📡 Tech & Security Digest — 2026-10-19

Curated from Hacker News, security blogs, and tech publications.

Critical BlockStrap flaw lets hackers run code on Magento servers — Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially …
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (ri…
Hackers exploit SiteGuard WAF flaw to run commands as admins — Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affecte…
BeyondTrust patches zero-day exploited in attacks since August — BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late Au…

Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch…
Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl…

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondT…
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions — A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident …
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation — Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.

The vuln…

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Conne…
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory — A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher …
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days — A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user onl…
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft — A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a&nbs…
Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts — Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.

Langflow is an open-source platform that all…

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug — A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kern…
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing — Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliat…