Daily brief

Friday 16 Oct 2026

2 added to CISA's known exploited list, 7 supply chain compromises.

Added to CISA's known exploited list

CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support · Critical 9.3 · CISA: check for compromise · Federal deadline 2026-10-19
CVE-2025-61624 Fortinet Multiple Products Path Traversal VulnerabilityFortinet Multiple Products · Medium 5.4 · CISA: check for compromise · Federal deadline 2026-10-19

Malicious release pyyi 2.4.1, 2.4.2, 2.4 on PyPI was a malicious releasepyyi 2.4.1, 2.4.2, 2.4, 2.5.5, 2.5.2, 2.5.0, 2.5.1, 2.5.4, 2.5.3
Malicious release fromthehotel-poems 0.1.0 on PyPI was a malicious releasefromthehotel-poems 0.1.0
Malicious release @flexmr/survey-client 1.0.0, 1.0.12, 3.0.12 on npm was a malicious release@flexmr/survey-client 1.0.0, 1.0.12, 3.0.12, 10.0.12, 2.0.12
Malicious release @flexmr/survey-conversation 1.0.12, 10.0.12, 2.0.12 on npm was a malicious release@flexmr/survey-conversation 1.0.12, 10.0.12, 2.0.12, 1.0.0, 3.0.12
Malicious release marocolor 1.0.0 on PyPI was a malicious releasemarocolor 1.0.0
Malicious release itsa-react-focuscontainer 16.0.10 on npm was a malicious releaseitsa-react-focuscontainer 16.0.10
Malicious release itsa-react-maskedinput 16.1.2 on npm was a malicious releaseitsa-react-maskedinput 16.1.2