cybr.cx — Daily Digest // October 10, 2026

Critical Vulnerabilities

⚠️ Actively Exploited — KEV Entries (Patch Deadline: October 11)

CVE-2015-5477 | ISC BIND | CVSS: N/A
⚠️ Actively exploited. An eleven-year-old vulnerability in ISC BIND is being weaponised right now. Remote attackers can crash BIND nameservers via malformed TKEY queries, causing a denial of service. If your DNS infrastructure is still running an unpatched BIND instance — and CISA adding this to KEV in 2026 suggests some are — treat this as an emergency. Patch or isolate immediately; due date was yesterday.

CVE-2016-3081 | Apache Struts | CVSS: N/A
⚠️ Actively exploited. A decade-old Apache Struts command injection flaw is back in active exploitation campaigns. When Dynamic Method Invocation is enabled, attackers can execute arbitrary code remotely via the method: prefix. Struts underpins a surprising amount of legacy enterprise Java — audit your inventory and verify DMI is disabled at minimum.

CVE-2023-22894 | Strapi | CVSS: N/A
⚠️ Actively exploited. Attackers with admin panel access to Strapi instances can extract sensitive user credentials and PII through query filter manipulation. Strapi may be end-of-life in affected versions — if you're running it, upgrade or decommission. Headless CMS platforms with exposed admin panels are a persistent soft target.

CVE-2021-3199 | ONLYOFFICE Docs | CVSS: N/A
⚠️ Actively exploited. A path traversal vulnerability in ONLYOFFICE Docs allows remote code execution even in JWT-protected deployments, via a /.. sequence in image upload parameters. Self-hosted collaborative document platforms are prime targets for initial access — check your deployments immediately.

CVE-2015-3306 | ProFTPD | CVSS: N/A
⚠️ Actively exploited. ProFTPD's SITE CPFR and SITE CPTO commands can be abused by unauthenticated remote attackers to read and write arbitrary files. Another vintage flaw seeing fresh exploitation — if ProFTPD is exposed anywhere in your environment, it should not be.

CVE-2026-88779 | Citrix NetScaler ADC / NetScaler Gateway | CVSS: N/A
⚠️ Actively exploited. A memory buffer bounds vulnerability in Citrix NetScaler ADC and Gateway enables denial-of-service attacks. Given NetScaler's position as a network perimeter device, availability impact here is significant. CISA's due date has already passed — escalate remediation.

CVE-2026-102489 / CVE-2026-102490 | Zammad (Zammad GmbH) | CVSS: N/A
⚠️ Actively exploited. These two Zammad flaws are designed to be chained: CVE-2026-102489 enables session fixation leading to RCE as the zammad user, and CVE-2026-102490 then escalates that foothold to root. Zammad is widely deployed as a helpdesk and ticketing platform — a full root compromise of your support infrastructure is a severe blast radius. CISA due date has passed.

New CVEs (Published Last 24h)

CVE-2026-16823, CVE-2026-19491 | IBM Security Verify Access / IBM Verify Identity Access | CVSS: 9.1 (Critical)
Two authentication bypass flaws affecting IBM Security Verify Access 10.0–10.0.9.2 and IBM Verify Identity Access 11.0–11.0.3 allow unauthenticated remote attackers to circumvent security controls entirely. An identity and access management platform with a bypass vulnerability is about as bad as it sounds — this is a potential skeleton key to any system relying on these products for authentication.

CVE-2026-16916 | IBM Security Verify Access / IBM Verify Identity Access | CVSS: 9.1 (Critical)
A separate but equally critical flaw in the same IBM platforms allows a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure. Combined with the authentication bypasses above, an attacker can chain unauthenticated access directly into RCE. Treat the full IBM Verify Access cluster as compromised until patched.

CVE-2026-81932 | IBM Guardium Data Protection 12.0–12.2 | CVSS: 8.6 (High)
Unauthenticated SQL injection in IBM Guardium Data Protection allows remote attackers to view, modify, add, or delete data in the backend database. Guardium is specifically a data security platform — SQL injection against your data protection tool is a particularly uncomfortable irony.

CVE-2026-108113 | ILIAS (before 9.24 / 10.12 / 11.5) | CVSS: 8.8 (High)
An unrestricted file upload flaw in ILIAS's QTI question import feature allows authenticated authors to write a .htaccess and PHP webshell to a web-served directory, achieving RCE as the web server user. The attack surface is any user with question pool import rights — a common privilege in academic environments where ILIAS is widely deployed.

CVE-2026-107782 | System Informer (before 4.0.26241.138) | CVSS: 7.8 (High)
A local privilege escalation in System Informer's phsvc helper allows any Authenticode-signed process to connect to SiSvcApiPort and call PhSvcApiCreateService, executing code as SYSTEM. The trick: load your malicious code into a Microsoft-signed host like rundll32.exe to satisfy the signature check. Update System Informer and review its deployment in privileged environments.

Headline News

North Korea's TraderTraitor Plants Malware in Trojanized Terraform Provider

A campaign attributed to TraderTraitor — the North Korean state-backed APT also tracked as Jade Sleet, UNC4899, and Slow Pisces — has been caught distributing a trojanized Terraform provider to deliver cross-platform malware. The July 2026 campaign, now publicly detailed, sees the group targeting infrastructure engineers and DevOps practitioners specifically via tooling they trust implicitly in their daily workflows. The trojanized provider behaves normally during use, making detection difficult without supply chain integrity verification. TraderTraitor has historically focused on cryptocurrency theft and financial sector targets, but tooling-layer supply chain compromise represents a significant tactical evolution. Any organisation using third-party Terraform providers should validate provider authenticity through checksums and official registries, and review recent provider updates for anomalous behaviour.

FBI Seizes Chinese Phishing Infrastructure in Broad Disruption Operation

The FBI and Department of Justice have seized and rendered inoperable phishing tools — identified as Microscan and FishHub — used by Chinese state-linked hackers in what officials described as an "indiscriminate and reckless" cyber operation. The platforms functioned as phishing-as-a-service infrastructure, enabling scalable credential harvesting campaigns across a wide range of targets. The operation's characterisation as indiscriminate is notable: unlike targeted espionage, this campaign appears to have swept broadly, suggesting opportunistic credential collection at scale rather than surgical intelligence gathering. The seizure disrupts current operations but doesn't eliminate the threat actors themselves — expect retooling and reconstitution. Practitioners should treat this as a prompt to review phishing-resistant authentication deployments and check whether any credentials may have been exposed to these campaigns.

Ransomware Hits Japanese Cloud Provider IDCF, Government Clients Disrupted

IDC Frontier, a major Japanese cloud and digital infrastructure provider, has disclosed a ransomware attack against its IDCF Cloud service that caused an outage at a data centre cluster serving eastern Japan. The incident is notable because IDCF Cloud counts government entities among its clients, raising questions about the downstream impact on public sector operations and data. Japan has seen an uptick in attacks against critical infrastructure-adjacent services over the past eighteen months, and this incident fits a pattern of ransomware groups deliberately targeting national cloud providers to maximise leverage and disruption. The blast radius of cloud provider compromises extends well beyond the provider itself — tenants should be actively reviewing their incident response plans for scenarios where their cloud platform, not their own environment, is the victim.

Schrödinger's Feed

IonQ has announced entanglement rates exceeding 1,000 operations per second between a trapped ion qubit and a solid-state memory via a photonic interconnect — a milestone some are framing as quantum computing's transistor moment. High-rate entanglement across different qubit modalities is a key prerequisite for scalable, networked quantum systems that could eventually underpin quantum communication infrastructure. The photonic interconnect approach is particularly relevant to cryptography, since photonic links are also central to proposed quantum key distribution networks. Practitioners don't need to act today, but the pace at which hardware milestones are arriving is compressing timelines for post-quantum cryptography migration — if your PQC roadmap is measured in "eventually," it may be time to sharpen that estimate.

/dev/random

The top-scoring story doing the rounds this week is the eye-watering funding announcement from a company called Typesafe AI — $870 million raised at a $7.5 billion valuation. The specific punchline the security community is enjoying: "Typesafe" is a term of art from programming meaning your code won't accidentally treat a password as an integer and explode at runtime. Whether the name implies their AI is immune to the type of foot-gun memory safety bugs that generate approximately half of all CVEs, or whether it's just a confident brand choice, remains unclear. Either way, the collective raised eyebrow from practitioners who've spent careers cleaning up type confusion vulnerabilities seems entirely warranted. We await the first CVE with interest.