Author
Ostorlab Team
TightVNC Viewer Pre-Auth RCE, Fixed in 2.8.90
A malicious VNC server runs code on the TightVNC Viewer before any password prompt; upgrade the Viewer to 2.8.90 and restrict listening mode on TCP 5500.
Nov 02, 2026
EDK II PXE Driver RCE Before Secure Boot (CVE-2026-97631)
An oversized ICMP error message corrupts memory while a server PXE-boots, running attacker code b...
Nov 01, 2026
LXD and Incus mTLS Authentication Bypass (CVE-2026-112816)
LXD and Incus mTLS authentication bypass lets network attackers impersonate trusted clients using...
Nov 01, 2026
CakePHP SQL Injection, Fixed in 5.4.4 (CVE-2026-119418)
CakePHP window offsets and collation names allow SQL injection when fed untrusted input. Check ex...
Nov 01, 2026
More by Ostorlab Team
ChatGPT Shared-Link Account Takeover via MathLive Sandbox Escape
A shared ChatGPT link ran attacker JavaScript inside the victim session through MathLive unchecked messages; OpenAI fixed it on October 26.
Oct 31, 2026
GhostAction: Stolen GitHub Tokens Hit 23,000 Repos
Stolen GitHub tokens pushed 72,026 malicious commits to 22,964 repositories in nine days; revoke the tokens and hunt the #ghc2 cron job.
Oct 31, 2026
Ivanti Connect Secure Zero-Day Chain, Exploited (CVE-2026-104935)
A three-flaw chain gives unauthenticated root on Ivanti Connect Secure; upgrade to 22.8R2.6 or 25.1.1.3 and audit for October exploitation.
Oct 31, 2026
imgproxy ICO Loader RCE, Fixed in 4.0.16 (GHSA-hff9-5pqw-6w9f)
imgproxy 4.0.0 to 4.0.15 allocates ICO data with a wrapping size that unauthenticated crafted-image requests turn into heap corruption; fixed in 4.0.16.
Oct 31, 2026
Late October 2026: Cloud Inventory, Scheduled Testing and Investigation Replay
The October 2026 update connects cloud inventory, schedules testing windows, replays investigations, and expands mobile scanning and fix verification.
Oct 31, 2026
pgAdmin 4 Import/Export RCE, Fixed in 9.19 (CVE-2026-116241)
pgAdmin 4 before 9.19 lets any Import/Export user run a psql TO PROGRAM command on the host, and lockout bypasses open admin guessing; fixed in 9.19.
Oct 31, 2026
WordPress Core Upgrade-Window RCE, Fixed in 7.1.4 (CVE-2026-119977)
WordPress 4.7 to 7.1.3 unpacks updates to a predictable web path that unauthenticated attackers race to run code; in CISA KEV since November 3; fixed in 7.1.4.
Oct 31, 2026
Langflow Auto-Login Superuser Bypass, RCE via MCP (CVE-2026-93680)
Langflow OSS 1.0.0 to 1.12.8 hands any caller a superuser session that reaches RCE through its MCP tools; fixed in 1.13.0.
Oct 30, 2026
testmetest: npm Worm Arms 42 GitHub Repos with a Hidden Publisher
An npm worm stole credentials, planted AI-tool hooks in 42 real GitHub repositories and hid a package publisher; treat installs as compromises.
Oct 30, 2026
Trojanized Claude Code Extension on Cursor Plants SSH Backdoor
A malicious Claude Code extension 2.1.313 on the Cursor Marketplace added an SSH backdoor; at most 5,000 users installed it on October 29, 2026.
Oct 30, 2026