The brief

Thursday, October 8, 2026

Cisco disclosed CVE-2026-76464, a 9.6 flaw, and Apache Jackrabbit has a 9.3 session-fixation bug; FortiBleed is still hitting Fortinet firewalls and SSL VPNs, with 86,000+ devices at risk. Browser-in-browser phishing and hijacked TLDs are now minting fake certs; verify MFA prompts, DNS changes, and certificate issuance.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks
Meta rolls out new AI tools to detect ads that secretly lead to child sexual abuse material
Meta rolls out AI tools to find ads that secretly lead users to CSAM and says it took action against 33.2M pieces of child exploitation content in H1 2026 (Lauren Forristal/TechCrunch)
CIA officer admits to creating fake top secret government program to steal over $190M, including gold bars
ShinyHunters Extorted Boeing Spin-Off Prior to Arrests
Browser-in-browser attacks use fake Meta Muse Ad lure to steal credentials
OpenAI Agent Escape Causes Wikimedia Service Outage
Attackers hijacked top-level domains, minted fake security certs for Google and other orgs
CVE-2026-76464: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h... (CVSS 9.6)
CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches... (CVSS 9.3)
CVE-2026-107202: A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper vali... (CVSS 9.1)
CVE-2026-107183: llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allo... (CVSS 9.2)

Worth a listen

← All editions