Microsoft discloses Windows Media Foundation buffer overflow CVE-2026-62744
The unauthenticated flaw allows arbitrary code execution when a user opens, previews, or loads a streamed malicious media file, requiring no credentials.
Vulnerabilities & Patches
vulnerability CVE zero-day patch exploit advisory update KEV
-
-
Atlassian discloses critical flaw exploited within hours; Let’s Encrypt cuts TLS lifetime
The Hacker News noted that Atlassian disclosed CVE-2026-21589, a critical flaw in Data Center products exploited within two hours of technical details being released.
-
Help Net Security and Vuln Herald Forecast Office‑Cleanup Focus for October 2026 Patch Tuesday After September’s Microsoft Update
The forecast urges prioritizing high‑risk systems and Office updates while noting that the two Known Exploited flaws from September—CVE‑2026‑85880 and CVE‑2026‑81963—remain critical for immediate patching.
-
Talos Intelligence newsletter says isolating legacy check‑printing devices keeps payroll running when patches aren’t possible
Pierre Cadieux of Cisco Talos describes how separating the devices onto a network segment that blocks internet traffic reduced exploit risk while allowing checks to keep printing.
-
In early 2026 Project Zero revisited CVE-2024-54529 in the Sound Barrier series
A look back at the type‑confusion flaw in macOS CoreAudio, how researchers built an exploit, Apple’s December 2024 patches and the guidance that followed.
-
FBI Updates FortiBleed Warning as Attackers Lock Out FortiGate Admins Before Ransomware
The joint FBI‑Secret Service advisory shows threat actors using stolen credentials to seize administrator accounts, lock out legitimate owners, and hand access to ransomware affiliates, and details mitigations that go beyond patching.
-
SonicWall Patches CVSS 10.0 Pre‑Auth SSRF in SMA1000 Appliances, Urges Segmentation and IOC Hunts
On Oct. 6, 2026 the vendor issued hotfixes for four SMA1000 vulnerabilities, including a maximum‑severity server‑side request forgery that lets attackers use the appliance as a forward proxy without credentials.
-
Atlassian CVE-2026-21589 Exploited Within Hours of Public PoC, Exposing Patch‑Lag Risk for Self‑Managed Jira, Confluence and Bitbucket
Attackers began scanning for the flaw shortly after a proof‑of‑concept appeared, showing how quickly unpatched enterprise instances can be targeted.
-
Google Discloses Counterfeit TLS Certificates After Attackers Hijacked Three Country‑Code Domain Registries
On Oct. 6, 2026, Google said threat actors compromised the .gh, .sl and .as registries, altered DNS to pass domain‑validation checks and obtained unauthorized TLS certificates for Google domains and other major services.
-
SonicWall Patches CVSS 10 SMA1000 Flaw; Splunk Fixes 22 Enterprise Bugs
SonicWall reports no exploitation of its SMA1000 vulnerabilities, while Splunk's advisories show no attacks on its October Enterprise flaws, though attackers exploited a June Splunk bug within days.
-
FBI, Secret Service Warn FortiBleed Attackers Are Locking Organizations Out of Fortinet Devices
A joint FBI and US Secret Service advisory says the credential-based campaign against FortiGate firewalls and SSL VPN gateways involves attacker-created accounts and deleted or reset original credentials.
-
JFrog Discloses Unpatched Critical LMCache Flaw, CVE-2026-105192, With No Fixed Version Available
JFrog says an unauthenticated remote code execution bug in LMCache's multiprocess mode affects every release from 0.3.9 through 0.5.5, and no fixed version exists.