Daily brief
Thursday 15 Oct 2026
1 added to CISA's known exploited list, 1 reported exploited and not on CISA's list, 11 supply chain compromises, 1 critical flaw in products attackers have targeted.
Added to CISA's known exploited list
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityAtlassian Multiple Products · Critical 9.3 · CISA: check for compromise · Federal deadline 2026-10-18
Reported exploited, not on CISA's list yet
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support · Critical 9.3 · CISA: check for compromise · Federal deadline 2026-10-19 · Zero-day reported by 6 outlets, first by Google Threat Intelligence
Supply chain compromises
- Malicious release py-sock2 0.1.0 on PyPI was a malicious releasepy-sock2 0.1.0
- Malicious release py-worm 0.1.0, 2.0.0, 2.0.1 on PyPI was a malicious releasepy-worm 0.1.0, 2.0.0, 2.0.1
- Malicious release getpubip 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious releasegetpubip 0.1.0, 0.1.1, 0.1.2
- Malicious release proxyrubika 0.1.0 on PyPI was a malicious releaseproxyrubika 0.1.0
- Malicious release py-wormgpt 1.0.0 on PyPI was a malicious releasepy-wormgpt 1.0.0
- Malicious release proxy-rubikis 0.1.0 on PyPI was a malicious releaseproxy-rubikis 0.1.0
- Malicious release proxyrobika 0.1.0 on PyPI was a malicious releaseproxyrobika 0.1.0
- Malicious release buyerdashboard 45.3.4 on npm was a malicious releasebuyerdashboard 45.3.4
- Malicious release idlive-face-capture-web-development 78.8.1 on npm was a malicious releaseidlive-face-capture-web-development 78.8.1
- Malicious release web-pixels-manager 76.2.4 on npm was a malicious releaseweb-pixels-manager 76.2.4
- Malicious release xapi-lib 88.2.5, 88.2.3, 90.2.1 on npm was a malicious releasexapi-lib 88.2.5, 88.2.3, 90.2.1, 90.3.1
Critical flaws in products attackers have targeted
- CVE-2026-110916 Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secuGoogle Chrome · Critical 9.6 · Fixed in 155.0.8059.84
10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON