Archive snapshot

Thu, Oct 15 · 06:00 PM CDT

Archived briefing content rendered inside the ACSP site experience.

Back to archive

Archived briefing

Snapshot overview

Generated Thu, Oct 15 · 06:00 PM CDTWindow last 6 hours

Top line

Coverage now updates on a rolling 6-hour window, while NVD entries come from the live API using a last-24-hours modified window and are sorted by severity.

Fast take

News stays on the current 6-hour slice, videos now use the last 24 hours, and NVD uses the API instead of the traditional feed to better match the live site behavior.

Top stories

5

Worth skimming

5

Tracked videos

1

NVD vulnerabilities

25

Top stories

Thu, 15 Oct 2026 20:32:41 +0000

Targeted ads delivered 0-click exploits to install mercenary malware

9.5/10 · Must read/watch

Ars Technicavulnmalware

Summary
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.

Open article ↗

Thu, Oct 15 · 06:00 PM CDT

New Aoki Infostealer Targets AI Coding Assistant Credentials

9.4/10 · Must read/watch

Infosecurity Magazinemalwareaiidentity

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Fri, 16 Oct 2026 01:54:36 +0530

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

9.2/10 · Must read/watch

The Hacker Newsvulnai

Summary
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as

Open article ↗

Fri, 16 Oct 2026 00:19:33 +0530

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

8.6/10 · Worth your time

The Hacker Newsai

Summary
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a b

Open article ↗

Thu, Oct 15 · 06:00 PM CDT

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

8.5/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Worth skimming

Thu, Oct 15 · 06:00 PM CDT

Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool

8.4/10 · Worth your time

Infosecurity Magazineai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, Oct 15 · 06:00 PM CDT

France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack

8.2/10 · Worth your time

Infosecurity Magazinegeneral

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Thu, 15 Oct 2026 19:00:00 GMT

Bringing GPT-Rosalind to academic research labs

8.1/10 · Worth your time

OpenAIgeneral

Summary
Introducing the Rosalind Academic Plan, offering eligible academic labs sponsored access to GPT-Rosalind and tools to advance life sciences research.

Open article ↗

Thu, Oct 15 · 05:00 PM CDT

The 8-mile hole in a Hawaii national park that no one can explain

8.1/10 · Worth your time

Hacker Newsai

Summary
Surfaced from Hacker News front page during collection run. Freshness on HN: 1 hour ago.

Open article ↗

Thu, Oct 15 · 06:00 PM CDT

Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs

8.0/10 · Worth your time

Infosecurity Magazinevulnai

Summary
Collected from the Infosecurity Magazine news page during the latest run.

Open article ↗

Videos worth watching

Thu, Oct 15 · 10:02 AM CDT

Browser Cache Payloads

7.6/10 · Worth your time

YouTube / John Hammondgeneral

Why it matters
Recent creator upload with some page-level evidence. Better than raw feed discovery, but still not a full content review.

Summary
This ClickFix technique stages the next payload through the browser cache, leaving a batch script on the file system before the user runs a command through t...

Worth watching?Maybe — good candidate if the title matches your interests, but confidence is still moderate.

Confidencelow

Open article ↗

NVD vulnerabilities

Fri, Mar 12 · 07:15 PM CST

CVE-2021-20231

9.8/10 · Must read/watch

NVDvuln

Summary
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.

CVECVE-2021-20231

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 12 · 07:15 PM CST

ModifiedWed, Oct 14 · 11:16 AM CDT

Open article ↗

Fri, Mar 12 · 07:15 PM CST

CVE-2021-20232

9.8/10 · Must read/watch

NVDvuln

Summary
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.

CVECVE-2021-20232

SeverityCRITICAL

TypeUPDATED

PublishedFri, Mar 12 · 07:15 PM CST

ModifiedWed, Oct 14 · 11:16 AM CDT

Open article ↗

Tue, May 25 · 10:15 PM CDT

CVE-2021-33574

9.8/10 · Must read/watch

NVDvuln

Summary
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other

CVECVE-2021-33574

SeverityCRITICAL

TypeUPDATED

PublishedTue, May 25 · 10:15 PM CDT

ModifiedWed, Oct 14 · 12:17 PM CDT

Open article ↗

Mon, Jan 10 · 02:12 PM CST

CVE-2022-22822

9.8/10 · Must read/watch

NVDvuln

Summary
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVECVE-2022-22822

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 10 · 02:12 PM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Mon, Jan 10 · 02:12 PM CST

CVE-2022-22823

9.8/10 · Must read/watch

NVDvuln

Summary
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVECVE-2022-22823

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 10 · 02:12 PM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Mon, Jan 10 · 02:12 PM CST

CVE-2022-22824

9.8/10 · Must read/watch

NVDvuln

Summary
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

CVECVE-2022-22824

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 10 · 02:12 PM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Fri, Jan 14 · 07:15 AM CST

CVE-2022-23218

9.8/10 · Must read/watch

NVDvuln

Summary
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack

CVECVE-2022-23218

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jan 14 · 07:15 AM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Fri, Jan 14 · 07:15 AM CST

CVE-2022-23219

9.8/10 · Must read/watch

NVDvuln

Summary
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stac

CVECVE-2022-23219

SeverityCRITICAL

TypeUPDATED

PublishedFri, Jan 14 · 07:15 AM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Mon, Jan 24 · 02:15 AM CST

CVE-2022-23852

9.8/10 · Must read/watch

NVDvuln

Summary
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

CVECVE-2022-23852

SeverityCRITICAL

TypeUPDATED

PublishedMon, Jan 24 · 02:15 AM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Wed, Feb 16 · 01:15 AM CST

CVE-2022-25235

9.8/10 · Must read/watch

NVDvuln

Summary
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

CVECVE-2022-25235

SeverityCRITICAL

TypeUPDATED

PublishedWed, Feb 16 · 01:15 AM CST

ModifiedWed, Oct 14 · 04:17 PM CDT

Open article ↗

Wed, Feb 16 · 01:15 AM CST

CVE-2022-25236

9.8/10 · Must read/watch

NVDvuln

Summary
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

CVECVE-2022-25236

SeverityCRITICAL

TypeUPDATED

PublishedWed, Feb 16 · 01:15 AM CST

ModifiedWed, Oct 14 · 05:17 PM CDT

Open article ↗

Thu, Sep 23 · 01:15 PM CDT

CVE-2021-22945

9.1/10 · Must read/watch

NVDvuln

Summary
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

CVECVE-2021-22945

SeverityCRITICAL

TypeUPDATED

PublishedThu, Sep 23 · 01:15 PM CDT

ModifiedWed, Oct 14 · 12:17 PM CDT

Open article ↗

Thu, Jul 22 · 06:15 PM CDT

CVE-2021-35942

9.1/10 · Must read/watch

NVDvuln

Summary
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have b

CVECVE-2021-35942

SeverityCRITICAL

TypeUPDATED

PublishedThu, Jul 22 · 06:15 PM CDT

ModifiedWed, Oct 14 · 12:17 PM CDT

Open article ↗

Thu, Apr 16 · 04:59 PM CDT

CVE-2015-0469

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVECVE-2015-0469

SeverityHIGH

TypeUPDATED

PublishedThu, Apr 16 · 04:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Thu, Jul 16 · 10:59 AM CDT

CVE-2015-2628

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.

CVECVE-2015-2628

SeverityHIGH

TypeUPDATED

PublishedThu, Jul 16 · 10:59 AM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Thu, Jul 16 · 10:59 AM CDT

CVE-2015-2638

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVECVE-2015-2638

SeverityHIGH

TypeUPDATED

PublishedThu, Jul 16 · 10:59 AM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Thu, Jul 16 · 11:00 AM CDT

CVE-2015-4731

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVECVE-2015-4731

SeverityHIGH

TypeUPDATED

PublishedThu, Jul 16 · 11:00 AM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Thu, Jul 16 · 11:00 AM CDT

CVE-2015-4732

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.

CVECVE-2015-4732

SeverityHIGH

TypeUPDATED

PublishedThu, Jul 16 · 11:00 AM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Thu, Jul 16 · 11:00 AM CDT

CVE-2015-4760

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVECVE-2015-4760

SeverityHIGH

TypeUPDATED

PublishedThu, Jul 16 · 11:00 AM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Wed, Oct 21 · 09:59 PM CDT

CVE-2015-4805

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

CVECVE-2015-4805

SeverityHIGH

TypeUPDATED

PublishedWed, Oct 21 · 09:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Wed, Oct 21 · 11:59 PM CDT

CVE-2015-4835

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.

CVECVE-2015-4835

SeverityHIGH

TypeUPDATED

PublishedWed, Oct 21 · 11:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Wed, Oct 21 · 11:59 PM CDT

CVE-2015-4843

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVECVE-2015-4843

SeverityHIGH

TypeUPDATED

PublishedWed, Oct 21 · 11:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Wed, Oct 21 · 11:59 PM CDT

CVE-2015-4844

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVECVE-2015-4844

SeverityHIGH

TypeUPDATED

PublishedWed, Oct 21 · 11:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Wed, Oct 21 · 11:59 PM CDT

CVE-2015-4860

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.

CVECVE-2015-4860

SeverityHIGH

TypeUPDATED

PublishedWed, Oct 21 · 11:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Wed, Oct 21 · 11:59 PM CDT

CVE-2015-4881

10.0/10 · Must read/watch

NVDvuln

Summary
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835.

CVECVE-2015-4881

SeverityHIGH

TypeUPDATED

PublishedWed, Oct 21 · 11:59 PM CDT

ModifiedWed, Oct 14 · 10:17 PM CDT

Open article ↗

Ignore today

Generic low-detail roundups without primary reporting.
HN items that are interesting but not clearly security or AI relevant.
Creator videos that look more like promotion, podcast chatter, or evergreen content than time-sensitive signal outside the rolling window.