cybr.cx Daily Digest — October 11, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2015-5477 | ISC BIND | No CVSS (legacy)
A decade-old vulnerability in ISC BIND is back in active exploitation. Unauthenticated remote attackers can trigger a denial-of-service condition by sending malformed TKEY queries, crashing the DNS daemon. CISA's remediation deadline was today — if you're running BIND and haven't patched or mitigated, treat this as P0. Any internet-facing DNS infrastructure should be audited immediately.

⚠️ Actively exploited — CVE-2016-3081 | Apache Struts | No CVSS (legacy)
Remote code execution via command injection in Apache Struts is seeing renewed exploitation activity — yes, in 2026. When Dynamic Method Invocation is enabled, attackers can abuse the method: prefix to execute arbitrary commands. Legacy Java stacks running end-of-life Struts versions are the target. If you have any Struts applications still in production, disable DMI now and accelerate decommission plans.

⚠️ Actively exploited — CVE-2021-3199 | ONLYOFFICE Docs | No CVSS
A path traversal flaw in ONLYOFFICE Docs that can lead to remote code execution is actively being weaponised. When JWT authentication is in use, attackers can smuggle a /.. sequence through an image upload parameter to escape the intended directory and achieve RCE. Self-hosted ONLYOFFICE deployments — common in enterprise and government environments — are the primary risk surface. Patch or take offline until patched.

⚠️ Actively exploited — CVE-2015-3306 | ProFTPD | No CVSS (legacy)
An improper access control vulnerability in ProFTPD allows unauthenticated remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. Another legacy flaw showing fresh exploitation signals — likely being chained with other vulnerabilities for initial access or data exfiltration. Disable the mod_copy module at minimum; upgrade immediately.

⚠️ Actively exploited — CVE-2023-22894 | Strapi CMS | No CVSS
Attackers with admin panel access to Strapi can extract sensitive user data — including credentials — via query filter abuse due to cleartext storage of sensitive information. CISA notes the affected versions may be end-of-life. If you're running Strapi in production and haven't migrated to a supported version, this warrants urgent action given active exploitation.

⚠️ Actively exploited — CVE-2026-88779 | Citrix NetScaler ADC / NetScaler Gateway | No CVSS
A memory buffer bounds vulnerability in Citrix NetScaler ADC and Gateway is being exploited to cause denial-of-service conditions. Given NetScaler's role as a critical network gateway in enterprise environments, even a DoS impact is operationally severe. CISA's remediation deadline passed October 7 — check your Citrix advisory portal for patches and apply immediately.

CVE-2026-104899 | GeoDirectory WordPress Plugin | CVSS 8.1 | HIGH
An unauthenticated local file inclusion flaw in GeoDirectory (≤2.8.187) lets attackers pass a malicious design_type parameter to include and execute arbitrary PHP files server-side. No authentication required makes this particularly dangerous on any WordPress installation with this plugin active. Update to 2.8.188 or later immediately.

CVE-2026-104797 | Advanced Form Integration WordPress Plugin | CVSS 8.1 | HIGH
An authentication bypass via unverified password change in Advanced Form Integration (≤2.9.0) allows attackers to resolve a target user by email address and force a password reset without verification. Effectively an unauthenticated account takeover primitive against any WordPress user whose email is known. Patch now.

CVE-2026-83526 | FV Player 8 WordPress Plugin | CVSS 8.8 | HIGH
Arbitrary file upload in FV Player 8 (≤8.1.7) — the plugin writes attacker-supplied remote file content to the uploads directory before performing any MIME or extension validation, and lacks a capability check on player creation. Authenticated attackers (minimal privilege required) can upload a PHP webshell and achieve RCE. High priority for any site running this plugin.

CVE-2026-108550 | SkillHub | CVSS 8.8 | HIGH
A broken authorisation flaw in SkillHub's account merge flow (before 0.2.22) allows authenticated attackers to initiate a merge against any target account, receive the verification token directly from the API response, and complete the takeover — inheriting the victim's API tokens and session data. Straightforward to exploit post-authentication. Update to 0.2.22+.

CVE-2026-104723/104725/104766/77183 | Multiple WordPress Plugins | CVSS 8.8 | HIGH
A cluster of privilege escalation and object injection flaws across LifterLMS (≤10.2.1), Groundhogg CRM (≤4.9), LatePoint Booking (≤5.7.3), and FooSales POS (≤1.43.0) all score 8.8. Common thread: insufficient capability checks or missing ownership validation allowing low-privilege authenticated users to escalate to admin or take over arbitrary accounts. If any of these are in your WordPress environment, patch today.

Headline News

Telegram Desktop one-click file theft vulnerability
A vulnerability in Telegram Desktop allowed any user's local files to be silently exfiltrated with a single click — no additional interaction required beyond opening a crafted message. The flaw resided in how Telegram Desktop handled certain link schemes and file references, enabling an attacker to construct a message that, when clicked, triggered an outbound request leaking local file contents to an attacker-controlled server. The attack surface was broad: anyone using the desktop client was potentially affected, including users who rely on Telegram for sensitive operational communications. The researcher who discovered the flaw published a detailed proof-of-concept demonstrating full account-level file access. Telegram has patched the issue, but practitioners should verify they are running the latest desktop client version and treat any unpatched Telegram Desktop installation in a corporate environment as a data exfiltration risk.

Arrest in FBIjobs.gov breach tied to ShinyHunters
A suspected co-conspirator linked to the ShinyHunters threat group has been arrested in connection with the breach of FBIjobs.gov and a compromise of a third-party vendor servicing the portal. ShinyHunters has been attributed to a string of high-profile data theft operations over the past several years, with a consistent playbook of targeting SaaS vendors and recruitment platforms to harvest credentials and PII at scale. The FBIjobs.gov breach is particularly notable given the sensitivity of applicant data — including background information and contact details for individuals seeking law enforcement roles — and the counterintelligence implications of that data in adversarial hands. The arrest signals continued international law enforcement coordination against the group, though ShinyHunters has historically operated with distributed membership, making single arrests unlikely to be operationally decisive. Practitioners managing third-party vendor access to sensitive HR or recruitment platforms should treat this as a prompt to review vendor authentication requirements and data minimisation practices.

ClickFix campaign pivots to Claude AI lure via Google Ads and Bing redirects
Threat actors are running a sophisticated malvertising campaign that chains legitimate Bing redirect URLs inside Google Ads to point users toward fake Anthropic Claude installer pages. Once a victim lands on the spoofed page, a ClickFix-style attack is triggered — the page instructs users to paste a PowerShell command into a Run dialog to "fix" a fabricated installation error, a social engineering technique that has seen rapidly growing adoption across criminal campaigns. The use of legitimate Bing redirect infrastructure helps the malicious URLs bypass ad platform URL inspection and appear credible to victims. The campaign is notable because it targets a technically sophisticated demographic — developers and AI practitioners actively seeking Claude — who might otherwise be more sceptical of phishing lures. Defenders should ensure endpoint controls block unauthorised PowerShell execution and consider adding the known fake Claude domain patterns to DNS blocklists.

Schrödinger's Feed

Researchers at the University of Saskatchewan have achieved a meaningful step forward in quantum error correction, developing geometry-optimised hyperbolic surface codes that effectively double code distance and quadruple error suppression efficiency compared to conventional approaches. Error correction is the central unsolved challenge on the path to cryptographically relevant quantum computers — better codes mean fewer physical qubits needed to produce reliable logical qubits, lowering the hardware bar for large-scale computation. Separately, a demonstration of Grover's search algorithm running on a room-temperature diamond processor is generating quiet excitement, raising questions about whether vacuum-dependent quantum hardware faces the same slow displacement that vacuum tubes experienced from transistors. For practitioners tracking the timeline for post-quantum cryptography migration: improvements in error correction efficiency are exactly the kind of incremental progress that could compress that timeline — another reason not to treat PQC migration as a distant concern.

/dev/random

Someone has built a fully self-hosted personal AI agent — persistent memory, tool use, the works — that runs entirely within Cloudflare's free tier, using Workers, KV storage, and Durable Objects to stay well inside the zero-dollar threshold. The project, Talorys, is a neat demonstration that "self-hosted" no longer necessarily implies owning any hardware or paying any bills, which is either liberating or slightly unsettling depending on your threat model. The obvious question it raises for security practitioners: if a hobbyist AI agent with access to your personal data and API keys can be hosted for free on shared global edge infrastructure, what does your organisation's shadow-IT posture actually look like right now? Probably worth finding out before your users do.