Archive snapshot

Mon, Oct 12 · 12:00 AM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Mon, Oct 12 · 12:00 AM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

2

NVD vulnerabilities

25

Top stories

Mon, Oct 12 · 12:00 AM CDT

ASOS Confirms Data Breach Linked to Stolen Employee Credentials

8.0/10 · Worth your time

Infosecurity Magazineidentity

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Mon, Oct 12 · 12:00 AM CDT

Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware

8.0/10 · Worth your time

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Mon, Oct 12 · 12:00 AM CDT

Q3 2026 Sets New Record for Ransomware Attacks

7.8/10 · Worth your time

Infosecurity Magazinemalware

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Mon, Oct 12 · 12:00 AM CDT

Wikimedia Says Rogue AI Agents Abused its Platforms

7.8/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Mon, Oct 12 · 12:00 AM CDT

AI Training Critical as Governance Challenges Grow

7.8/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Worth skimming

Mon, Oct 12 · 12:00 AM CDT

Major AI Firms Pledge Data Protection Changes Following UK Privacy Watchdog Push

7.8/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Mon, Oct 12 · 12:00 AM CDT

Critical Flaw in Multiple Atlassian Products Exploited in the Wild

7.6/10 · Worth your time

Infosecurity Magazinevuln

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Sun, Oct 11 · 06:00 PM CDT

Fingerprints are the new cookies

7.6/10 · Worth your time

Hacker Newsgeneral

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 6 hours ago.

Open article ↗

Sun, Oct 11 · 07:00 PM CDT

Whatever became of holography? (2011)

7.6/10 · Worth your time

Hacker Newsgeneral

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 5 hours ago.

Open article ↗

Sun, Oct 11 · 09:00 PM CDT

Calculus with Julia

7.6/10 · Worth your time

Hacker Newsgeneral

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 3 hours ago.

Open article ↗

Videos worth watching

John Hammond

6.8/10 · Skim only if relevant

YouTube / John Hammondgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Summary
Free Cybersecurity Education and Ethical Hacking.

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NahamSec

6.6/10 · Skim only if relevant

YouTube / NahamSecgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Summary
HACK THE PLANET!! Hi! I'm NahamSec. I think everyone can be a hacker and I'm on a mission to prove that!

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-42696

10.0/10 · Must read/watch

NVDvuln

Summary
Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.

CVECVE-2026-42696

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Sat, Oct 10 · 05:16 PM CDT

CVE-2026-104398

9.8/10 · Must read/watch

NVDvuln

Summary
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

CVECVE-2026-104398

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 05:16 PM CDT

ModifiedSat, Oct 10 · 05:16 PM CDT

Open article ↗

Sat, Oct 10 · 07:16 PM CDT

CVE-2026-105892

9.8/10 · Must read/watch

NVDvuln

Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

CVECVE-2026-105892

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 07:16 PM CDT

ModifiedSat, Oct 10 · 07:16 PM CDT

Open article ↗

Sat, Oct 10 · 07:16 PM CDT

CVE-2026-106610

9.8/10 · Must read/watch

NVDvuln

Summary
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

CVECVE-2026-106610

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 07:16 PM CDT

ModifiedSat, Oct 10 · 07:16 PM CDT

Open article ↗

Sat, Oct 10 · 03:16 PM CDT

CVE-2026-108551

9.8/10 · Must read/watch

NVDvuln

Summary
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or

CVECVE-2026-108551

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 03:16 PM CDT

ModifiedSat, Oct 10 · 03:16 PM CDT

Open article ↗

Sat, Oct 10 · 07:16 PM CDT

CVE-2026-108598

9.8/10 · Must read/watch

NVDvuln

Summary
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, ex

CVECVE-2026-108598

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 07:16 PM CDT

ModifiedSat, Oct 10 · 07:16 PM CDT

Open article ↗

Thu, Oct 08 · 02:16 PM CDT

CVE-2026-14991

9.8/10 · Must read/watch

NVDvuln

Summary
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

CVECVE-2026-14991

SeverityCRITICAL

TypeUPDATED

PublishedThu, Oct 08 · 02:16 PM CDT

ModifiedSat, Oct 10 · 01:17 PM CDT

Open article ↗

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-39801

9.8/10 · Must read/watch

NVDvuln

Summary
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

CVECVE-2026-39801

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Thu, Oct 08 · 09:18 PM CDT

CVE-2026-78401

9.8/10 · Must read/watch

NVDvuln

Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVECVE-2026-78401

SeverityCRITICAL

TypeUPDATED

PublishedThu, Oct 08 · 09:18 PM CDT

ModifiedSat, Oct 10 · 01:17 PM CDT

Open article ↗

Thu, Oct 08 · 08:17 PM CDT

CVE-2026-84272

9.8/10 · Must read/watch

NVDvuln

Summary
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.

CVECVE-2026-84272

SeverityCRITICAL

TypeUPDATED

PublishedThu, Oct 08 · 08:17 PM CDT

ModifiedSat, Oct 10 · 01:17 PM CDT

Open article ↗

Sat, Oct 10 · 05:17 PM CDT

CVE-2026-105889

9.3/10 · Must read/watch

NVDvuln

Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVECVE-2026-105889

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 05:17 PM CDT

ModifiedSat, Oct 10 · 05:17 PM CDT

Open article ↗

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-40800

9.3/10 · Must read/watch

NVDvuln

Summary
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

CVECVE-2026-40800

SeverityCRITICAL

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Thu, Oct 08 · 09:17 PM CDT

CVE-2026-16916

9.1/10 · Must read/watch

NVDvuln

Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

CVECVE-2026-16916

SeverityCRITICAL

TypeUPDATED

PublishedThu, Oct 08 · 09:17 PM CDT

ModifiedSat, Oct 10 · 01:17 PM CDT

Open article ↗

Thu, Oct 08 · 09:17 PM CDT

CVE-2026-19491

9.1/10 · Must read/watch

NVDvuln

Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

CVECVE-2026-19491

SeverityCRITICAL

TypeUPDATED

PublishedThu, Oct 08 · 09:17 PM CDT

ModifiedSat, Oct 10 · 01:17 PM CDT

Open article ↗

Sat, Oct 10 · 02:16 PM CDT

CVE-2026-105885

8.8/10 · Worth your time

NVDvuln

Summary
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVECVE-2026-105885

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 02:16 PM CDT

ModifiedSat, Oct 10 · 02:16 PM CDT

Open article ↗

Sat, Oct 10 · 03:16 PM CDT

CVE-2026-108550

8.8/10 · Worth your time

NVDvuln

Summary
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verif

CVECVE-2026-108550

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 03:16 PM CDT

ModifiedSat, Oct 10 · 03:16 PM CDT

Open article ↗

Sat, Oct 10 · 06:16 AM CDT

CVE-2026-87780

8.8/10 · Worth your time

NVDvuln

Summary
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

CVECVE-2026-87780

SeverityHIGH

TypeUPDATED

PublishedSat, Oct 10 · 06:16 AM CDT

ModifiedSat, Oct 10 · 12:16 PM CDT

Open article ↗

Sat, Oct 10 · 06:16 AM CDT

CVE-2026-87781

8.6/10 · Worth your time

NVDvuln

Summary
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVECVE-2026-87781

SeverityHIGH

TypeUPDATED

PublishedSat, Oct 10 · 06:16 AM CDT

ModifiedSat, Oct 10 · 12:16 PM CDT

Open article ↗

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-42633

8.5/10 · Worth your time

NVDvuln

Summary
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

CVECVE-2026-42633

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Sat, Oct 10 · 07:16 PM CDT

CVE-2026-96341

8.2/10 · Worth your time

NVDvuln

Summary
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

CVECVE-2026-96341

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 07:16 PM CDT

ModifiedSat, Oct 10 · 07:16 PM CDT

Open article ↗

Sat, Oct 10 · 03:16 PM CDT

CVE-2026-108549

8.1/10 · Worth your time

NVDvuln

Summary
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_

CVECVE-2026-108549

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 03:16 PM CDT

ModifiedSat, Oct 10 · 03:16 PM CDT

Open article ↗

Thu, Oct 08 · 09:17 PM CDT

CVE-2026-19494

8.1/10 · Worth your time

NVDvuln

Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

CVECVE-2026-19494

SeverityHIGH

TypeUPDATED

PublishedThu, Oct 08 · 09:17 PM CDT

ModifiedSat, Oct 10 · 01:17 PM CDT

Open article ↗

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-39802

8.1/10 · Worth your time

NVDvuln

Summary
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

CVECVE-2026-39802

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-40777

8.1/10 · Worth your time

NVDvuln

Summary
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

CVECVE-2026-40777

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Sat, Oct 10 · 08:16 PM CDT

CVE-2026-40801

8.1/10 · Worth your time

NVDvuln

Summary
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

CVECVE-2026-40801

SeverityHIGH

TypeNEW

PublishedSat, Oct 10 · 08:16 PM CDT

ModifiedSat, Oct 10 · 08:16 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.