---
title: Cybersecurity News | Signal Desk
url: https://signal-desk-d5t.pages.dev/news
---

# Cybersecurity News

Exploited-now vulnerabilities and patch alerts, each checked against CISA KEV or the vendor.

confirmed

2026-10-13

### Windows Shell zero-day CVE-2026-96951 exploited; on CISA KEV, due Oct 16

Microsoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.

Sources: [MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

confirmed

2026-10-13

### Ivanti Connect Secure CVE-2026-104935 added to KEV, due Oct 16

Authentication bypass by spoofing leading to remote command execution (CVSS 8.6). Listed in CISA KEV on Oct 13 with an Oct 16 due date. Apply Ivanti's fix and review appliance integrity.

Sources: [Ivanti advisory](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

confirmed

2026-10-13

### October 2026 Patch Tuesday: criticals to prioritize after the zero-day

Not known exploited, but high-value: Exchange Server RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs at 9.8 such as CVE-2026-70242; Message Queuing RCE CVE-2026-100202 (9.8); DHCP Server RCE CVE-2026-96934 and QUIC RCEs. Severity and exploitability labels are Microsoft's.

Sources: [MSRC release notes](https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct) · [NVD CVE-2026-70571](https://nvd.nist.gov/vuln/detail/CVE-2026-70571) · [NVD CVE-2026-70229](https://nvd.nist.gov/vuln/detail/CVE-2026-70229) · [NVD CVE-2026-70242](https://nvd.nist.gov/vuln/detail/CVE-2026-70242) · [NVD CVE-2026-100202](https://nvd.nist.gov/vuln/detail/CVE-2026-100202)

exploited (researcher), not on KEV

2026-10-13

### REDCap CVE-2026-90817 unauthenticated RCE exploited via public surveys

Unit 42 reports attacks dropping a webshell then a fileless XMRig miner. Fixed in 16.0.49, 17.3.10 and 17.4.4. Not in CISA KEV as of Oct 13; NVD has no entry yet.

Sources: [Unit 42 (via @Unit42_Intel)](https://x.com/Unit42_Intel/status/2109811397617992120)

confirmed

2026-10-13

### VMware vCenter CVE-2026-59310 on CISA KEV since Aug 18 (known ransomware use)

Broadcom VMware vCenter path traversal that lets a network-adjacent attacker execute code. CISA added it to KEV on Aug 18 with an Aug 21 federal due date and marks known ransomware campaign use. A separate dark-web monitor also claimed an exploit for sale (~$10k) on Oct 13; treat that as secondary noise. Patch vCenter and keep it off the public internet.

Sources: [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Broadcom advisory](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) · [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-59310) · [@ptdbugs (sale claim)](https://x.com/ptdbugs/status/2109657410138693679)

exploited (vendor/researcher), not on KEV

2026-10-12

### AhsayCBS CVE-2026-105133 + CVE-2026-105134 chain exploited since Oct 7

Auth bypass chained with Replication Receiver RCE gives SYSTEM. Huntress observed webshells and a disguised crypto miner. The first fix was incomplete: install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9), reboot, then hunt for compromise. Not in CISA KEV as of Oct 13.

Sources: [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) · [Ahsay](https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update)

exploited (Patchstack), not independently re-verified

2026-10-12

### Bricksforge WordPress plugin CVE-2026-85097 unauthenticated RCE

Patchstack reports first exploitation on Oct 7. Update the plugin or remove it. We could not reach a primary advisory page today, so treat details as preliminary. Not in KEV as of Oct 13.

Sources: [Patchstack database](https://patchstack.com/database/) · [@averyjparker summary](https://x.com/averyjparker/status/2109617279910674795)

exploitation reported, not on KEV

2026-10-09

### SonicWall SMA1000 CVE-2026-102255 pre-auth SSRF under attack

Pre-auth SSRF in the Work Place interface (advisory SNWLID-2026-0017). Upgrade to 12.4.3-03670 or 12.5.0-03082; note 12.5.0-02952, the September zero-day fix, is now listed as affected. Canada's Cyber Centre cites open-source reports of exploitation. Not in KEV as of Oct 13.

Sources: [SonicWall PSIRT](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017) · [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-102255) · [Cyber Centre AV26-1017](https://www.cyber.gc.ca/en/alerts-advisories/sonicwall-security-advisory-av26-1017)