Microsoft discloses Windows Media Foundation buffer overflow CVE-2026-62744
The unauthenticated flaw allows arbitrary code execution when a user opens, previews, or loads a streamed malicious media file, requiring no credentials.
CVE
-
-
Teen Leader of ShinyHunters Detained, Cooperating with FBI
Dutch police arrested alleged ShinyHunters member Pepijn van der Stap, known as "Umbreon," on September 15, 2026, as part of the same investigation.
-
Dutch police arrest alleged ShinyHunters leader amid global cybercrime investigation
The arrest follows a February 2026 social‑engineering breach of Dutch telecom Odido that exposed over 6.2 million customer records.
-
Atlassian discloses critical flaw exploited within hours; Let’s Encrypt cuts TLS lifetime
The Hacker News noted that Atlassian disclosed CVE-2026-21589, a critical flaw in Data Center products exploited within two hours of technical details being released.
-
Attackers hijack Danfoss fridge controllers, raise temps in French supermarkets
Sources reported that the defrost manipulation heated refrigeration units to 50°C, spoiling frozen and fresh food.
-
Park24 reports third-party accessed 6.6 million Times Car accounts
Monogatari Corporation reported on October 5, 2026 that 10,788,963 records leaked from its Yakiniku King app member system.
-
Help Net Security and Vuln Herald Forecast Office‑Cleanup Focus for October 2026 Patch Tuesday After September’s Microsoft Update
The forecast urges prioritizing high‑risk systems and Office updates while noting that the two Known Exploited flaws from September—CVE‑2026‑85880 and CVE‑2026‑81963—remain critical for immediate patching.
-
Talos Intelligence newsletter says isolating legacy check‑printing devices keeps payroll running when patches aren’t possible
Pierre Cadieux of Cisco Talos describes how separating the devices onto a network segment that blocks internet traffic reduced exploit risk while allowing checks to keep printing.
-
In early 2026 Project Zero revisited CVE-2024-54529 in the Sound Barrier series
A look back at the type‑confusion flaw in macOS CoreAudio, how researchers built an exploit, Apple’s December 2024 patches and the guidance that followed.
-
CISA warns of critical 9.8‑severity flaws in openPDC and openHistorian grid‑monitoring software
The agency urges utilities to patch, segment networks and review authentication before attackers can exploit the vulnerabilities.
-
SonicWall Patches CVSS 10.0 Pre‑Auth SSRF in SMA1000 Appliances, Urges Segmentation and IOC Hunts
On Oct. 6, 2026 the vendor issued hotfixes for four SMA1000 vulnerabilities, including a maximum‑severity server‑side request forgery that lets attackers use the appliance as a forward proxy without credentials.
-
Atlassian CVE-2026-21589 Exploited Within Hours of Public PoC, Exposing Patch‑Lag Risk for Self‑Managed Jira, Confluence and Bitbucket
Attackers began scanning for the flaw shortly after a proof‑of‑concept appeared, showing how quickly unpatched enterprise instances can be targeted.