https://blueteamherald.com/Security news, verified and fastenThu, 22 Oct 2026 00:26:37 +0000https://blueteamherald.com/c/vulnerabilities/patch-gitlab-to-stop-saml-ldap-account-takeover/https://blueteamherald.com/c/vulnerabilities/patch-gitlab-to-stop-saml-ldap-account-takeover/Thu, 22 Oct 2026 00:13:01 +0000VulnerabilitiesGitLab users must update to block a high-severity flaw allowing authenticated attackers to hijack LDAP accounts via improper input sanitization.https://blueteamherald.com/c/vulnerabilities/patch-trigger-dev-cli-csrf-flaw-before-version-4/https://blueteamherald.com/c/vulnerabilities/patch-trigger-dev-cli-csrf-flaw-before-version-4/Wed, 21 Oct 2026 17:12:27 +0000VulnerabilitiesA high-severity cross-site request forgery in the Trigger.dev CLI authorization flow allows attackers to steal personal access tokens from logged-in users.https://blueteamherald.com/c/vulnerabilities/patch-virtualenv-to-stop-arbitrary-command/https://blueteamherald.com/c/vulnerabilities/patch-virtualenv-to-stop-arbitrary-command/Wed, 21 Oct 2026 16:54:49 +0000VulnerabilitiesA high-severity flaw in virtualenv allows attackers to run shell commands via crafted environment names, requiring users to update to 21.14.7 immediately.https://blueteamherald.com/c/cyber-attacks/hunt-for-sandboxie-dll-sideloading-to-stop-ad/https://blueteamherald.com/c/cyber-attacks/hunt-for-sandboxie-dll-sideloading-to-stop-ad/Wed, 21 Oct 2026 12:39:51 +0000Cyber AttacksThreat actors use trusted Windows apps to load malicious libraries, stealing directory data from targets across Asia and Africa between 2025 and 2026.https://blueteamherald.com/c/vulnerabilities/patch-wp-user-manager-to-block-unauthenticated/https://blueteamherald.com/c/vulnerabilities/patch-wp-user-manager-to-block-unauthenticated/Wed, 21 Oct 2026 11:01:00 +0000VulnerabilitiesA high-severity flaw in WP User Manager allows unauthenticated visitors to gain administrator roles without payment if the payment gateway is disconnected.https://blueteamherald.com/c/cyber-attacks/verify-order-notifications-attackers-abuse/https://blueteamherald.com/c/cyber-attacks/verify-order-notifications-attackers-abuse/Wed, 21 Oct 2026 10:34:10 +0000Cyber AttacksThreat researchers found that criminals are inserting scam phone numbers into legitimate retail transaction emails to bypass security filters.https://blueteamherald.com/c/vulnerabilities/patch-couchdb-3-5-2-to-block-unauthorized-access/https://blueteamherald.com/c/vulnerabilities/patch-couchdb-3-5-2-to-block-unauthorized-access/Wed, 21 Oct 2026 10:28:28 +0000VulnerabilitiesA high-severity authorization bypass in Apache CouchDB allows unrestricted reading of prefixed user and replicator databases, requiring an immediate upgrade to 3.5.3.https://blueteamherald.com/c/vulnerabilities/update-node-js-follow-redirects-to-block-cve-2026/https://blueteamherald.com/c/vulnerabilities/update-node-js-follow-redirects-to-block-cve-2026/Wed, 21 Oct 2026 09:58:30 +0000VulnerabilitiesA regex flaw in the Node.js follow-redirects package allows custom credential headers to leak during cross-origin redirects if header names contain specific characters.https://blueteamherald.com/c/vulnerabilities/patch-eclipse-openj9-to-stop-remote-jitserver/https://blueteamherald.com/c/vulnerabilities/patch-eclipse-openj9-to-stop-remote-jitserver/Wed, 21 Oct 2026 08:42:26 +0000VulnerabilitiesUnauthenticated attackers can crash JVM processes in OpenJ9 versions before 0.63.0 by sending malformed payloads to the JITServer component.https://blueteamherald.com/c/vulnerabilities/update-chrome-desktop-and-chromeos-to-patch-353/https://blueteamherald.com/c/vulnerabilities/update-chrome-desktop-and-chromeos-to-patch-353/Wed, 21 Oct 2026 08:27:38 +0000VulnerabilitiesGoogle releases Chrome 156 stable updates for desktop and ChromeOS, addressing hundreds of security vulnerabilities including critical memory corruption issues.https://blueteamherald.com/c/vulnerabilities/update-argo-cd-to-stop-low-privilege-attackers/https://blueteamherald.com/c/vulnerabilities/update-argo-cd-to-stop-low-privilege-attackers/Wed, 21 Oct 2026 08:08:29 +0000VulnerabilitiesA critical flaw allows attackers to read sensitive files and exhaust memory via JSONnet imports in Argo CD versions prior to the latest security updates.https://blueteamherald.com/c/vulnerabilities/block-argo-cd-rce-helm-plugin-flaw-in-2-1-to-3-6/https://blueteamherald.com/c/vulnerabilities/block-argo-cd-rce-helm-plugin-flaw-in-2-1-to-3-6/Wed, 21 Oct 2026 08:05:16 +0000VulnerabilitiesA critical vulnerability in Argo CD allows remote code execution via Helm plugins with minimal permissions, affecting versions up to 3.6.0-rc2.https://blueteamherald.com/c/vulnerabilities/secure-totolink-x2000r-admin-access-to-mitigate/https://blueteamherald.com/c/vulnerabilities/secure-totolink-x2000r-admin-access-to-mitigate/Wed, 21 Oct 2026 04:07:58 +0000VulnerabilitiesA critical buffer overflow in Totolink X2000R firmware allows authenticated attackers to execute arbitrary code via crafted HTTP requests.https://blueteamherald.com/c/vulnerabilities/upgrade-vyper-to-0-3-0-to-fix-high-severity/https://blueteamherald.com/c/vulnerabilities/upgrade-vyper-to-0-3-0-to-fix-high-severity/Wed, 21 Oct 2026 02:46:35 +0000VulnerabilitiesA flaw in Vyper versions before 0.3.0 allows memory corruption during internal function calls, risking incorrect smart contract behavior.https://blueteamherald.com/c/vulnerabilities/secure-totolink-x2000r-routers-against-critical/https://blueteamherald.com/c/vulnerabilities/secure-totolink-x2000r-routers-against-critical/Wed, 21 Oct 2026 01:40:56 +0000VulnerabilitiesResearchers identified critical stack-based buffer overflows in the device's IPv6 setup feature that allow attackers to run arbitrary code.https://blueteamherald.com/c/vulnerabilities/block-tcf-servlet-access-to-stop-oracle-ebs/https://blueteamherald.com/c/vulnerabilities/block-tcf-servlet-access-to-stop-oracle-ebs/Wed, 21 Oct 2026 00:22:50 +0000VulnerabilitiesHorizon3 researchers found an unauthenticated SQL injection in Oracle E-Business Suite that allows attackers to run commands on application servers without logging in.https://blueteamherald.com/c/vulnerabilities/block-malformed-put-requests-to-prevent-netx-duo/https://blueteamherald.com/c/vulnerabilities/block-malformed-put-requests-to-prevent-netx-duo/Tue, 20 Oct 2026 23:52:21 +0000VulnerabilitiesAn unauthenticated remote crash flaw in Eclipse ThreadX NetX Duo allows attackers to crash servers via a single bad HTTP request.https://blueteamherald.com/c/vulnerabilities/block-path-traversal-attacks-on-eyelock-nano-nxt/https://blueteamherald.com/c/vulnerabilities/block-path-traversal-attacks-on-eyelock-nano-nxt/Tue, 20 Oct 2026 21:10:16 +0000VulnerabilitiesUnauthenticated attackers can read arbitrary files on EyeLock nano NXT devices via a high-severity path traversal flaw in older firmware versions.https://blueteamherald.com/c/cyber-attacks/block-exposed-ai-control-panels-to-stop/https://blueteamherald.com/c/cyber-attacks/block-exposed-ai-control-panels-to-stop/Tue, 20 Oct 2026 15:48:02 +0000Cyber AttacksResearchers observed criminals using open-source AI tools to breach over 100 company websites by exploiting internet-facing control panels.https://blueteamherald.com/c/vulnerabilities/patch-go-compress-library-to-fix-high-severity/https://blueteamherald.com/c/vulnerabilities/patch-go-compress-library-to-fix-high-severity/Tue, 20 Oct 2026 15:25:16 +0000VulnerabilitiesAttackers can trigger a segmentation fault in Go applications using the klauspost compress library by supplying crafted dictionary data that bypasses validation checks.https://blueteamherald.com/c/vulnerabilities/upgrade-typo3-file-manager-to-3-1-3-to-fix-cve/https://blueteamherald.com/c/vulnerabilities/upgrade-typo3-file-manager-to-3-1-3-to-fix-cve/Tue, 20 Oct 2026 10:19:53 +0000VulnerabilitiesUnquoted search terms in the File Manager extension allow database queries to break out, exposing sensitive data to attackers.https://blueteamherald.com/c/vulnerabilities/patch-advantech-adam-3600-to-stop-critical-remote/https://blueteamherald.com/c/vulnerabilities/patch-advantech-adam-3600-to-stop-critical-remote/Tue, 20 Oct 2026 09:18:29 +0000VulnerabilitiesAn unpatched firmware flaw allows attackers to forge packets and run commands with full privileges on exposed industrial modules.https://blueteamherald.com/c/cyber-attacks/us-army-echotribble-program-uses-agentic-ai-for/https://blueteamherald.com/c/cyber-attacks/us-army-echotribble-program-uses-agentic-ai-for/Tue, 20 Oct 2026 06:48:40 +0000Cyber AttacksLeaked documents reveal a US Army Cyber Command initiative deploying autonomous AI agents to traverse networks and eliminate targets, raising significant operational security concerns.https://blueteamherald.com/c/cyber-attacks/monitor-for-fraud-surges-as-ftc-report-highlights/https://blueteamherald.com/c/cyber-attacks/monitor-for-fraud-surges-as-ftc-report-highlights/Tue, 20 Oct 2026 05:08:48 +0000Cyber AttacksNew FTC data shows reported losses for Americans over 60 hit $3 billion in 2025, with investment fraud driving significant increases.https://blueteamherald.com/c/vulnerabilities/deploy-reference-monitors-to-secure-ai-agents/https://blueteamherald.com/c/vulnerabilities/deploy-reference-monitors-to-secure-ai-agents/Tue, 20 Oct 2026 03:21:48 +0000VulnerabilitiesRapid7 argues that AI agents require external reference monitors rather than internal prompts to prevent misuse of privileged access.https://blueteamherald.com/c/vulnerabilities/update-grav-cms-to-2-2-2-to-stop-page-editors/https://blueteamherald.com/c/vulnerabilities/update-grav-cms-to-2-2-2-to-stop-page-editors/Tue, 20 Oct 2026 03:01:20 +0000VulnerabilitiesPage editors in vulnerable Grav versions can bypass allowlists to delete directories or read files by renaming form fields.https://blueteamherald.com/c/vulnerabilities/block-unauthenticated-access-to-piflow-deepagents/https://blueteamherald.com/c/vulnerabilities/block-unauthenticated-access-to-piflow-deepagents/Tue, 20 Oct 2026 01:53:51 +0000VulnerabilitiesPiflow 2.0.0 and 2.0.1 allow unauthenticated remote code execution via chat agents, risking credential theft.https://blueteamherald.com/c/vulnerabilities/block-command-execution-in-camunda-7-by/https://blueteamherald.com/c/vulnerabilities/block-command-execution-in-camunda-7-by/Mon, 19 Oct 2026 23:31:36 +0000VulnerabilitiesAuthenticated users can execute OS commands in vulnerable Camunda 7 versions by injecting expressions into query fields, bypassing safety controls.https://blueteamherald.com/c/vulnerabilities/install-mercury-3-2-6-to-stop-anonymous-users/https://blueteamherald.com/c/vulnerabilities/install-mercury-3-2-6-to-stop-anonymous-users/Mon, 19 Oct 2026 22:45:54 +0000VulnerabilitiesDefault tokenless deployments of the Mercury framework allow anonymous users to create Jupyter kernels and run arbitrary Python code on exposed servers.https://blueteamherald.com/c/cyber-attacks/defenders-must-audit-postgresql-role-chains-in/https://blueteamherald.com/c/cyber-attacks/defenders-must-audit-postgresql-role-chains-in/Mon, 19 Oct 2026 19:53:42 +0000Cyber AttacksResearchers showed how limited database privileges could escalate to full server control, highlighting risks in managed cloud services.https://blueteamherald.com/c/vulnerabilities/update-semaphore-ui-to-mitigate-cve-2026-112305/https://blueteamherald.com/c/vulnerabilities/update-semaphore-ui-to-mitigate-cve-2026-112305/Mon, 19 Oct 2026 18:53:02 +0000VulnerabilitiesA high-severity flaw in Semaphore UI allows task runners to execute arbitrary code by overriding Ansible variables, exposing server-side secrets and keys.https://blueteamherald.com/c/vulnerabilities/preserve-siteguard-diagnostics-before-patching/https://blueteamherald.com/c/vulnerabilities/preserve-siteguard-diagnostics-before-patching/Mon, 19 Oct 2026 12:28:13 +0000VulnerabilitiesAttackers exploit a command injection flaw in SiteGuard Server Edition to gain root access. Defenders must save diagnostic logs before applying the vendor's patch or upgrade.https://blueteamherald.com/c/threat-intel/osint-investigation-cleanup-containment-and/https://blueteamherald.com/c/threat-intel/osint-investigation-cleanup-containment-and/Mon, 19 Oct 2026 05:43:10 +0000Threat IntelligenceExposing internal assets via open-source intelligence often triggers rapid attacker pivoting before formal containment begins.https://blueteamherald.com/c/threat-intel/cyber-range-training-platforms-how-simulated/https://blueteamherald.com/c/threat-intel/cyber-range-training-platforms-how-simulated/Mon, 19 Oct 2026 05:28:17 +0000Threat IntelligenceSimulated training environments often teach defenders how to react to intrusions while missing the architectural flaws that allowed the breach initially.https://blueteamherald.com/c/cyber-attacks/fake-ticket-websites-risks-and-protection-for/https://blueteamherald.com/c/cyber-attacks/fake-ticket-websites-risks-and-protection-for/Mon, 19 Oct 2026 05:07:09 +0000Cyber AttacksFake ticket sites exploit your payment gateway to harvest credentials and trigger chargebacks that drain your accounts and trigger fraud alerts.https://blueteamherald.com/c/cyber-attacks/secure-remote-workflows-after-fbi-seizes-187/https://blueteamherald.com/c/cyber-attacks/secure-remote-workflows-after-fbi-seizes-187/Sun, 18 Oct 2026 16:01:36 +0000Cyber AttacksThe Justice Department targeted a North Korean scheme using stolen US identities to infiltrate IT firms, resulting in major seizures and charges.https://blueteamherald.com/c/vulnerabilities/update-opentelemetry-to-1-45-0-to-block/https://blueteamherald.com/c/vulnerabilities/update-opentelemetry-to-1-45-0-to-block/Sun, 18 Oct 2026 12:15:46 +0000VulnerabilitiesA CVE-2026-112006 flaw in OpenTelemetry HTTP exporter versions before 1.45.0 allows attackers to intercept telemetry data by bypassing certificate checks.https://blueteamherald.com/c/cyber-attacks/disable-connectwise-skykick-apps-in-m365-tenants/https://blueteamherald.com/c/cyber-attacks/disable-connectwise-skykick-apps-in-m365-tenants/Sat, 17 Oct 2026 20:20:43 +0000Cyber AttacksHuntress confirms attackers are using stolen vendor credentials to access Microsoft 365 data, requiring immediate app revocation and log review.https://blueteamherald.com/c/vulnerabilities/update-icecms-beyond-4-1-5-to-block-put-request/https://blueteamherald.com/c/vulnerabilities/update-icecms-beyond-4-1-5-to-block-put-request/Sat, 17 Oct 2026 16:29:47 +0000VulnerabilitiesA critical missing authentication flaw in IceCMS allows attackers to reset admin passwords without credentials, risking full system control for users on versions 4.1.5 and earlier.https://blueteamherald.com/c/vulnerabilities/update-helical-insight-past-7-0-0-to-stop-viewers/https://blueteamherald.com/c/vulnerabilities/update-helical-insight-past-7-0-0-to-stop-viewers/Fri, 16 Oct 2026 19:33:23 +0000VulnerabilitiesAuthenticated viewers can exploit CVE-2026-111634 to manipulate data sources via crafted report parameters in Helical Insight through version 7.0.0.