What you need to know today.
BeyondTrust zero-day exploited by APTs; Microsoft patches actively exploited Windows Shell flaw; numerous critical vulns disclosed.
A critical remote code execution vulnerability in BeyondTrust Remote Support (CVE-2026-102764) has been added to CISA's Known Exploited Vulnerabilities catalog. This flaw, which allows attackers to bypass security controls and gain administrative access, has reportedly been exploited by Chinese espionage actors since August, as detailed by The Hacker News and Mandiant Threat Intelligence. The vulnerability stems from inadequate message origin validation within the product's internal components.
Microsoft's October Patch Tuesday addressed a record-breaking 1,413 vulnerabilities, including a critical command injection flaw in Windows Shell (CVE-2026-96951) that is now also on CISA's KEV list. This vulnerability allows attackers to bypass security features over a network. Multiple sources, including The Record and Help Net Security, highlight the severity and active exploitation of this bug.
Several other critical vulnerabilities were disclosed, including an untrusted search path flaw in DeepSeek Harness (CVE-2026-95182) enabling arbitrary code execution. ProPhoenix Law RMS (CVE-2024-34323) suffers from an Insecure Direct Object Reference (IDOR) allowing sensitive information disclosure. Additionally, WmsCMS (CVE-2026-89309) has an authorization bypass in its mobile server, and Wavlink WL-WN530BE1-A (CVE-2026-109108) contains an OS command injection vulnerability.
A significant number of authentication bypass and missing authentication vulnerabilities have been identified across various products. These include issues in Canove WhaTicket (CVE-2026-111708), LangChat (CVE-2026-111704), IceCMS (CVE-2026-111673), Fastapiadmin (CVE-2026-111641), and Webreaper Damselfly (CVE-2026-111626), all allowing unauthenticated attackers to gain unauthorized access or perform privileged actions. Hard-coded credentials in DataBuff ai-apm-web (CVE-2026-111693) and EseeCloud devices (CVE-2026-107617) also present serious risks.
WordPress plugins are also affected, with the LearnPress plugin (CVE-2026-104736) vulnerable to PHP Object Injection due to deserialization of untrusted input. The My Calendar plugin (CVE-2026-104798) has a privilege escalation vulnerability. Netcore NR256CN (CVE-2026-111711) has a pre-authentication stack overflow in its web server. The Linux kernel also saw a fix for a vulnerability in vxlan (CVE-2026-74475).