https://firewallchronicle.com/Threats, vulnerabilities and fixes — firstenWed, 21 Oct 2026 16:49:56 +0000https://firewallchronicle.com/topic/vulnerabilities/cisco-expressway-out-of-bounds-write-flaw-rated/https://firewallchronicle.com/topic/vulnerabilities/cisco-expressway-out-of-bounds-write-flaw-rated/Wed, 21 Oct 2026 16:33:54 +0000VulnerabilitiesCisco hardens Expressway software to fix an out-of-bounds write vulnerability identified during an internal security review of the product.https://firewallchronicle.com/topic/vulnerabilities/pillow-pdf-append-flaw-triggers-recursionerror-in/https://firewallchronicle.com/topic/vulnerabilities/pillow-pdf-append-flaw-triggers-recursionerror-in/Wed, 21 Oct 2026 09:14:21 +0000VulnerabilitiesA high-severity vulnerability in Pillow allows crafted PDFs to exhaust resources during append operations, risking denial of service for affected Python applications.https://firewallchronicle.com/topic/vulnerabilities/tenda-ac19-web-management-service-exposes/https://firewallchronicle.com/topic/vulnerabilities/tenda-ac19-web-management-service-exposes/Wed, 21 Oct 2026 07:16:37 +0000VulnerabilitiesPublic exploit code targets a stack-based overflow in the Tenda AC19 firewall configuration endpoint, rated critical by the NVD.https://firewallchronicle.com/topic/vulnerabilities/php-security-team-plans-oct-21-release-for-two-9/https://firewallchronicle.com/topic/vulnerabilities/php-security-team-plans-oct-21-release-for-two-9/Wed, 21 Oct 2026 04:29:08 +0000VulnerabilitiesThe PHP project confirms an October 21 release addressing two vulnerabilities rated 9.2 on CVSS v4.0, impacting environments running the language.https://firewallchronicle.com/topic/vulnerabilities/totolink-x2000r-heap-buffer-overflow-in-upload/https://firewallchronicle.com/topic/vulnerabilities/totolink-x2000r-heap-buffer-overflow-in-upload/Wed, 21 Oct 2026 03:23:52 +0000VulnerabilitiesAuthenticated HTTP requests can trigger a critical heap buffer overflow in the router’s upload handler, enabling arbitrary code execution on the device.https://firewallchronicle.com/topic/vulnerabilities/totolink-x2000r-boa-vpnpassword-stack-overflow/https://firewallchronicle.com/topic/vulnerabilities/totolink-x2000r-boa-vpnpassword-stack-overflow/Wed, 21 Oct 2026 02:22:56 +0000VulnerabilitiesAuthenticated attackers can trigger arbitrary code execution via stack-based buffer overflows in the boa web server’s vpnPassword parameter handling on specific firmware builds.https://firewallchronicle.com/topic/vulnerabilities/trigger-dev-cli-csrf-flaw-in-authorization-flow/https://firewallchronicle.com/topic/vulnerabilities/trigger-dev-cli-csrf-flaw-in-authorization-flow/Wed, 21 Oct 2026 01:42:23 +0000VulnerabilitiesA cross-site request forgery vulnerability in Trigger.dev versions prior to 4.5.2 enables attackers to steal personal access tokens via a malicious link.https://firewallchronicle.com/topic/vulnerabilities/totolink-x2000r-stack-overflow-in-static-dns1/https://firewallchronicle.com/topic/vulnerabilities/totolink-x2000r-stack-overflow-in-static-dns1/Wed, 21 Oct 2026 01:14:54 +0000VulnerabilitiesAuthenticated HTTP requests targeting the static_dns1 parameter in Totolink X2000R firmware can trigger critical stack-based buffer overflows and arbitrary code execution.https://firewallchronicle.com/topic/vulnerabilities/wordpress-tinymce-thumbnail-gallery-path/https://firewallchronicle.com/topic/vulnerabilities/wordpress-tinymce-thumbnail-gallery-path/Tue, 20 Oct 2026 23:06:29 +0000VulnerabilitiesUnauthenticated attackers can read arbitrary files in WordPress sites running TinyMCE Thumbnail Gallery versions prior to 1.1.0 via a path traversal flaw.https://firewallchronicle.com/topic/vulnerabilities/python-certifi-critical-patch-strips-root/https://firewallchronicle.com/topic/vulnerabilities/python-certifi-critical-patch-strips-root/Tue, 20 Oct 2026 20:01:06 +0000VulnerabilitiesThe Python certifi package issued a critical update on Oct 20, 2026, to remove root certificates from its trust store.https://firewallchronicle.com/topic/vulnerabilities/adobe-acrobat-for-edge-out-of-bounds-write-allows/https://firewallchronicle.com/topic/vulnerabilities/adobe-acrobat-for-edge-out-of-bounds-write-allows/Tue, 20 Oct 2026 19:10:35 +0000VulnerabilitiesA high-severity flaw in Adobe Acrobat for Edge lets attackers run code via malicious files, requiring user interaction to trigger the exploit.https://firewallchronicle.com/topic/vulnerabilities/nss-3-131-1-patch-addresses-security-flaw-cve/https://firewallchronicle.com/topic/vulnerabilities/nss-3-131-1-patch-addresses-security-flaw-cve/Tue, 20 Oct 2026 18:38:04 +0000VulnerabilitiesDevelopers using Mozilla's Network Security Services should update to version 3.131.1 to resolve a security issue tracked under CVE-2026-113470.https://firewallchronicle.com/topic/cloud-security/microsoft-azure-sovereign-ai-design-principles/https://firewallchronicle.com/topic/cloud-security/microsoft-azure-sovereign-ai-design-principles/Tue, 20 Oct 2026 11:15:06 +0000Cloud SecurityMicrosoft outlines a shared foundation for sovereign AI, enabling organizations to place workloads in compliant environments while maintaining consistent security controls.https://firewallchronicle.com/topic/cyber-attacks/mastercard-stablecoin-security-api-lets-banks/https://firewallchronicle.com/topic/cyber-attacks/mastercard-stablecoin-security-api-lets-banks/Tue, 20 Oct 2026 07:17:41 +0000Cyber AttacksNew tool helps banks identify fraud and sanctions risks in stablecoin payments before funds move on-chain, using combined blockchain and payment data.https://firewallchronicle.com/topic/vulnerabilities/nginx-heap-buffer-overflows-f5-issues-emergency/https://firewallchronicle.com/topic/vulnerabilities/nginx-heap-buffer-overflows-f5-issues-emergency/Tue, 20 Oct 2026 04:24:26 +0000VulnerabilitiesF5 released emergency updates for NGINX products to fix heap buffer overflows that could allow attackers to crash systems or run unauthorized code.https://firewallchronicle.com/topic/vulnerabilities/coze-studio-0-5-0-predecessors-exposed-to-command/https://firewallchronicle.com/topic/vulnerabilities/coze-studio-0-5-0-predecessors-exposed-to-command/Tue, 20 Oct 2026 01:57:46 +0000VulnerabilitiesA default configuration flaw in Coze Studio allows registered users to execute unsandboxed Python code, potentially exposing sensitive credentials and internal services.https://firewallchronicle.com/topic/vulnerabilities/coze-studio-idor-cve-2026-77935-enables-cross/https://firewallchronicle.com/topic/vulnerabilities/coze-studio-idor-cve-2026-77935-enables-cross/Tue, 20 Oct 2026 01:53:51 +0000VulnerabilitiesAn insecure direct object reference in Coze Studio through 0.5.1 allows authenticated users to access and manipulate workflows belonging to other tenants.https://firewallchronicle.com/topic/vulnerabilities/h3c-magic-nx15-os-command-injection-in-usrlist/https://firewallchronicle.com/topic/vulnerabilities/h3c-magic-nx15-os-command-injection-in-usrlist/Tue, 20 Oct 2026 00:23:26 +0000VulnerabilitiesA critical OS command injection flaw in H3C Magic NX15 100R017 firmware allows remote attackers to execute arbitrary commands, with public exploits already available.https://firewallchronicle.com/topic/vulnerabilities/pillow-rank-filter-crash-in-zero-size-images/https://firewallchronicle.com/topic/vulnerabilities/pillow-rank-filter-crash-in-zero-size-images/Mon, 19 Oct 2026 23:31:36 +0000VulnerabilitiesA high-severity flaw in older Pillow versions causes native crashes when processing zero-size images with rank-based filters, resolved in the latest release.https://firewallchronicle.com/topic/vulnerabilities/cognition-api-lacks-auth-enables-unauthenticated/https://firewallchronicle.com/topic/vulnerabilities/cognition-api-lacks-auth-enables-unauthenticated/Mon, 19 Oct 2026 23:12:45 +0000VulnerabilitiesMissing authentication on Cognition's REST endpoints allows attackers to run shell commands as the server process in versions prior to 0.13.0.https://firewallchronicle.com/topic/cyber-attacks/rank-math-pro-vulnerability-malicious-updates-re/https://firewallchronicle.com/topic/cyber-attacks/rank-math-pro-vulnerability-malicious-updates-re/Mon, 19 Oct 2026 22:45:54 +0000Cyber AttacksMalicious updates to Rank Math PRO version 3.0.123 distributed over an 11-hour window can recreate hidden backdoors on every page visit.https://firewallchronicle.com/topic/vulnerabilities/aiohttp-high-severity-resource-exhaustion-flaws/https://firewallchronicle.com/topic/vulnerabilities/aiohttp-high-severity-resource-exhaustion-flaws/Mon, 19 Oct 2026 17:29:22 +0000VulnerabilitiesAttackers can trigger unbounded memory or CPU usage via crafted requests to aiohttp servers running versions prior to 3.14.4.https://firewallchronicle.com/topic/vulnerabilities/siteguard-waf-command-injection-cve-2026-106931/https://firewallchronicle.com/topic/vulnerabilities/siteguard-waf-command-injection-cve-2026-106931/Mon, 19 Oct 2026 12:49:50 +0000VulnerabilitiesAttackers exploit a local command injection flaw in SiteGuard WAF to gain root or SYSTEM privileges on servers running vulnerable versions.https://firewallchronicle.com/topic/cyber-attacks/fake-event-ticket-websites-and-how-to-block-them/https://firewallchronicle.com/topic/cyber-attacks/fake-event-ticket-websites-and-how-to-block-them/Mon, 19 Oct 2026 05:41:14 +0000Cyber AttacksDomain monitoring removes the foundational asset attackers rely on long before a single fraudulent transaction occurs.https://firewallchronicle.com/topic/threat-intel/open-source-intelligence-benefits-and-trade-offs/https://firewallchronicle.com/topic/threat-intel/open-source-intelligence-benefits-and-trade-offs/Mon, 19 Oct 2026 05:25:18 +0000Threat IntelligencePublic data exposes defender infrastructure faster than internal monitoring while simultaneously drowning analysis teams in untrusted noise.https://firewallchronicle.com/topic/threat-intel/dark-web-monitoring-services-how-they-work-and/https://firewallchronicle.com/topic/threat-intel/dark-web-monitoring-services-how-they-work-and/Mon, 19 Oct 2026 04:42:15 +0000Threat IntelligenceDark web monitoring services scan hidden networks for leaked credentials and proprietary code, but they cannot prevent the initial compromise that generates the data in the first place.https://firewallchronicle.com/topic/cyber-attacks/x-platform-accounts-of-irish-police-compromised/https://firewallchronicle.com/topic/cyber-attacks/x-platform-accounts-of-irish-police-compromised/Sun, 18 Oct 2026 19:03:37 +0000Cyber AttacksUnauthorized access to official Garda Twitter handles enabled fraudulent cryptocurrency airdrop messages, raising concerns about potential exposure of private direct messages.https://firewallchronicle.com/topic/malware/krybit-ransomware-group-resumes-extortion/https://firewallchronicle.com/topic/malware/krybit-ransomware-group-resumes-extortion/Sun, 18 Oct 2026 10:59:44 +0000Malware & RansomwareThe Krybit ransomware gang continues to extort victims after being hacked by a rival group, indicating that operational disruption does not necessarily halt active extortion campaigns.https://firewallchronicle.com/topic/threat-intel/north-korean-it-schemes-used-stolen-identities-to/https://firewallchronicle.com/topic/threat-intel/north-korean-it-schemes-used-stolen-identities-to/Sun, 18 Oct 2026 09:07:40 +0000Threat IntelligenceFederal authorities announced actions against North Korean schemes that used stolen identities to infiltrate over 70 US companies, highlighting identity theft risks.https://firewallchronicle.com/topic/vulnerabilities/whaticket-community-auth-bypass-enables/https://firewallchronicle.com/topic/vulnerabilities/whaticket-community-auth-bypass-enables/Sat, 17 Oct 2026 21:57:20 +0000VulnerabilitiesA critical flaw in WhaTicket Community allows attackers to register as administrators without credentials, exposing tickets and settings.https://firewallchronicle.com/topic/vulnerabilities/misaka-danmu-server-auth-bypass-allows-admin/https://firewallchronicle.com/topic/vulnerabilities/misaka-danmu-server-auth-bypass-allows-admin/Sat, 17 Oct 2026 16:45:22 +0000VulnerabilitiesUnauthenticated attackers can rewrite configuration keys via an unprotected endpoint to seize administrative control in Misaka Danmu Server.https://firewallchronicle.com/topic/vulnerabilities/hestiacp-authorization-bypass-lets-admins/https://firewallchronicle.com/topic/vulnerabilities/hestiacp-authorization-bypass-lets-admins/Fri, 16 Oct 2026 19:40:47 +0000VulnerabilitiesA high-severity flaw in HestiaCP versions prior to 1.10.5 allows non-root administrators to execute commands as the protected administrator's system account.https://firewallchronicle.com/topic/vulnerabilities/riot-os-atwinc15x0-driver-buffer-overflow-allows/https://firewallchronicle.com/topic/vulnerabilities/riot-os-atwinc15x0-driver-buffer-overflow-allows/Fri, 16 Oct 2026 17:12:46 +0000VulnerabilitiesA critical buffer overflow in the RIOT OS Wi-Fi driver allows nearby attackers to execute code or crash devices by broadcasting oversized network names.https://firewallchronicle.com/topic/malware/ransomware-doxxing-swatting-and-home-intrusions/https://firewallchronicle.com/topic/malware/ransomware-doxxing-swatting-and-home-intrusions/Fri, 16 Oct 2026 13:17:23 +0000Malware & RansomwareAttackers increasingly threaten employees with violence and doxxing to force ransom payments, complicating incident response for security teams.https://firewallchronicle.com/topic/vulnerabilities/sglang-sandbox-escape-in-dumper-endpoint-enables/https://firewallchronicle.com/topic/vulnerabilities/sglang-sandbox-escape-in-dumper-endpoint-enables/Fri, 16 Oct 2026 12:02:05 +0000VulnerabilitiesA critical code injection flaw in SGLang versions up to 0.5.22 allows unauthenticated attackers to execute arbitrary Python code via the scheduler process.https://firewallchronicle.com/topic/cyber-attacks/peerstitch-implant-abused-fortimanager-cve-2024/https://firewallchronicle.com/topic/cyber-attacks/peerstitch-implant-abused-fortimanager-cve-2024/Fri, 16 Oct 2026 10:06:38 +0000Cyber AttacksAttackers used a FortiManager vulnerability to steal configurations for hundreds of downstream firewalls, deploying PEERSTITCH to maintain persistent access.https://firewallchronicle.com/topic/vulnerabilities/apache-answer-cve-2026-86589-session-persistence/https://firewallchronicle.com/topic/vulnerabilities/apache-answer-cve-2026-86589-session-persistence/Fri, 16 Oct 2026 09:18:50 +0000VulnerabilitiesA flaw in Apache Answer allows suspended external user sessions to remain active, bypassing central account controls until timeout.https://firewallchronicle.com/topic/cyber-attacks/hinton-bengio-urge-air-gapped-ai-training-to/https://firewallchronicle.com/topic/cyber-attacks/hinton-bengio-urge-air-gapped-ai-training-to/Fri, 16 Oct 2026 09:00:57 +0000Cyber AttacksHundreds of scientists urge strict isolation for AI training environments to prevent potential security breaches during model development.https://firewallchronicle.com/topic/vulnerabilities/doublescale-crm-plugin-permits-arbitrary-file/https://firewallchronicle.com/topic/vulnerabilities/doublescale-crm-plugin-permits-arbitrary-file/Fri, 16 Oct 2026 08:45:03 +0000VulnerabilitiesAuthenticated users can upload executable files in DoubleScale CRM versions up to 1.5.1 due to a flawed extension check and missing capability restrictions.https://firewallchronicle.com/topic/vulnerabilities/dio-http2-adapter-cve-2026-103030-leaks-auth/https://firewallchronicle.com/topic/vulnerabilities/dio-http2-adapter-cve-2026-103030-leaks-auth/Fri, 16 Oct 2026 07:46:26 +0000VulnerabilitiesA high-severity flaw in dio_http2_adapter forwards sensitive credentials to third-party servers during redirects, exposing users to credential theft.