Alhamdulilah, My highest bounty so far, this was found back then using opus 4.6(and some skills) on azure horizondb CVE-2026-85878 https://t.co/vevhzKrD1N

Critical vulnerability CVE-2026-85878 hits Azure Postgres. It is a CVSS 9.9 privilege escalation risk. Audit your application credentials and patch immediately.

#Security #Azure #PostgreSQL #CVE

🚨 CVE-2026-85878 Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

🎖@cveNotify

A design choice in a frontend framework led to full backend compromise for a huge number of web apps.

React2Shell, tracked as CVE-2025-55182, hit React Server Components in late 2025. It allowed unauthenticated remote code execution with a CVSS score of 10.0.

The bug came from architecture rather than a simple coding slip. It blurred the line between data and executable intent at the client-server boundary.

In his AppSec Israel 2026 talk, "When React Becomes an Attack Vector: Lessons from the React2Shell CVE" , on Tuesday, October 6, Ofir Elarat used the flaw as a case study in insecure design.

Speaker: Ofir Elarat , Developer, Orion Security

The talk built a threat model with three trust zones: the browser, the framework runtime and the application server. It traced root causes such as implicit trust in framework-generated calls and weak checking of serialized input.

It walked the attack chain from client to server at a high level. It also mapped the flaw to the OWASP Top 10 and OWASP ASVS. It also explained what the fix changed.

The defensive patterns are practical. Treat framework-managed calls as untrusted input. Layer defenses across client, framework and server, then log server-side execution.

According to the React team's advisory , versions 19.0.1, 19.1.2 and 19.2.1 fix the flaw. CISA added it to its Known Exploited Vulnerabilities catalog days after disclosure.

Ofir Elarat is a software engineer at Orion Security. He was previously a senior software engineer at Mixtiles. Before that, he spent six years as a developer and team lead in the Israel Defense Forces.

He writes about rendering strategies and AI tooling on his Medium blog .

AppSec engineers and developers who use React Server Components should treat framework internals as part of their threat model.

Does your threat model treat framework-generated calls as untrusted input?

💀CRITICAL Exploits Trending (all CVSS 10) ├ CVE-2025-55182 · Meta/React “React2Shell” · Scanner live ├ CVE-2025-57819 · FreePBX · RCE detector live ├ CVE-2026-48907 · Joomla Content Editor · PoC live ├ CVE-2026-48908 · JoomShaper · PoC live └ CVE-2026-5430 · WSO2 · PoC live

ExploitGrid Daily Digest

🚨 Top Exploits: CVE-2025-55182 (CVSS: 10) Meta CVE-2025-57819 (CVSS: 10) FreePBX CVE-2026-48907 (CVSS: 10) joomlaconten... CVE-2026-48908 (CVSS: 10) https://t.co/rUCex2k1eh CVE-2026-5430 (CVSS: 10) WSO2

..🧵👇

#NØØT_Security_Alerts 🚨 #ALERT — TELEGRAM DESKTOP FLAW ENABLES ONE-CLICK FILE THEFT AND ACCOUNT HIJACKING October 7, 2026

DISCLOSED BY: beaksec / VulnCheck

PRODUCT: Telegram Desktop CVE: CVE-2026-107181 SEVERITY: High — CVSS 8.1 (v3.1)

AFFECTED VERSIONS: Before 7.2.9. Fixed in 7.2.9.

IMPACT: An IPC command-injection flaw allows crafted links to trigger unauthorized local-file uploads to an attacker-controlled Telegram group.

Exposed files may include credentials and Telegram session data, potentially enabling account takeover.

EXPLOITATION STATUS: PUBLIC END-TO-END RESEARCH PoC.

No verified in-the-wild exploitation.

EXPOSURE: The demonstrated Windows attack requires the victim to open a malicious external link that launches Telegram, with a Telegram instance already running.

The attack chain also uses a downloaded instruction file. Automatic group-file downloads increase exposure.

Account takeover through stolen session files is demonstrated when no Telegram local passcode is configured.

Forensic triage: Inspect unexpected group membership, suspicious files in Downloads/Telegram Desktop, unusual outgoing file transfers, and unknown active sessions.

No confirmed malicious infrastructure IOCs were published.

URGENT ACTION: Update Telegram Desktop to 7.2.9 or later.

Enable a local passcode, restrict group invitations, and require confirmation before saving received files.

Terminate unfamiliar sessions and investigate potential credential exposure.

SOURCE: https://t.co/zX8m2zXXBj

PATCH: https://t.co/yIQ0wW2CE8

CONFIDENCE: HIGH — Reproduced researcher PoC, VulnCheck advisory, and upstream source-code fix. Real-world attacks remain unverified.

#CyberSecurity #ThreatIntel #Telegram #AccountTakeover #VulnerabilityResearch

One click on a normal https link. That's all it took to steal files from Telegram Desktop.

CVE-2026-107181, CVSS 8.1, up to v7.2.8. The stolen session files can open your account.

Fixed in 7.2.9, quietly, no advisory. Update your desktop app today. https://t.co/IR2R02Ka0z

ONE CLICK, ACCOUNT GONE

#VALVET #Security https://t.co/cmXw5iFRDb

Happy Friday! It’s time for another Weekly Threat Roundup—a carefully selected compilation of must-read articles on the newest threats in the cyber world. Each week, we dive into the most pressing #cybersecurity news to bring you the insights you need to stay informed.

This week, a public proof-of-concept has dropped for CVE-2026-59346, a critical integer overflow in #VMware’s VMXNET3 virtual network adapter affecting Workstation and Fusion. The flaw sits in the TCP Segmentation Offload processing path inside the host’s vmware-vmx process — an attacker with admin privileges inside a guest VM can write crafted descriptors into the VMXNET3 transmit ring to crash the host process and power off the guest. The published PoC demonstrates that crash, not code execution, but Broadcom’s own advisory is explicit that the underlying bug enables guest-to-host code execution. This is the second VMXNET3 TSO flaw in roughly a year, following CVE-2025-41236. The fix shipped in VMware Workstation and Fusion 26H1u1 in early September. With public exploit code now available, the barrier to building a full exploit is lower than it was a week ago.

💡 Want to stay informed on evolving threats and solutions? Subscribe to our Weekly Threat Roundup to get the latest insights directly in your inbox: https://t.co/Og1NJ5LOr8

🛡️ VMWARE HYPERVISOR ESCAPE!

TSO heap overflow (CVE-2026-59346, CVSS 9.3) in VMXNET3 driver lets guest VMs break isolation to gain host-level code execution.

Read full Blog: https://t.co/h0vEFTHVHN

#Hacktober #CyberAwareness #sh3llc0d3 #shellcode #VMware #HypervisorEscape

This is a nasty one. A guest-to-host breakout with a 9.3 CVSS is the kind of bug that keeps virtualization admins up at night.

The vulnerability is an integer overflow in the VMXNET3 virtual network adapter . An attacker with admin privileges inside a VM can craft specific network traffic to trigger the overflow, escaping the sandbox to execute arbitrary code on the host OS.

Technical Breakdown: - CVE: CVE-2026-59346 - CVSS: 9.3 (Critical) - Component: VMXNET3 virtual network adapter - Privilege Required: Administrator/root inside the guest VM - Impact: Guest-to-host escape, arbitrary code execution on the hypervisor host - Affected Products: VMware Workstation (Pro & Player), VMware Fusion (Pro)

Defense: - Patch immediately. Apply the latest updates from Broadcom for Workstation and Fusion. - Detection: Monitor for unusual VMX process behavior on the host (e.g., child processes spawning from vmware-vmx.exe or vmware-vmx ), or anomalous outbound network connections from the host process. - Mitigation: If patching is delayed, restrict administrative access to VMs and consider disabling the VMXNET3 adapter in favor of e1000e if performance impact is acceptable (though this is a weak band-aid).

Source: https://socprime.com/blog/cve-2026-59346-analysis/

[Content removed]

#ParsedReport #CompletenessHigh 02-10-2026

Warlock Ransomware Attackers Hit Water and Telecom Operators

Report completeness: High

Actors/Campaigns: Warlock Storm-2603 Chamelgang

Threats: Toolshell_vuln K7rkscan_tool Dll_sideloading_technique Byovd_technique Lolbin_technique Nltest_tool Netexec_tool Crackmapexec_tool Edr-killer

Victims: Water utility, Telecommunications provider, Regional government, University, Critical infrastructure

Industry: Critical_infrastructure, Education, Telco, Government

Geo: Russia, Africa, China, Brazil, Taiwan, Japan, United states, Portuguese, India, Latin america

CVEs: CVE-2025-1055 [Vulners] CVSS V3.1: 5.6, Vulners: Exploitation: True

CVE-2025-53771 [Vulners] CVSS V3.1: 6.5, Vulners: Exploitation: True Soft: - microsoft sharepoint_server (<16.0.18526.20508, 2016, 2019)

CVE-2025-53770 [Vulners] CVSS V3.1: 9.8, Vulners: Exploitation: True Soft: - microsoft sharepoint_server (<16.0.18526.20508, 2016, 2019)

CVE-2025-49706 [Vulners] CVSS V3.1: 6.5, Vulners: Exploitation: True Soft: - microsoft sharepoint_enterprise_server (2016) - microsoft sharepoint_server (<16.0.18526.20424, 2019)

CVE-2025-49704 [Vulners] CVSS V3.1: 8.8, Vulners: Exploitation: True Soft: - microsoft sharepoint_server (2016, 2019)

TTPs: Tactics: 1 Technics: 0

ChatGPT TTPs: do not use without manual check T1027, T1033, T1036, T1059.001, T1087.002, T1098, T1105, T1110.003, T1190, T1211, have more...

IOCs: Domain: 5 File: 17 Command: 9 Url: 3 Hash: 19

Soft: SharePoint, Microsoft SharePoint, Visual Studio, Visual Studio Code, Microsoft SharePoint Server, SharePoint Server, Active Directory

Algorithms: base64

Functions: Symantec

Win API: NET

Languages: powershell

#ParsedReport #CompletenessHigh 02-10-2026

Warlock Ransomware Attackers Hit Water and Telecom Operators

Report completeness: High

Actors/Campaigns: Warlock Storm-2603 Chamelgang

Threats: Toolshell_vuln K7rkscan_tool Dll_sideloading_technique Byovd_technique Lolbin_technique Nltest_tool Netexec_tool Crackmapexec_tool Edr-killer

Victims: Water utility, Telecommunications provider, Regional government, University, Critical infrastructure

Industry: Critical_infrastructure, Education, Telco, Government

Geo: Russia, Africa, China, Brazil, Taiwan, Japan, United states, Portuguese, India, Latin america

CVEs: CVE-2025-1055 [Vulners] CVSS V3.1: 5.6, Vulners: Exploitation: True

CVE-2025-53771 [Vulners] CVSS V3.1: 6.5, Vulners: Exploitation: True Soft: - microsoft sharepoint_server (<16.0.18526.20508, 2016, 2019)

CVE-2025-53770 [Vulners] CVSS V3.1: 9.8, Vulners: Exploitation: True Soft: - microsoft sharepoint_server (<16.0.18526.20508, 2016, 2019)

CVE-2025-49706 [Vulners] CVSS V3.1: 6.5, Vulners: Exploitation: True Soft: - microsoft sharepoint_enterprise_server (2016) - microsoft sharepoint_server (<16.0.18526.20424, 2019)

CVE-2025-49704 [Vulners] CVSS V3.1: 8.8, Vulners: Exploitation: True Soft: - microsoft sharepoint_server (2016, 2019)

TTPs: Tactics: 1 Technics: 0

ChatGPT TTPs: do not use without manual check T1027, T1033, T1036, T1059.001, T1087.002, T1098, T1105, T1110.003, T1190, T1211, have more...

IOCs: Domain: 5 File: 17 Command: 9 Url: 3 Hash: 19

Soft: SharePoint, Microsoft SharePoint, Visual Studio, Visual Studio Code, Microsoft SharePoint Server, SharePoint Server, Active Directory

Algorithms: base64

Functions: Symantec

Win API: NET

Languages: powershell