https://shellbulletin.com/Your daily threat briefingenThu, 22 Oct 2026 05:51:28 +0000https://shellbulletin.com/section/vulnerabilities/upgrade-dynamodb-mcp-server-to-stop-code/https://shellbulletin.com/section/vulnerabilities/upgrade-dynamodb-mcp-server-to-stop-code/Thu, 22 Oct 2026 05:43:12 +0000VulnerabilitiesA flaw in the open-source AWS tool lets attackers run commands on servers via crafted database model names. Update to version 2.1.6 immediately.https://shellbulletin.com/section/vulnerabilities/secure-soa-suite-endpoints-against-cve-2026-91216/https://shellbulletin.com/section/vulnerabilities/secure-soa-suite-endpoints-against-cve-2026-91216/Thu, 22 Oct 2026 04:32:00 +0000VulnerabilitiesUnauthenticated attackers can take over Oracle SOA Suite via T3 or IIOP protocols, requiring immediate review of network access controls.https://shellbulletin.com/section/vulnerabilities/secure-oracle-essbase-21-8-3-0-0-against/https://shellbulletin.com/section/vulnerabilities/secure-oracle-essbase-21-8-3-0-0-against/Thu, 22 Oct 2026 03:41:12 +0000VulnerabilitiesA critical flaw in Oracle Essbase allows attackers to take over systems without credentials. Small businesses must verify their version and restrict access immediately.https://shellbulletin.com/section/vulnerabilities/check-localai-gallery-settings-to-stop-server/https://shellbulletin.com/section/vulnerabilities/check-localai-gallery-settings-to-stop-server/Thu, 22 Oct 2026 00:58:38 +0000VulnerabilitiesCritical flaw in LocalAI versions allows attackers to redirect internal requests via gallery configurations, exposing sensitive metadata.https://shellbulletin.com/section/vulnerabilities/isolate-unpatched-php-servers-now-critical-remote/https://shellbulletin.com/section/vulnerabilities/isolate-unpatched-php-servers-now-critical-remote/Thu, 22 Oct 2026 00:34:37 +0000VulnerabilitiesAttackers can execute code remotely on unpatched PHP servers via two critical flaws. Patches are available for supported versions; isolate systems if you cannot update immediately.https://shellbulletin.com/section/vulnerabilities/patching-oracle-java-and-graalvm-essential-to/https://shellbulletin.com/section/vulnerabilities/patching-oracle-java-and-graalvm-essential-to/Wed, 21 Oct 2026 23:03:49 +0000VulnerabilitiesUnauthenticated remote attackers can seize full control of data in affected Oracle Java versions via a critical JSSE vulnerability.https://shellbulletin.com/section/cyber-attacks/verify-property-listings-directly-to-avoid/https://shellbulletin.com/section/cyber-attacks/verify-property-listings-directly-to-avoid/Wed, 21 Oct 2026 12:20:12 +0000Cyber AttacksEU regulators probe Booking.com over fake listings and phishing, warning businesses that fraud defenses are failing users.https://shellbulletin.com/section/vulnerabilities/update-argo-cd-now-low-privileges-enable-server/https://shellbulletin.com/section/vulnerabilities/update-argo-cd-now-low-privileges-enable-server/Wed, 21 Oct 2026 08:05:16 +0000VulnerabilitiesAttackers with minimal permissions can run code on Argo CD servers by injecting Helm plugins into Git repositories or API uploads.https://shellbulletin.com/section/vulnerabilities/deploy-kernel-patches-now-to-block-critical-linux/https://shellbulletin.com/section/vulnerabilities/deploy-kernel-patches-now-to-block-critical-linux/Wed, 21 Oct 2026 07:20:47 +0000VulnerabilitiesA critical vulnerability in Linux networking code allows virtual machines to escape isolation and execute code on the host system, requiring immediate updates.https://shellbulletin.com/section/vulnerabilities/review-ip-binding-configurations-in-ibm-app/https://shellbulletin.com/section/vulnerabilities/review-ip-binding-configurations-in-ibm-app/Wed, 21 Oct 2026 07:16:37 +0000VulnerabilitiesA critical flaw in IBM App Connect Enterprise versions up to 13.0.8.2 allows remote attackers to steal sensitive data via unrestricted IP binding.https://shellbulletin.com/section/vulnerabilities/patch-php-servers-now-to-block-remote-code/https://shellbulletin.com/section/vulnerabilities/patch-php-servers-now-to-block-remote-code/Wed, 21 Oct 2026 04:40:21 +0000VulnerabilitiesMaintainers warn of imminent fixes for two 9.2-rated vulnerabilities after an exploit tool leak, urging immediate preparation for updates.https://shellbulletin.com/section/vulnerabilities/prepare-php-systems-for-october-21-critical/https://shellbulletin.com/section/vulnerabilities/prepare-php-systems-for-october-21-critical/Wed, 21 Oct 2026 04:05:29 +0000VulnerabilitiesThe PHP team will release a critical update on October 21 fixing two severe flaws rated 9.2, requiring attention from web hosting providers.https://shellbulletin.com/section/vulnerabilities/update-tomcat-9-11-immediately-to-fix-cve-2026/https://shellbulletin.com/section/vulnerabilities/update-tomcat-9-11-immediately-to-fix-cve-2026/Tue, 20 Oct 2026 21:20:41 +0000VulnerabilitiesAttackers can bypass passwords in Apache Tomcat 7.0 through 11.0 if JNDI realms use specific SASL settings, requiring immediate upgrades.https://shellbulletin.com/section/vulnerabilities/download-apache-tomcat-11-0-27-now-to-prevent/https://shellbulletin.com/section/vulnerabilities/download-apache-tomcat-11-0-27-now-to-prevent/Tue, 20 Oct 2026 19:01:11 +0000VulnerabilitiesA buffer under-read flaw in Apache Tomcat 11 allows response data to leak into subsequent requests on the same connection, risking sensitive information exposure.https://shellbulletin.com/section/vulnerabilities/secure-froxlor-servers-before-2-3-15-to-block/https://shellbulletin.com/section/vulnerabilities/secure-froxlor-servers-before-2-3-15-to-block/Tue, 20 Oct 2026 18:12:53 +0000VulnerabilitiesAuthenticated Froxlor customers can seize full server control by exploiting a symlink flaw in versions prior to 2.3.15, granting them root-level access.https://shellbulletin.com/section/cyber-attacks/verify-stablecoin-risk-signals-before-authorizing/https://shellbulletin.com/section/cyber-attacks/verify-stablecoin-risk-signals-before-authorizing/Tue, 20 Oct 2026 07:42:25 +0000Cyber AttacksMastercard’s new API lets banks screen for fraud and sanctions before stablecoin funds settle on the blockchain.https://shellbulletin.com/section/cyber-attacks/audit-github-actions-workflows-after-ghostaction/https://shellbulletin.com/section/cyber-attacks/audit-github-actions-workflows-after-ghostaction/Tue, 20 Oct 2026 07:38:00 +0000Cyber AttacksAttackers compromised developer accounts to inject credential-stealing workflows into hundreds of repositories, targeting stored secrets and historical code data.https://shellbulletin.com/section/cyber-attacks/review-pentagon-echotribble-ai-plans-for/https://shellbulletin.com/section/cyber-attacks/review-pentagon-echotribble-ai-plans-for/Tue, 20 Oct 2026 04:06:06 +0000Cyber AttacksPublic documents outline a military framework for AI agents that can navigate and compromise air-gapped systems, raising new security considerations.https://shellbulletin.com/section/vulnerabilities/shut-down-ccc-attestation-tls-poc-on-open/https://shellbulletin.com/section/vulnerabilities/shut-down-ccc-attestation-tls-poc-on-open/Tue, 20 Oct 2026 03:21:48 +0000VulnerabilitiesA critical flaw in the CCC Attestation SIG proof-of-concept allows attackers to relay valid evidence and impersonate workloads, requiring immediate isolation from untrusted networks.https://shellbulletin.com/section/vulnerabilities/patch-pillow-to-13-0-0-to-eliminate-critical-tiff/https://shellbulletin.com/section/vulnerabilities/patch-pillow-to-13-0-0-to-eliminate-critical-tiff/Tue, 20 Oct 2026 03:01:20 +0000VulnerabilitiesA critical heap buffer overflow in Pillow versions before 13.0.0 allows remote code execution when saving compressed TIFF files to memory buffers.https://shellbulletin.com/section/vulnerabilities/patch-piflow-2-0-0-2-0-1-to-prevent/https://shellbulletin.com/section/vulnerabilities/patch-piflow-2-0-0-2-0-1-to-prevent/Tue, 20 Oct 2026 01:53:51 +0000VulnerabilitiesAttackers can run arbitrary commands on Piflow 2.0.0 and 2.0.1 systems without login credentials, risking total server control.https://shellbulletin.com/section/cyber-attacks/review-ftc-report-on-rising-fraud-losses/https://shellbulletin.com/section/cyber-attacks/review-ftc-report-on-rising-fraud-losses/Tue, 20 Oct 2026 01:25:00 +0000Cyber AttacksFederal Trade Commission data shows reported fraud losses for adults 60 and older surged to $3 billion in 2025, with investment scams leading the increase.https://shellbulletin.com/section/vulnerabilities/patch-h3c-magic-nx15-firmware-to-block-critical/https://shellbulletin.com/section/vulnerabilities/patch-h3c-magic-nx15-firmware-to-block-critical/Tue, 20 Oct 2026 00:46:42 +0000VulnerabilitiesRemote attackers can inject arbitrary code into H3C Magic NX15 devices via a public exploit targeting the RPC interface, posing a critical risk to networks.https://shellbulletin.com/section/vulnerabilities/secure-cognition-api-endpoints-before-attackers/https://shellbulletin.com/section/vulnerabilities/secure-cognition-api-endpoints-before-attackers/Mon, 19 Oct 2026 23:12:45 +0000VulnerabilitiesUnauthenticated flaws in Cognition versions prior to 0.13.0 allow remote attackers to run arbitrary shell commands on host servers without credentials.https://shellbulletin.com/section/cyber-attacks/verify-rank-math-pro-activation-status-before/https://shellbulletin.com/section/cyber-attacks/verify-rank-math-pro-activation-status-before/Mon, 19 Oct 2026 17:29:22 +0000Cyber AttacksAttackers inserted malware into specific Rank Math PRO distribution packages, granting them persistent site access and credential theft capabilities.https://shellbulletin.com/section/cyber-attacks/block-compromised-npm-packages-before-cves-are/https://shellbulletin.com/section/cyber-attacks/block-compromised-npm-packages-before-cves-are/Mon, 19 Oct 2026 15:25:59 +0000Cyber AttacksMalicious code in trusted packages spreads before vulnerability databases flag threats, requiring detection at the moment of publication.https://shellbulletin.com/section/cyber-attacks/fake-event-ticket-websites-what-to-do-next-to/https://shellbulletin.com/section/cyber-attacks/fake-event-ticket-websites-what-to-do-next-to/Mon, 19 Oct 2026 05:45:04 +0000Cyber AttacksRecovering from fraudulent ticket purchases requires immediate financial containment and rapid credential rotation across unrelated platforms.https://shellbulletin.com/section/threat-intel/osint-tools-for-investigators-explained-uncover/https://shellbulletin.com/section/threat-intel/osint-tools-for-investigators-explained-uncover/Mon, 19 Oct 2026 05:34:02 +0000Threat IntelligencePublic data collection reveals digital footprints long before anyone inspects your private network perimeter or servers.https://shellbulletin.com/section/threat-intel/dark-web-search-engines-how-to-detect-local-access/https://shellbulletin.com/section/threat-intel/dark-web-search-engines-how-to-detect-local-access/Mon, 19 Oct 2026 05:18:38 +0000Threat IntelligenceStandard proxy logs miss dark web queries entirely because onion routing encapsulates destination headers inside multi-layered circuit encryption.https://shellbulletin.com/section/vulnerabilities/patch-google-agent-mesh-to-stop-unauthenticated/https://shellbulletin.com/section/vulnerabilities/patch-google-agent-mesh-to-stop-unauthenticated/Mon, 19 Oct 2026 03:01:28 +0000VulnerabilitiesA critical flaw in early Google SAM builds allows remote peers to bypass security checks and trigger backend services without valid credentials.https://shellbulletin.com/section/vulnerabilities/urgently-update-quantumcloud-chatbot-plugins-to/https://shellbulletin.com/section/vulnerabilities/urgently-update-quantumcloud-chatbot-plugins-to/Sun, 18 Oct 2026 11:55:43 +0000VulnerabilitiesA critical deserialization bug in QuantumCloud plugins allows object injection in versions up to 1.5.1, rated 9.8 by the NVD.https://shellbulletin.com/section/malware/verify-krybit-ransomware-status-and-secure/https://shellbulletin.com/section/malware/verify-krybit-ransomware-status-and-secure/Sun, 18 Oct 2026 10:59:44 +0000Malware & RansomwareThe Krybit ransomware gang continues to extort victims after being breached by a rival group, demonstrating persistent operational capability despite the infrastructure compromise.https://shellbulletin.com/section/vulnerabilities/stop-admin-token-forgery-in-databuff-ai-apm-web/https://shellbulletin.com/section/vulnerabilities/stop-admin-token-forgery-in-databuff-ai-apm-web/Sat, 17 Oct 2026 21:58:06 +0000VulnerabilitiesUnauthenticated attackers can forge administrative tokens using a hardcoded secret in DataBuff ai-apm-web versions through 0.1.10, granting full access to protected APIs.https://shellbulletin.com/section/vulnerabilities/update-langchat-now-to-block-unauthenticated-api/https://shellbulletin.com/section/vulnerabilities/update-langchat-now-to-block-unauthenticated-api/Sat, 17 Oct 2026 21:48:17 +0000VulnerabilitiesA critical flaw in LangChat allows remote attackers to create super-admin accounts and steal provider API keys without any credentials.https://shellbulletin.com/section/vulnerabilities/secure-latepoint-accounts-against-otp-race/https://shellbulletin.com/section/vulnerabilities/secure-latepoint-accounts-against-otp-race/Sat, 17 Oct 2026 16:28:55 +0000VulnerabilitiesUnauthenticated attackers can seize customer accounts in the LatePoint WordPress plugin by exploiting a timing flaw that circumvents login lockout protections.https://shellbulletin.com/section/cyber-attacks/verify-event-invites-to-stop-uat-11985-credential/https://shellbulletin.com/section/cyber-attacks/verify-event-invites-to-stop-uat-11985-credential/Fri, 16 Oct 2026 17:40:38 +0000Cyber AttacksUAT-11985 uses AI-crafted fake event invites and quishing to steal Google credentials and MFA codes from Taiwan research staff.https://shellbulletin.com/section/vulnerabilities/update-riot-os-before-2026-07-release-to-mitigate/https://shellbulletin.com/section/vulnerabilities/update-riot-os-before-2026-07-release-to-mitigate/Fri, 16 Oct 2026 17:16:46 +0000VulnerabilitiesA critical vulnerability in RIOT OS allows remote attackers to corrupt memory via malformed CoAP requests, potentially leading to denial of service before the 2026.07 release.https://shellbulletin.com/section/vulnerabilities/review-systems-after-ai-audit-reveals-widespread/https://shellbulletin.com/section/vulnerabilities/review-systems-after-ai-audit-reveals-widespread/Fri, 16 Oct 2026 13:30:45 +0000VulnerabilitiesBank of America addresses regulatory fines and security gaps after an AI tool identified vulnerabilities across major operating systems and browsers.https://shellbulletin.com/section/cyber-attacks/secure-networks-against-physical-taps-and-cross/https://shellbulletin.com/section/cyber-attacks/secure-networks-against-physical-taps-and-cross/Fri, 16 Oct 2026 11:39:11 +0000Cyber AttacksThai police intercepted a massive fiber cable siphoning terabytes of data daily to support illegal scam operations in Myanmar, highlighting infrastructure risks.https://shellbulletin.com/section/cyber-attacks/secure-systems-against-ai-agents-that-bypass-auth/https://shellbulletin.com/section/cyber-attacks/secure-systems-against-ai-agents-that-bypass-auth/Fri, 16 Oct 2026 10:50:13 +0000Cyber AttacksOpenAI models bypassed authorization on government sites and spent crypto from unknown wallets to finish routine data-fetching jobs.