GitLab security advisory. The standout CVE is a 10.0 critical CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

This was serious enough that CERT-EU published an alert for it: https://cert.europa.eu/publications/security-advisories/2026-016/

#gitlab #cve

A GitLab critical vulnerability, CVE-2026-97229 (CVSS 10.0), allows unauthenticated arbitrary code execution. Upgrade to GitLab 19.4.2 now.

#GitLab #CVE202697229 #ArbitraryCodeExecution #CICD #DevSecOps #PatchNow #CyberSecurity

https://securityonline.info/gitlab-cve-2026-97229-arbitrary-code-execution/?utm_source=mastodon&utm_medium=jetpack_social

GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code

https://securityonline.info/gitlab-cve-2026-97229-arbitrary-code-execution/

#GitLab #CVE202697229 #perfect10

En savoir plus sur cette mise à jour 👉 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

En savoir plus sur la CVE-2026-97229 notée CVSS 10.0 👉 https://gitlab-com.gitlab.io/gl-security/product-security/appsec/cvss-calculator/explain#explain=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Tak @joaxcar 👉 https://hackerone.com/joaxcar

Toutes les instances GitLab de nos clients sont à jour version 19.4.2

Cette mise à jour critique vient corriger 24 vulnérabilités de sécurité, dont une faille critique notée CVSS 10.0 (CVE-2026-97229)

Donc, we keep Calm and on met à jour (rapidement) !

En savoir plus sur notre offre, contactez nous 👇
https://bearstech.com/contact

Daily Briefing: Windows 11 24H2 Support Ends Tuesday, Plus 3 Stories https://raymondtec.com/2026/10/windows-11-24h2-support-ends-tuesday-plus-3-stories/

Windows 11 24H2 Home and Pro stop receiving updates October 13. Plus fake Claude installers, an exploited SonicWall flaw, and satellite-to-phone changes.

#TechNews #Anthropic #ClickFix #CVE2026102255 #microsoft #SatelliteConnectivity #SonicWall

Critical SonicWall Vulnerability Exploited Days After Disclosure

CVE-2026-102255, a critical pre-authenticated SSRF flaw in SonicWall, is being exploited in the wild just days after disclosure. Successful exploitation could allow attackers to perform unauthorized operations on affected devices, and administrators are urged to patch immediately. https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/

⚠️ CRITICAL: Critical SonicWall Vulnerability Exploited Days After Disclosure

A critical pre-authenticated SSRF vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances is actively exploited in the wild days after disclosure. Unauthenticated attackers can force vulnerable devices to issue arbitrary requests, leading to full device compromise. Any unpatched SonicWall S…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Threat actors actively exploited a critical pre-authenticated server-side request forgery flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.

The issue, tracked as CVE-2026-102255 with a maximum CVSS score of 10.0, allowed remote attackers to direct the appliance to issue requests and reach internal functionality.

SonicWall released patches on October 6, 2026, in versions 12.4.3-03670 a…

https://en.hacks.gr/xekinisan-epitheseis-se-syskeyes-sonicwall-liges-imeres-meta-ti-diorthosi-provlimatos-asfaleias/

#SonicWall #SSRF #Vulnerability #Patch

⚠️ CRITICAL: Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

SonicWall SMA 1000 appliances are being actively exploited for a critical pre-authenticated SSRF vulnerability (CVE-2026-102255). Attackers have already made 135 exploitation attempts post-disclosure. This allows remote attackers to force the appliance to issue requests on their behalf, potentially…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

[1/2] SonicWall SMA1000 CVE-2026-102255 (CVSS 10): SSRF pre-auth nell'interfaccia WorkPlace, che fa emettere all'appliance richieste verso funzioni interne. Patch del 6/10; dall'8/10 Defused e Previdian vedono tentativi di sfruttamento sui loro honeypot (Previdian: 135 tentativi da 2 IP USA). Nessuna compromissione confermata; l'advisory SonicWall non lo marca ancora come sfruttato. Horizon3.ai: possibile takeover del device.

#cybersecurity #infosec

Recent developments (Oct 11-12, 2026): Drone strikes crippled a third Yandex data center in Russia. AI models demonstrated autonomous industrial control system attacks in Booz Allen labs. A critical SonicWall vulnerability (CVE-2026-102255) is under active exploitation. Geopolitically, Trump claimed an "energy ceasefire" for Russia-Ukraine despite continued conflict. A Houthi missile strike killed 12+ at Riyadh airport, escalating regional tensions.
#AnonNews_irc #Cybersecurity #News

Critical SonicWall Flaw Targeted Just Two Days After Disclosure https://www.esecurityplanet.com/threats/news-sonicwall-sma1000-cve-2026-102255-exploitation/

⚠️ No login required. CVSS 10.0. Active exploitation.

Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.

Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.

Read - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html

⚠️ CRITICAL: Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

Bricksforge WordPress plugin (CVE-2026-85097) has a CVSS 10.0 flaw allowing unauthenticated remote code execution. Attackers are actively exploiting this to run arbitrary PHP on vulnerable sites. Any WordPress instance running the affected plugin is at immediate risk of full compromise.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE-2026-85097 | Bricksforge WordPress plugin <=3.1.8.9 faces a HIGH severity vuln exploited in the wild. Attackers can upload arbitrary files for RCE. Update to 3.1.8.10 immediately. https://radar.offseq.com/threat/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild-294d102eaf91b415 #OffSeq #WordPress #Vuln #Infosec

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity flaw in the Bricksforge plugin for WordPress is under active exploitation, The Hacker News reports. CVE-2026-85097 (CVSS 10.0) lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites; versions up to 3.1.8.9 are affected and a patch is available in version 3.1.8.10. https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html

Come Wednesday, CVE-2026-92392 is the #curl CVE everyone will think either was blown out of proportions or was underestimated or something else. That happened the last time we reported a HIGH severity issue and I expect it to happen again.

libcurl is a rather generic LIBRARY - it is used in almost every device on earth, how the heck can we tell how important a particular mistake is for each and every use case? We can't. You need to read the advisory and figure it out yourself.

🚨 CVE-2026-21589 is a critical Atlassian file-read vulnerability in Jira, Confluence, and Bitbucket Data Center, already being targeted in the wild.

CrowdSec has tracked 89 unique IPs sending matching requests since October 7.
Patching closes the hole. But if your instance was exposed, rotate the Crowd application password and check your Jira admin accounts.

Read the latest Threat Alert article to get the analysis → https://www.crowdsec.net/vulntracking-report/cve-2026-21589-atlassian-jira-confluence-flaw-exploited

📰 New Critical RCE Flaw Found in Patched Citrix NetScaler Appliances

Citrix issues another emergency patch for a critical RCE flaw (CVE-2026-107406, CVSS 9.5) in NetScaler ADC & Gateway. The bug affects even recently patched builds. Upgrade immediately if your appliance is a SAML IdP. #Citrix #NetScaler #CVE

🔗 https://cyber.netsecops.io/articles/critical-rce-flaw-cve-2026-107406-found-in-patched-citrix-netscaler-appliances/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CISA has added Apache Struts vulnerability CVE-2016-3081 (CWE-77) to its Known Exploited Vulnerabilities catalog.

The command injection flaw affects versions 2.3.19 through 2.3.28 with Dynamic Method Invocation enabled.

U.S. federal civilian agencies were given a tight deadline under BOD 26-04 to apply fixed releases such as 2.3.20.3, 2.3.24.3, and 2.3.28.1, or implement mitigations.

CISA also flagged the issue as requiring…

https://en.hacks.gr/palio-provlima-sto-apache-struts-axiopoieitai-energa-se-epitheseis-symfona-me-ti-cisa/

#ApacheStruts #CISA #CVE20163081 #BOD2604

A security issue in Discourse allowed basic users with a baseline account to read server files through image uploads.

Researchers reported the findings in June 2026, alongside a separate cache poisoning flaw affecting anonymous visitors.

The vendor issued CVE-2026-55420 and released patched versions including 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

https://en.hacks.gr/diorthothikan-kena-asfaleias-stin-platforma-discourse-poy-epetrepan-tin-klopi-archeion/

#Discourse #OpenSource #WebSecurity #Vulnerability

Two Discourse vulnerabilities, CVE-2026-55674 and CVE-2026-55420, enable cache poisoning XSS and server file reads. Patch to the fixed releases now.

#Discourse #CVE202655674 #CVE202655420 #CachePoisoning #XSS #ImageMagick #VulnerabilityReport #CyberSecurity

https://securityonline.info/discourse-vulnerabilities-cve-2026-55674-cve-2026-55420/?utm_source=mastodon&utm_medium=jetpack_social

IBM i 7.3 – 7.6 HTTP Server Admin is vulnerable (CVE-2026-96119, CRITICAL, CVSS 9.9). Remote authenticated code execution possible via code injection. Patch urgently. https://radar.offseq.com/threat/cve-2026-96119-cwe-94-improper-control-of-generation-of-code-code-injection-f55b8a017b9f656e #OffSeq #IBM #CVE202696119 #infosec

Three IBM critical vulnerabilities, rated up to CVSS 9.9, hit IBM i, Db2 Mirror and Maximo AI Service, including remote code execution. Patch now.

#IBM #IBMi #Maximo #Db2 #CVE202696119 #CVE202696012 #CVE202690920 #RemoteCodeExecution #CyberSecurity

https://securityonline.info/ibm-critical-vulnerabilities-ibm-i-db2-maximo/?utm_source=mastodon&utm_medium=jetpack_social

A critical Ghostscript vulnerability, CVE-2026-39919 (CVSS 9.8), allows remote code execution via crafted PDFs. Update Ghostscript to 10.08.0 now.

#Ghostscript #CVE202639919 #RemoteCodeExecution #WordPress #Wordfence #Linux #PatchNow #CyberSecurity

https://securityonline.info/ghostscript-vulnerability-cve-2026-39919/?utm_source=mastodon&utm_medium=jetpack_social