CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… (GitHub Security Advisories)

2026-10-27T15:38:39Z

[GitHub Security Advisories · GITHUB GHSA-2phh-27fw-q4gc + CVE-2026-108360 VERIFIED] ## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetches it with `file_get_contents()` using a stream co — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… (GitHub Security Advisories)

2026-10-27T19:01:39Z

[GitHub Security Advisories · GITHUB GHSA-r925-mgvr-h9cc + CVE-2026-108082 VERIFIED] ### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… (GitHub Security Advisories)

2026-10-27T19:01:50Z

[GitHub Security Advisories · GITHUB GHSA-2v3c-qxhr-7vpv + CVE-2026-109413 VERIFIED] ### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `m — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… (GitHub Security Advisories)

2026-10-27T21:07:12Z

[GitHub Security Advisories · GITHUB GHSA-mf2p-h6hf-fcwm + CVE-2026-116675 VERIFIED] ### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with th — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy… (The Hacker News)

Thu, 29 Oct 2026 20:50:29 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

Google's Gemini 4 Carbon Leads Benchmarks for Finding,… (The Hacker News)

Thu, 29 Oct 2026 19:12:40 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cyb — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Webinar: How to Build AI Threat Readiness Into Your Security… (The Hacker News)

Thu, 29 Oct 2026 17:09:41 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses fa — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Telegram Android Flaw Lets Attackers Run Code When Users Answer… (The Hacker News)

Thu, 29 Oct 2026 17:09:18 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10 — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

The Rise of the Threat Operator: How AI Will Redefine Security… (The Hacker News)

Thu, 29 Oct 2026 17:03:41 +0530

[The Hacker News · VERIFIED 6-FEED SECURITY RADAR] AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems can perform — Immediate UK Mitigation (£5 Starter Quick-Fix / £24 DMARC, SPF & MTA-STS Pack): Stage DMARC: start at p=none with rua to your own mailbox, move to p=quarantine once reports are clean, then p=reject; flatten SPF under the 10-lookup RFC 7208 ceiling with -all, and publish MTA-STS in mode: testing before enforce. Verify free at https://faultypacket.co.uk/dmarc-spf-mta-sts-remediation-guide.html

Hitachi Energy CoreTec Product (CISA Advisories)

Thu, 29 Oct 26 12:00:00 +0000

[CISA Advisories · GOV / OFFICIAL VENDOR VERIFIED] View CSAF Summary Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Siemens Mendix SAML Module (CISA Advisories)

Thu, 29 Oct 26 12:00:00 +0000

[CISA Advisories · GOV / OFFICIAL VENDOR VERIFIED] View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

Hitachi Energy TRO600 series products (CISA Advisories)

Thu, 29 Oct 26 12:00:00 +0000

[CISA Advisories · GOV / OFFICIAL VENDOR VERIFIED] View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA Advisories)

Wed, 28 Oct 26 12:00:00 +0000

[CISA Advisories · GOV/VENDOR + CVE-2026-41709 VERIFIED] CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-46300 Linux Kernel Missing Initialization of — Immediate UK Mitigation (£12 WordPress & WooCommerce Security Shield Pack): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers. Verify free at https://faultypacket.co.uk/wordpress-woocommerce-security-flaw-finder.html

From industry concern to practical action: the value of working… (UK NCSC Advisories)

Tue, 27 Oct 2026 12:00:00 +0000

[UK NCSC Advisories · GOV / OFFICIAL VENDOR VERIFIED] How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity — Immediate UK Mitigation (£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack): Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding. Verify free at https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html

BIMI Logo Not Showing in Gmail? Checklist | FaultyPacket