVSS score of 8.8. It affects Fleet’s package installation process, which failed to verify ownership before applying uploaded integration settings to an existing data stream.
Discord Users’ Data Exposed in Security Bot Double Counter Security Breach
Double Counter, a Discord security bot, has disclosed a breach that exposed user data after an attacker broke into its cloud systems on October 4, 2026. Attackers copied about 12 GB of database records, and the stolen bot token was used to post unwanted invitations across roughly 50 large Discord servers. According to Double Counter’s official incident report, the attack is contained and service was restored at 19:19. Investigators audited 14 cloud projects and found no backdoors. The breach involved the bot provider’s infrastructure, not a confirmed compromise of Discord itself.
3 lessons from frontier AI vulnerability research
In this article Shift 1. From frontier capability to scale Shift 2. From token consumption to reasoning economics Shift 3. Validation and remediation as a continuous learning loop Transferring security research to help open source projects Open-source vulnerability reporting snapshot Measured costs of automated validation FORGE OSS Bug Hunt Party: Human coordination at scale (Hackathon) Akrites: Coordinated effort to remediate vulnerabilities What’s next for FORGE Lab?
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging library. A single network
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10
SonicWall has patched four vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances, including a critical server-side request forgery (SSRF) flaw with a maximum CVSS score of 10.0. The bug could let a remote attacker without valid credentials make the appliance send requests on their behalf, reach internal functions, and perform unauthorized operations. The company published security advisory SNWLID-2026-0017 on October 6, 2026. SonicWall said it currently has no evidence that any of these four vulnerabilities are being exploited in the wild.
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
CyberXero has emerged as an initial access broker that combines familiar hacking tools with artificial intelligence to run large-scale intrusions. The Russian-speaking operator targeted WordPress and e-commerce sites worldwide while separately probing Ukrainian energy and utility organizations. The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session records and stolen data. The evidence indicates that the operation remained active during the investigation, raising concern that compromised access could be sold or reused.
Cybersecurity Awareness Month 2026 – Don’t Make It Easy for Them
Cybersecurity Awareness Month 2026 arrives as online attacks become easier to launch, harder to spot, and more focused on people. Observed every October, the campaign helps individuals and businesses build safer digital habits. This year there are two themes. The NCA is running “Don’t Make It Easy for Them”, a push to make life harder for cybercriminals through small daily habits. CISA is running “Securing the Next 250”, tied to America’s 250th anniversary, with a strong focus on critical services like power and water. The message is not limited to the U.S.
Critical Progress DataDirect GenAI Flaw Lets Malicious OpenAPI Files Execute OS Commands
Progress disclosed critical command injection flaw CVE-2026-91140 in DataDirect Autonomous REST Connector AI Model Generator agents, allowing malicious OpenAPI or Swagger documents to execute arbitrary OS commands. The security bulletin, published on October 6, 2026, covers Early Access agent definitions available through the public progress/datadirect-arc-ai-model-gen GitHub repository. Progress has released updated definitions and urges customers to retrieve them before running the agents again. The vulnerability originates from a filename value derived from an OpenAPI or Swagger document.
Anthropic Mythos AI Finds Rejetto HFS Flaw That Lets Attackers Forge Admin Sessions and Execute Code
Anthropic’s Mythos AI has identified a critical vulnerability in Rejetto HTTP File Server that could allow remote attackers to forge administrator sessions and execute arbitrary code. The issue, tracked as CVE-2026-61500, stems from predictable session-signing keys generated through JavaScript’s non-cryptographic Math.random() function. Horizon3 made the finding after joining Anthropic’s Project Glasswing in July 2026, which uses the Mythos Preview model and industry partners to identify and fix critical and open-source software flaws.
Veeam Backup and Replication Vulnerability Allow Attackers to Execute Malicious Script
Veeam has released Veeam Backup & Replication 12.3.2 P4, build 12.3.2.4934, to address four security vulnerabilities, including a flaw that lets attackers execute malicious scripts in an authenticated user’s browser. Released on October 6, 2026, the update also fixes a critical remote code execution vulnerability affecting the backup server. The vulnerabilities carry CVSS 4.0 scores ranging from 4.8 to 9.4. They involve browser script execution, insecure deserialization, unauthorized access to sensitive configuration data, and arbitrary file reading.
Google Chrome Update Fixes Massive 247 Vulnerabilities, Including 4 Code Execution Flaws
Google released a major Chrome security update on October 6, 2026, fixing 247 vulnerabilities, including four critical memory-safety flaws, across Windows, Mac, and Linux. The patched versions are 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux. Although the critical bugs raise concerns about possible code execution, Google’s announcement identifies them as use-after-free vulnerabilities. It does not describe specific exploitation methods or confirm arbitrary code execution. The first critical vulnerability, CVE-2026-106382, affects Chromecast.
Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks
WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses. The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported. The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, severity scores, or confirmed exploitation details.
Caught in 4K: The Gentlemen Files | CloudSEK
Caught in 4K: The Gentlemen Files | CloudSEK 🚀 CloudSEK featured in the 2026 Frost Radar™! Read more 🚀 Introducing the CloudSEK MCP Server! Read more 🚀 CloudSEK becomes first Indian origin cybersecurity company to receive investment from US state fund Read more 🚀 CloudSEK Becomes First Indian Cybersecurity Firm to partner with The Private Office Read more 🚀 CloudSEK has raised $19M Series B1 Round – Powering the Future of Predictive Cybersecurity Read more Products AIVigil AI Attack Surface Monitoring XVigil Digital Risk protection BeVigil Attack Surface monitoring SVigil Third party Risk…
Anthropic Opens Claude Access to Red Teams and Verified Cyber Defenders With Reduced Restrictions
Anthropic has expanded its Cyber Verification Program, giving verified security professionals access to advanced Claude models with fewer cybersecurity restrictions. Announced on October 6, 2026, the update introduces three access tiers covering defensive research, authorized penetration testing, and testing of systems where failures could threaten lives or disrupt markets. The program includes Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models.
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]
CISO perspectives on managing vulnerability risks in the age of AI
Most of what has been written about AI and vulnerability management focuses on speed: how much faster frontier AI models can scan code, find weaknesses, design patches, and build exploits than any human team. That part is true, and it matters to how we remediate vulnerabilities. The more challenging question is what happens after the scan? Frontier AI models are about to hand every security team a far larger set of findings than they have ever had to work through. The real test for chief information security officers (CISOs) and IT security leaders is not how fast they can patch.
Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks
Four security flaws described in the supplied Apache Struts advisories could expose affected applications to remote code execution, denial-of- service, and unintended data disclosure. Recommended fixes include Struts 7.4.0 or later, or Struts 6.12.0 or later for organizations using the 6.x maintenance line. The vulnerabilities affect different framework components, so exposure depends on application configuration and functionality. Three issues carry a Moderate security rating, while an unrestricted request body issue in the REST plugin is rated Important.
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
Torrance, Californina, October 6th, 2026, CyberNewswire Criminal IP by AI SPERA, a cyber threat intelligence platform delivering decision-ready intelligence and attack surface visibility to security teams worldwide, will participate in GovWare 2026 in Singapore. As security operations increasingly move beyond asset discovery toward understanding, prioritizing, and responding to exposure, Criminal IP is introducing AITEM (AI-Powered Threat Exposure Management), its vision for the next evolution of Attack Surface Management.
Iranian Hackers Use Fake Dubai Airports Coding Test to Target Iraqi Critical Infrastructure
Iranian state-aligned hackers have used a fake Dubai Airports recruitment process to target Iraqi critical infrastructure with a booby-trapped coding test. The campaign, called Blinder Tunnel, turned a routine developer task into a quiet, potentially long-term route for remote access, persistence and network tunneling across a victim environment. The operation was prepared as early as November 2025 and activated in March 2026 against a likely Iraqi software engineer.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Hackers are exploiting internet-connected industrial controllers to disrupt US water utilities and other essential services. Recent incidents show that poorly protected equipment can give attackers direct access to physical operations, with consequences ranging from lost monitoring to flooding and reduced water pressure. The threat involves several campaigns rather than one newly discovered malware family. Attackers exploit exposed devices, weak passwords, insecure remote access, and legitimate engineering functions.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User
Dell has released security updates for five vulnerabilities in Dell System Update (DSU), including a critical flaw that could let an unauthenticated remote attacker execute code with root privileges. The issues affect versions before 2.3.0.0, and Dell urges customers to upgrade at the earliest opportunity. The company published security advisory DSA-2026-324 on October 1, 2026. DSU is a command-line tool that helps administrators deploy BIOS, firmware, and software updates across Dell PowerEdge servers running Linux and Windows, making its security important for enterprise server management.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short. Earlier this year, our team at OX Security, traced critical vulnerabilities in Anthropic's MCP
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42.
ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
ClingSTUN is a Linux backdoor that exploits vulnerable internet-connected devices to give attackers lasting remote access. Rather than simply infecting routers and cameras, it turns compromised equipment into remotely controlled proxy nodes that can relay traffic and run commands. The campaign targets known security flaws across multiple vendors, expanding its attack methods as it evolves. Unpatched firmware, unsupported hardware, and exposed services create openings for infections that can survive device restarts and conceal their activity from routine checks.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
FBI Removes Accenture Contractor After Unpatched PeopleSoft Flaw Exposes Thousands of Employees
The FBI removed an Accenture contractor on October 5, 2026, after a missed security patch led to a data breach exposing sensitive personal details of thousands of employees. According to Reuters, two sources identified Oracle’s PeopleSoft human resources platform as the affected system and Accenture as the service provider. FBI cyber chief Brett Leatherman said the bureau’s review found that a contractor failed to install a patch issued to secure a platform managed by a third party. He said the FBI had removed the contractor and taken steps to reduce further risk and protect its workforce.
Google Adds 6 Advanced Protection Features to Android 17 Against Sophisticated Attacks
Google has detailed six Advanced Protection enhancements for Android 17, targeting sophisticated attacks, scams and unauthorized access. Announced on October 1, 2026, the changes combine stronger restrictions with tools that preserve evidence when someone suspects their phone has been compromised. The update expands protections introduced with Android 16 rather than announcing a newly discovered malware campaign. Building on Android 16 security protections, the approach brings security controls together for journalists, elected officials, public figures and other users facing elevated risks.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
Top 10 Best Just-in-Time (JIT) Access Tools in 2026 [Ranked & Scored]
Credentials that always work are credentials worth stealing which is why mitigating how attackers exploit privileged access has driven organizations toward Zero Standing Privileges (ZSP) and made JIT access mandatory infrastructure. Credentials that always work are credentials worth stealing which is why zero standing privileges became the destination and JIT the road. We scored the leading options with expiry automation and lane coverage weighted highest. CyberArk takes 1 on governed depth; Britive and Microsoft’s bundled PIM complete the podium.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
The AI-code flood made one truth undeniable: static analysis only matters if developers fix what it finds. We scored ten SAST tools with fix-rate potential precision, PR-fit, and remediation quality weighted highest. At the same time, enforcing strict secure coding practices remains the most cost-effective way to stop injection attacks, memory leaks, and broken logic before pull requests ever merge. Snyk Code takes #1 on developer gravity; GitHub CodeQL and Semgrep complete a podium that says the developer lane won. Key Takeaways • 1 overall: Snyk Code findings at IDE speed, fixes in the PR.
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others
New Dell System Update flaw lets hackers gain root privileges
Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. [...]
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and
Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories
This week’s security newsletter was dominated by a Pentagon personnel data breach affecting more than three million people, actively exploited zero-days in Apple CoreGraphics and Fortinet FortiMail, and reports of two still-unpatched Citrix NetScaler RCE flaws. The broader bulletin covers 26 developments spanning cloud identity, malware, AI-agent governance, remote access, browser security, vulnerable infrastructure, and defensive tooling. Pentagon Data Breach The Pentagon confirmed that unautho
[CVE-2026-88779] Citrix NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to
Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000
Vercel has confirmed a KVM zero-day vulnerability after security researcher Paulos Yibelo reported a full virtual machine escape that, he says, allows code inside a guest to gain root access on the host. Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon pic.twitter.com/dt9AsDO0De — Paulos Yibelo (@PaulosYibelo) October 3, 2026 The discovery came through the Vercel Sandbox bug bounty program, raising concerns about a security boundary used to contain untru
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the
Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks
GitLab has released urgent security updates for a critical AI Gateway vulnerability that could allow authenticated attackers to execute commands remotely. Tracked as CVE-2026-90970, the flaw carries a CVSS score of 9.9 and affects self-hosted deployments used to support GitLab Duo AI features. The company released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the issue. GitLab strongly recommends that customers running affected self-hosted gateways upgrade immediately. It also contac
Debian has Patched 1,313 Flaws in Massive Update Leading to DoS and Privilege Escalation Attacks
Debian has released a major Linux kernel security update covering 1,313 CVE entries, addressing flaws that could allow privilege escalation, denial of service, and information leaks. The fixes are available for Debian’s stable release, Trixie, in Linux source package version 6.12.111-1. Security team member Salvatore Bonaccorso published advisory DSA-6528-1 on September 29, 2026. Debian recommends upgrading the affected linux packages. Importantly, the update prevents potential attacks; the advi
Citrix NetScaler Keeps Rebooting Following the 0-Day Patch
Citrix NetScaler customers are reporting repeated appliance reboots after installing build 14.1-73.37, the emergency update released for two zero-day flaws under active attack. The failures appear linked to crafted SAML authentication traffic that crashes the nsaaad service. Citrix says its engineering and support teams are tracking a newly seen SAML issue and plan to release a fresh security bulletin and fixed build. The key point is that the reboot reports do not yet prove attackers have bypas
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the Amazon aws-smithy-json runtime crate in versions 0.62.6 and earlier. Impact Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with API_AUTH_KEY set (F2), unauthenticated file write of.py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost ports credentialed cross-origin access (F-A4), and partial API-key disclosure via _mask_secret() (F-A5). --- Shared baseline (applies t
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Summary The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS. No non-default configuration is required; the Basic Catalog is enabled by def
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Affected files * dulwich/index.py (Methods: validate_path_element_ntfs, _tree_to_fs_path) * dulwich/porcelain/init.py (Method: _checked_worktree_path) Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for validating NTFS paths strictly reject.git variants, Alternate Data Streams (ADS), git~1 short names, and reserved device names, but they completely fail to check fo
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a low-privilege authenticated user can make the server issue POST requests to internal-only services and cloud metadata endpoints (for example http://169.254.169.254/). No private-IP, scheme, or redire
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Summary Dulwich's porcelain.checkout(paths=[...]) code path writes files using raw os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode) followed by f.write(obj.data). This code path does NOT call build_file_from_blob() at all, completely bypassing any symlink protections (including the unreleased d09f8af fix). os.open without O_NOFOLLOW follows symlinks at both the target file and intermediate directories, allowing arbitrary file writes. Root Cause At dulwich/porcelain/init
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems. The vulnerabilities are listed below - CVE-2026-63688 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. The flaw