cybr.cx — Daily Digest | October 13, 2026

Critical Vulnerabilities

⚠️ Actively Exploited — CVE-2015-5477 | ISC BIND | CVSS: N/A (Critical)

A decade-old vulnerability in ISC BIND is being actively exploited right now. Specially crafted TKEY queries can crash a BIND nameserver, resulting in a denial of service — no authentication required. If your DNS infrastructure runs an unpatched BIND instance, it is a live target today. CISA's patch deadline has already passed (October 11). Patch or isolate immediately.

⚠️ Actively Exploited — CVE-2016-3081 | Apache Struts | CVSS: N/A (Critical)

Also actively exploited: a remote code execution flaw in Apache Struts triggered via the method: prefix when Dynamic Method Invocation is enabled. This is a pre-auth RCE — no credentials needed. Struts is pervasive in enterprise Java applications, and this vulnerability has been weaponised before. If you're still running an affected Struts version, assume you're already a target.

⚠️ Actively Exploited — CVE-2021-3199 | ONLYOFFICE Docs | CVSS: N/A (High)

ONLYOFFICE Docs contains a path traversal vulnerability that can bypass JWT protections via a /.. sequence in an image upload parameter, enabling remote code execution. Active exploitation is confirmed. Organisations using ONLYOFFICE for collaborative document editing should audit exposure immediately — particularly internet-facing instances.

⚠️ Actively Exploited — CVE-2015-3306 | ProFTPD | CVSS: N/A (High)

An improper access control flaw in ProFTPD allows unauthenticated remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This is a file-write primitive that can lead to full system compromise when chained with writable paths. Another ancient vulnerability seeing a resurrection — check your FTP infrastructure.

⚠️ Actively Exploited — CVE-2023-22894 | Strapi | CVSS: N/A (High)

Attackers with admin panel access can exploit a cleartext storage flaw in Strapi to extract sensitive user information via query filters. CISA notes the affected versions may be end-of-life. If you're running Strapi and haven't migrated, this is now a confirmed exploitation scenario — not theoretical.

CVE-2026-52903 | ManageIQ | CVSS: 8.8 (High)

A dangerous deserialization flaw in ManageIQ's YamlLoadAliases module silently falls back from YAML.safe_load to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can upload a crafted YAML payload to trigger RCE. The silent fallback is particularly insidious — defenders may have assumed safe parsing was in effect. Restrict dialog import permissions and apply available patches.

CVE-2026-109305 & CVE-2026-109308 | Craft CMS | CVSS: 8.8 (High)

Two separate high-severity flaws in Craft CMS this cycle. The first (109305, affecting 5.x before 5.10.14) allows non-admin users with System Messages permissions to bypass the Twig sandbox using has some / has every operators, passing callables like passthru or system directly to PHP. The second (109308, affecting both 4.x and 5.x) permits behaviour and event-handler injection via unsanitised update request parameters, exploitable via gadget chains like AttributeTypecastBehavior. Both require authentication but have low privilege bars. Update to 4.18.7 or 5.10.14 immediately.

CVE-2026-109318 | Grav Git Sync Plugin | CVSS: 8.8 (High)

The Git Sync plugin for Grav CMS (versions 1.0.2–3.4.12) passes user-controlled profile fields — username, full name, email — directly into git commit --author via PHP exec(). Any authenticated content editor can inject shell substitutions to achieve OS command execution as the web server account. If you're running Grav with Git Sync enabled, update the plugin and audit who has content editor access.

CVE-2026-109185 & CVE-2026-109186 | jshERP | CVSS: 8.8 (High)

Two related flaws in jshERP through 3.6 make a nasty combination. The first allows any authenticated user to assign arbitrary roles — including tenant administrator — to any account via the updateUser handler. The second is a mass assignment vulnerability in the same controller, letting attackers overwrite tenant_id and password hashes. Together, these provide a clear path to full tenant takeover with minimal privilege. No patch is available at time of writing — restrict access to trusted users only.

CVE-2026-105464 | IBM Db2 | CVSS: 8.8 (High)

IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 on Linux, UNIX, and Windows contain an improper privilege management flaw exploitable by local attackers for privilege escalation. While local access is required, Db2 is frequently deployed in high-value environments where insider threat and post-compromise lateral movement are real concerns. Apply IBM's patches and audit local account access to Db2 hosts.

Headline News

Cyberattack Forces Supermarket Refrigeration Systems Offline Across Europe

In what's being described as an unprecedented attack on operational technology infrastructure, hackers compromised refrigeration control systems across multiple European supermarket chains, remotely triggering automatic defrost cycles en masse. The attack disrupted cold chain integrity across store networks, forcing emergency product disposal and impacting delivery logistics and pricing systems. The incident is a stark demonstration of how IT/OT convergence creates physical-world consequences — refrigeration systems in retail environments are typically managed via internet-connected building management platforms with notoriously poor patch cadence and weak authentication. For practitioners, this is a case study in why OT asset discovery and network segmentation aren't optional: an attacker with access to a building management system can now spoil millions in perishable inventory without ever touching a cash register. Expect threat intelligence teams to be scrutinising this for attribution over the coming days.

Yandex Data Centre Attack Collapses Bot Traffic by 99%

A physical or infrastructure-level attack against a Yandex data centre has caused the company's automated bot traffic to drop by approximately 99% within a seven-day observation window — a collapse visible in public traffic telemetry. The scale of the disruption suggests the affected facility hosted a significant portion of Yandex's web crawling and automated systems infrastructure. For defenders, the story cuts both ways: it illustrates how concentrated infrastructure dependencies create single points of catastrophic failure, while also temporarily cleaning up a meaningful slice of web bot noise. Organisations that monitor referral and crawler traffic may notice anomalies in their analytics as a downstream effect. The incident raises broader questions about the resilience of large-scale internet services to targeted physical infrastructure attacks.

Zod npm Package Briefly Suspected of Compromise

The popular TypeScript schema validation library Zod — with hundreds of millions of weekly downloads — triggered an urgent community investigation after suspicious activity was flagged around version 4.6.6. A commit linked to the concern drew immediate scrutiny from the open-source security community, demonstrating how quickly supply chain alerts now propagate through practitioner networks. While the full scope of the incident is still being assessed, the episode is a reminder that even foundational, well-maintained libraries are attractive targets: Zod sits deep in the dependency trees of countless JavaScript and TypeScript applications. Developers should verify their lockfiles, check installed versions against known-good hashes, and monitor upstream advisories closely. Supply chain vigilance isn't a periodic exercise — it's a continuous operational requirement.

Schrödinger's Feed

IonQ has announced the acquisition of zero-trust security vendor Elisity for up to $1.3 billion, explicitly framing the deal as a response to "harvest now, decrypt later" threats — where adversaries collect encrypted traffic today, intending to decrypt it once cryptographically relevant quantum computers exist. The combined offering aims to pair IonQ's post-quantum cryptography work with Elisity's network microsegmentation and identity-based access controls. It's a notable signal that quantum-threat timelines are being treated as near-term business risk, not decade-out research curiosity, by companies writing nine-figure cheques. Practitioners should be tracking PQC migration roadmaps now: if the vendors are already placing billion-dollar bets, the window for comfortable planning is narrowing faster than most enterprise patch cycles.

/dev/random

A study examining AI coding agents found that while they dramatically increase raw lines of code generated, they don't produce a corresponding increase in working, deployable software — a distinction that will surprise no one who's reviewed an AI pull request at 4pm on a Friday. The research suggests agents are excellent at producing the appearance of progress: functions written, tests scaffolded, boilerplate filled — but integration, correctness, and architectural coherence lag behind. In security terms, this is quietly alarming: more code surface area, generated faster, with less human review per line, is essentially a vulnerability pipeline with a nicer UI. The finding implies that AI-assisted development metrics need to shift from "code generated" to "functional, secure software shipped" — otherwise we're just automating the creation of future CVEs.