cybr.cx — Daily Digest | October 09, 2026

Critical Vulnerabilities

⚠️ Actively Exploited — CVE-2015-5477 | ISC BIND | CVSS: N/A (Legacy)

CISA added this decade-old BIND vulnerability to the KEV catalogue this week, confirming active exploitation is ongoing right now. Remote attackers can crash BIND nameservers via malformed TKEY queries, causing a denial of service. If you're running any legacy BIND deployments — particularly in embedded devices, routers, or unmanaged DNS infrastructure — treat this as urgent. Remediation due date: October 11.

⚠️ Actively Exploited — CVE-2016-3081 | Apache Struts | CVSS: N/A (Legacy)

Apache Struts' Dynamic Method Invocation command injection flaw is back in active exploitation campaigns. Attackers can achieve remote code execution via crafted method: prefix requests when DMI is enabled. If Struts is anywhere in your stack — including legacy internal apps — DMI must be disabled immediately. Remediation due date: October 11.

⚠️ Actively Exploited — CVE-2023-22894 | Strapi | CVSS: N/A

Attackers with admin panel access to Strapi CMS can exfiltrate sensitive user data — including hashed passwords and PII — via the query filter API. CISA notes the affected versions may already be end-of-life. If you're running Strapi in any production environment, audit admin access immediately and consider migration off EoL versions. Remediation due date: October 11.

⚠️ Actively Exploited — CVE-2021-3199 | ONLYOFFICE Docs | CVSS: N/A

A path traversal vulnerability in ONLYOFFICE Docs allows remote code execution via a crafted /.. sequence in an image upload parameter, even when JWT authentication is in use. Attackers have been chaining this against collaborative document environments. Patch or isolate ONLYOFFICE instances immediately. Remediation due date: October 11.

⚠️ Actively Exploited — CVE-2015-3306 | ProFTPD | CVSS: N/A (Legacy)

Another legacy flaw seeing fresh exploitation: ProFTPD's SITE CPFR/SITE CPTO commands allow unauthenticated remote attackers to read and write arbitrary files on the server. If ProFTPD is running anywhere — especially internet-facing — this needs immediate attention. Remediation due date: October 11.

⚠️ Actively Exploited — CVE-2026-88779 | Citrix NetScaler ADC / Gateway | CVSS: N/A

An out-of-bounds memory operation in Citrix NetScaler ADC and Gateway is being actively weaponised for denial of service. NetScaler infrastructure is a perennial target given its network edge position. Apply Citrix's patch immediately; this one is overdue (CISA due date was October 7).

⚠️ Actively Exploited — CVE-2026-102489 + CVE-2026-102490 | Zammad | CVSS: N/A

These two Zammad vulnerabilities are being chained in the wild for a full compromise. CVE-2026-102489 is a session fixation flaw enabling RCE as the zammad user; CVE-2026-102490 then escalates that foothold to root via improper privilege management. Any internet-exposed Zammad helpdesk installation should be treated as potentially compromised. CISA due date has already passed (October 5).

⚠️ Actively Exploited — CVE-2026-104286 | Fortinet FortiMail | CVSS: N/A

Unauthenticated attackers are exploiting a path traversal and null-byte injection flaw in FortiMail to write arbitrary files to the underlying OS via crafted HTTP/HTTPS requests — a classic webshell-planting scenario. FortiMail sits on the email perimeter; a compromise here means full visibility into inbound/outbound mail flow. Patch immediately.

CVE-2026-107639 | ILIAS LMS | CVSS: 8.8 — HIGH

An argument injection vulnerability in ILIAS's image map question component allows any question author to achieve remote code execution. Attackers embed tab-separated ImageMagick convert options inside uploaded image filenames — options that escapeshellcmd() does not sanitise — writing a PHP webshell directly under the web root. Affects ILIAS before 9.24, 10.x before 10.12, and 11.x before 11.5. Educational institutions running ILIAS should patch immediately, particularly given the broad author-level access typical in academic environments.

CVE-2026-84250 | IBM Guardium Data Protection 12.2 | CVSS: 8.4 — HIGH

Guardium ships with a hard-coded recovery key in the pkcrypto passkey component alongside weak cryptographic protections. A local attacker can exploit this to recover the root password and fully own the appliance — particularly damaging given that Guardium is a data security monitoring platform. Privilege escalation on your security monitoring tool is about as bad as it gets.

CVE-2026-14905 | IBM DataPower Gateway | CVSS: 8.2 — HIGH

Multiple versions of IBM's DataPower Gateway are vulnerable to XML External Entity (XXE) injection when processing XML input. Remote, unauthenticated attackers can extract sensitive server-side files or exhaust memory resources. Affected versions span 10.5.0.0–10.5.0.22, 10.6.x, and 11.0.0.0–11.0.0.2. DataPower commonly sits in API gateway and enterprise integration roles, making information disclosure here particularly sensitive.

CVE-2026-107701 | dot-access ≤ 1.0.0 (npm) | CVSS: 8.2 — HIGH

The dot-access npm library is vulnerable to prototype pollution via its set() method. Supplying a path containing __proto__ segments — possible wherever user-supplied field names reach this library — allows attackers to inject arbitrary properties into Object.prototype, potentially bypassing authorisation checks or crashing Node.js processes. Audit any application accepting user-controlled dotted paths.

CVE-2026-82335 | IBM Guardium Data Protection 12.x | CVSS: 8.1 — HIGH

A heap-based buffer overflow in Guardium's MongoDB protocol parser allows a remote attacker to send a crafted SCRAM username with an excessive length field, causing memory corruption that could lead to arbitrary code execution or DoS. Unauthenticated network access is sufficient to trigger it.

CVE-2026-107707 | Intego Antivirus for Windows ≤ 3.0.0.1 | CVSS: 7.8 — HIGH

A symlink/junction following vulnerability in Intego's Windows optimisation module lets local unprivileged users delete arbitrary folders as SYSTEM. By replacing a directory with a junction to C:\Config.msi and abusing Windows Installer rollback, attackers can escalate to code execution as SYSTEM. Local privilege escalation via the security tool itself.

Headline News

Google Domains Hijacked via ccTLD Registry Breaches

Threat actors have compromised the backend infrastructure of at least three country-code top-level domain (ccTLD) registries — Ghana, American Samoa, and Sierra Leone — and used that access to modify authoritative DNS records for Google domains within those namespaces. Crucially, the attackers also obtained valid HTTPS certificates for the hijacked domains, meaning browser trust indicators provided no warning to affected users. The attack vector targets the often-overlooked trust chain between registrars, registry operators, and certificate authorities — a layer most organisations assume to be out of scope for their threat model. This incident is a significant reminder that domain security extends well beyond your own registrar account: your exposure includes every ccTLD you operate under and the security posture of that registry's upstream operators. Security teams managing multi-country domain portfolios should audit their certificate transparency logs immediately for unexpected issuances and review CAA (Certification Authority Authorisation) records across all domains.

A Wave of Ancient Vulnerabilities Hits the CISA KEV — And They're Being Exploited Right Now

CISA's Known Exploited Vulnerabilities catalogue added a striking batch of entries this week, with several entries dating back to 2015 and 2016 — including flaws in ISC BIND, Apache Struts, and ProFTPD that most practitioners would consider long-retired from active threat consideration. The simultaneous addition of these legacy CVEs alongside more recent issues in Strapi, ONLYOFFICE, Zammad, and FortiMail strongly suggests adversaries are running opportunistic campaigns that sweep wide across internet-exposed infrastructure, hitting whatever vulnerable version responds. The tight three-day remediation windows CISA has assigned reflect the severity of active exploitation, but the real concern is the attack surface implied: legacy software running in production environments that organisations may not even know they have. Incident responders should treat this as a prompt for a comprehensive inventory sweep — particularly for embedded systems, inherited infrastructure, and any application stack that predates 2020. The attackers clearly aren't ignoring old vulnerabilities just because the security industry has moved on.

Schrödinger's Feed

Oratomic has raised $775 million in fresh funding with a specific focus on fault-tolerant quantum computing — the architectural milestone that would make quantum systems reliable enough for cryptographically relevant workloads. Fault tolerance is the critical threshold: without it, quantum noise limits what these machines can actually compute, but with it, the timeline to breaking RSA and elliptic curve cryptography becomes a serious engineering question rather than a theoretical one. Significant capital concentrating on this specific problem suggests investor conviction that fault tolerance is closer than the academic consensus has traditionally suggested. Practitioners implementing post-quantum cryptography migrations should note the pace of investment here — the urgency of PQC transition planning is not diminishing.

/dev/random

This week's entry in "things that shouldn't need auditing but apparently do": OpenAI's annualised revenue figures came in roughly $20 billion lower than the company had previously signalled to investors and partners, a discrepancy large enough to qualify as a rounding error only by Silicon Valley standards. For security practitioners, the practical concern isn't the revenue gap itself but what it implies about the reliability of AI vendor claims more broadly — if top-line figures are this loosely defined, how confident should we be in stated model capability benchmarks, safety evaluations, or incident response commitments? Vendor due diligence just got a new line item: ask your AI providers to show their working. Extraordinary claims, as they say, require extraordinary evidence — or at minimum, consistent arithmetic.