Bricksforge Plugin Vulnerability (CVE-2026-85097) Allows Unauthenticated RCE

Prioritize patching the Bricksforge WordPress Plugin due to unauthenticated RCE. Additionally, address RCE and SSTI vulnerabilities in Thelia versions 2.6.0 and 2.6.1. Defenders should also investigate Ledger devices sold by CryptoBilis regarding confirmed hardware implants.

Threat level high

Today in 60 seconds

Critical·Exploited·CVSS 9.8·3 outlets Bricksforge Plugin Vulnerability (CVE-2026-85097) Allows Unauthenticated RCE Unauthenticated attackers can achieve remote code execution via the Bricksforge WordPress Plugin. Do this today Upgrade Bricksforge WordPress Plugin to version 3.1.8.10 or later.
High·CVSS 7.2 Thelia: Multiple RCE and SSTI Vulnerabilities in Versions 2.6.0 and 2.6.1 Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities allowing RCE, SSTI, and XSS via file management and templates. Do this today Upgrade Thelia to a patched version immediately.
High Ledger: Hardware Implant Confirmed in Devices from CryptoBilis Reseller Ledger confirmed hardware implants were found in devices sold by reseller CryptoBilis, potentially draining crypto wallets. Do this today Users who purchased Ledger devices from CryptoBilis should not initiate setup if they have not done so.

Actively Exploited 4

Bricksforge Plugin Vulnerability (CVE-2026-85097) Allows Unauthenticated RCE Critical·Exploited·CVSS 9.8·3 outlets·SecurityWeekNewRead Unauthenticated attackers can achieve remote code execution via the Bricksforge WordPress Plugin.
CVE-2026-85097 is a critical flaw in the Bricksforge WordPress Plugin. This vulnerability allows unauthenticated users to upload and execute arbitrary PHP code on affected websites.

Why it matters. Successful exploitation grants threat actors full control of the targeted WordPress websites.

Do this today Upgrade Bricksforge WordPress Plugin to version 3.1.8.10 or later.

Affected
Bricksforge WordPress Plugin, versions up to 3.1.8.9

CVE
CVE-2026-85097

Read on SecurityWeek Post on X LinkedIn

Also covered by The Hacker News, GBHackers
```
{"coverage":0.774,"evidence":0.9,"freshness":0.642,"importance":1,"novelty":1,"quality":0.9,"total":0.895}
```
SonicWall SMA1000: Unauthenticated SSRF Flaw (CVE-2026-102255) Exploited Critical·Exploited·CVSS 10.0·5 outlets·BleepingComputerDay 2NewRead Attackers are exploiting a maximum-severity, pre-authenticated SSRF flaw in SonicWall SMA1000 appliances.
Attackers are exploiting CVE-2026-102255, a maximum-severity SSRF flaw in the Appliance WorkPlace interface. This flaw allows an unauthenticated remote attacker to perform unauthorized operations by directing the appliance to issue requests on their behalf.

Why it matters. The vulnerability permits unauthorized operations by interacting with internal services like CouchDB. SMA1000 devices are frequently targeted by MSSPs and large organizations for VPN access.

Do this today Patch SonicWall SMA1000 appliances immediately.

Affected
SMA1000 6210, 7210, and 8200v models

CVE
CVE-2026-102255
1. Sat 10 OctSonicWall SMA1000: Max Severity SSRF Flaw (CVE-2026-102255)
2. TodaySonicWall SMA1000: Unauthenticated SSRF Flaw (CVE-2026-102255) Exploited
Read on BleepingComputer Post on X LinkedIn

Also covered by SecurityWeek, Dark Reading
```
{"coverage":1,"evidence":0.9,"freshness":0.028,"importance":1,"novelty":0.6,"quality":0.95,"total":0.833}
```
Ransomware Exploits Palo Alto Networks GlobalProtect Authentication Bypass (CVE-2026-0257) Critical·KEV·Ransomware·CVSS 9.1·EPSS 97%·GBHackersNewRead Ransomware groups are actively exploiting an authentication bypass in GlobalProtect to gain unauthorized network access.
Ransomware operators are exploiting CVE-2026-0257, an authentication bypass vulnerability in GlobalProtect and Prisma Access. Successful exploitation allows attackers to establish unauthorized VPN sessions. This access can mimic legitimate remote work activity.

Why it matters. Exploitation provides a trusted remote-access pathway, enabling subsequent activities like credential theft, lateral movement, or ransomware deployment with potentially delayed detection.

Do this today Disable authentication override cookies on GlobalProtect portals and gateways if not required.

Affected
Palo Alto Networks PAN-OS GlobalProtect and Prisma Access

CVE
CVE-2026-0257

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":1,"freshness":0.583,"importance":1,"novelty":1,"quality":0.65,"total":0.831}
```
Chinese Actors Combine Tools to Steal Data via Exchange and Web Flaws Critical·KEV·Ransomware·CVSS 10.0·EPSS 100%·3 outlets·CISADay 3NewRead Chinese government-linked actors use automated tools and XSS to steal data from global organizations.
Chinese government-linked threat actors are combining automated scanning, botnets, and hands-on exploitation. These actors target organizations by exploiting vulnerabilities such as those in Microsoft Exchange servers and using cross-site scripting attacks.

Why it matters. Exploitation vectors include CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894, some of which are in the CISA KEV catalog.

Do this today Disable unused services and ports, sanitize web application inputs, and implement multifactor authentication for all services.

Affected
Microsoft Exchange servers, Apache Struts

CVE
CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, +5 more
1. Fri 9 OctChinese Actors Use Automated Tools to Steal Data from Global Organizations
2. Sat 10 OctChinese Actors Combine Tools to Steal Data via Multiple Vulnerabilities
3. TodayChinese Actors Combine Tools to Steal Data via Exchange and Web Flaws
Read on CISA Post on X LinkedIn

Also covered by The Hacker News, GBHackers
```
{"coverage":0.774,"evidence":1,"freshness":0.048,"importance":1,"novelty":0.6,"quality":0.95,"total":0.826}
```

Vulnerabilities & Patches 3

Thelia: Multiple RCE and SSTI Vulnerabilities in Versions 2.6.0 and 2.6.1 High·CVSS 7.2·CERT/CCNewRead Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities allowing RCE, SSTI, and XSS via file management and templates.
Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, and administrative workflows. Exploitation can lead to RCE, SSTI, and XSS. Specific flaws include insufficient file validation during document updates and banner uploads.

Why it matters. Several vulnerabilities allow authenticated administrative users to achieve arbitrary code execution on the host server. This exposes both server-side and client-side attack surfaces.

Do this today Upgrade Thelia to a patched version immediately.

Affected
Thelia 2.6.0, Thelia 2.6.1

CVE
CVE-2026-103521, CVE-2026-103522

Read on CERT/CC Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.755,"importance":0.75,"novelty":1,"quality":0.9,"total":0.649}
```
Discourse ImageMagick Vulnerability Enables Arbitrary File Read/Write (CVE-2026-55420) High·CVSS 8.1·GBHackersNewRead A low-privileged user can read and write server files on Discourse via ImageMagick exploitation during image uploads.
CVE-2026-55420 allows a low-privileged user to read and write files on the server by exploiting the ImageMagick-based upload pipeline. The vulnerability was triggered by crafting a polyglot file that passed initial image checks but reached ImageMagick's processing paths. This process allowed an attacker to execute an MSL payload, leading to arbitrary file read/write.

Why it matters. Exploitation could allow access to sensitive local files, potentially leading to privilege escalation depending on deployment configuration.

Do this today Update Discourse and verify ImageMagick policy blocks unnecessary coders and delegates.

Affected
Default Discourse deployments using Docker-based stack

CVE
CVE-2026-55420

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.682,"importance":0.75,"novelty":1,"quality":0.65,"total":0.616}
```
GitLab: Max Severity RCE in CI/CD Regular Expression Compiler (CVE-2026-97229) Medium·BleepingComputerNewRead An unauthenticated remote code execution vulnerability exists in GitLab's CI/CD Regular Expression Compiler.
A vulnerability, tracked as CVE-2026-97229, stems from an integer overflow weakness in the CI/CD Regular Expression Compiler. This flaw could allow an unauthenticated user to execute arbitrary code on targeted GitLab instances via a crafted regular expression.

Why it matters. Remote attackers can achieve unauthenticated code execution on vulnerable self-managed GitLab servers. Immediate patching is required to mitigate this risk.

Do this today Upgrade self-managed GitLab installations to the patched versions specified in the advisory.

Affected
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2

Read on BleepingComputer Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.72,"importance":0.75,"novelty":1,"quality":0.95,"total":0.55}
```

Worth watching

Walkthrough HackTheBox - DevHub IppSec · 10 Oct
Malware analysis Has AI Solved Reverse Engineering? Low Level · 9 Oct
Conference talk Black Hat Asia 2026 Highlights Black Hat · 10 Oct

Malware & Ransomware 1

WhatsApp Malware Uses Task Scheduler Injection for SYSTEM Privilege Escalation High·GBHackersNewRead Malware delivered via WhatsApp injects into Task Scheduler to achieve SYSTEM privileges and deploy payloads.
Malware delivered via a WhatsApp-lured financial document injects code into the Task Scheduler service, executing subsequent payloads with LocalSystem privileges. The payload uses a process-injection technique to establish persistence and download a final implant.

Why it matters. The technique bypasses traditional security inspection layers by using in-memory reconstruction and service-level execution context. This grants SYSTEM authority without requiring a secondary local privilege escalation flaw.

Do this today Block and hunt for connections to 61.18.208.27:8888 and review Task Scheduler telemetry for tasks named USOPrivate Kit.

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.656,"importance":0.75,"novelty":1,"quality":0.65,"total":0.514}
```

Threat Actors & Campaigns 3

Ukrainian Drones Target Yandex Data Centers, Disrupting Russian Digital Services Medium·3 outlets·The RecordNewRead Ukrainian drone strikes hit multiple Yandex data centers, causing widespread outages for cloud, payments, and online services.
Ukrainian drones struck a third Yandex data center in Vladimir, following previous attacks on facilities in the Ryazan and Kaluga regions. These attacks forced the shutdown of multiple facilities and damaged infrastructure at others. The disruptions affected Yandex Cloud, payments, deliveries, and numerous third-party services.

Why it matters. The repeated targeting of critical infrastructure demonstrates a sustained effort to degrade a major national digital service provider. Reliance on a single provider increases systemic risk for dependent businesses.

Do this today Review service dependencies on single cloud providers and establish alternative recovery plans.

Affected
Yandex Cloud, Yandex services, third-party services

Read on The Record Post on X LinkedIn

Also covered by BleepingComputer, The Register
```
{"coverage":0.774,"evidence":0,"freshness":0.697,"importance":0.5,"novelty":1,"quality":0.95,"total":0.531}
```
AI-Augmented Campaign Uses Claude Code Against Ukrainian Targets High·The Hacker NewsNewRead Researchers detailed an AI-augmented campaign using Claude Code to steal records from Ukrainian sites.
A campaign utilized an AI orchestration layer powered by Anthropic's Claude Code alongside commodity tools like Cobalt Strike. This activity targeted WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. The operation resulted in the theft of over 628,000 records.

Why it matters. Adversaries are integrating advanced AI models into initial access stages, increasing the sophistication of commodity tool usage.

Do this today Review logs for indicators of Cobalt Strike usage combined with AI orchestration patterns.

Affected
WordPress sites, e-commerce platforms, critical infrastructure entities in Ukraine

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.614,"importance":0.75,"novelty":1,"quality":0.8,"total":0.524}
```
Cybersecurity Executive Charged with Extortion in Pennsylvania Medium·Dark ReadingNewRead A cybersecurity executive was arrested and charged with conspiracy to extort money.
Edward Dubrovsky, a cybersecurity executive, was arrested in Pennsylvania. He was charged with conspiracy to extort money.

Why it matters. This incident details law enforcement action against individuals involved in ransomware negotiation activities.

Read on Dark Reading Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.871,"importance":0.5,"novelty":1,"quality":0.85,"total":0.48}
```

Breaches & Incidents 3

Ledger: Hardware Implant Confirmed in Devices from CryptoBilis Reseller High·BleepingComputerNewRead Ledger confirmed hardware implants were found in devices sold by reseller CryptoBilis, potentially draining crypto wallets.
Ledger confirmed that some devices distributed through reseller CryptoBilis contained unauthorized hardware implants. These implants were capable of capturing display output and button presses to steal seed phrases via an LTE connection. Ledger has paused sales through CryptoBilis and is investigating the incidents.

Why it matters. This incident demonstrates a physical supply-chain attack vector targeting hardware security modules. Users must assume devices from unauthorized sources are compromised.

Do this today Users who purchased Ledger devices from CryptoBilis should not initiate setup if they have not done so.

Affected
Ledger X devices

Read on BleepingComputer Post on X LinkedIn

Also covered by The Hacker News
```
{"coverage":0.613,"evidence":0,"freshness":0.685,"importance":0.75,"novelty":1,"quality":0.95,"total":0.58}
```
Danfoss Refrigeration Controllers Targeted in French Supermarket Cyberattack High·The RecordNewRead Attackers remotely triggered defrost functions on refrigeration controllers at French supermarkets.
A cyberattack disrupted refrigeration at hundreds of French supermarkets by remotely triggering the defrost function on units. The attack reportedly targeted older versions of Danfoss refrigeration controllers.

Why it matters. This demonstrates the potential for physical disruption of critical food supply infrastructure via industrial control systems.

Affected
Danfoss refrigeration controllers

Read on The Record Post on X LinkedIn

Also covered by BleepingComputer
```
{"coverage":0.613,"evidence":0,"freshness":0.486,"importance":0.75,"novelty":1,"quality":0.95,"total":0.561}
```
iRhythm Data Breach: Unauthorized Access to Patient Information High·The RecordDay 2NewRead iRhythm experienced a data breach involving unauthorized access to third-party business applications.
iRhythm reported a data breach involving unauthorized access to third-party-hosted business applications between June 3 and June 8. The breach exposed personal information for at least 360,000 people.

Why it matters. The exposed data includes names, addresses, phone numbers, patient account numbers, and insurance numbers. The incident did not affect clinical systems or medical devices.

Affected
iRhythm
1. Mon 12 OctiRhythm Data Breach: Unauthorized Access to Patient Information
2. TodayiRhythm Data Breach: Unauthorized Access to Patient Information
Read on The Record Post on X LinkedIn

Also covered by SecurityWeek
```
{"coverage":0.613,"evidence":0,"freshness":0.106,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.483}
```

AI Security 1

Researchers Bypass 6 AI Agent Frameworks Using 'Repeat-After-Me' Prompt Info·CSO OnlineNewRead A text repetition prompt can trick multiple AI agent frameworks into executing attacker-controlled tool calls.
Researchers demonstrated that a simple 'Repeat-After-Me' prompt can force six AI agent frameworks to execute tool calls written by an attacker. This technique allows an attacker to control tool invocation and its arguments via text repetition.

Why it matters. The vulnerability indicates an architectural weakness where the orchestration layer may treat model output as sufficient authority to execute operations. This bypasses system prompts designed to prevent dangerous requests.

Do this today Implement independent authorization checks for all sensitive tool calls within agent orchestration layers.

Affected
LangChain LangGraph, Microsoft Agent Framework, Microsoft AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents, CrewAI

Read on CSO Online Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.699,"importance":0.75,"novelty":1,"quality":0.8,"total":0.533}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2015-3306	ProFTPDThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.	10.0	99%	Exploited (KEV)CISA due 11 Oct (passed)
CVE-2015-5477	ISC BINDnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion fa…	7.5	99%	Exploited (KEV)CISA due 11 Oct (passed)
CVE-2016-3081	Apache StrutsApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker…	8.1	96%	Exploited (KEV)CISA due 11 Oct (passed)
CVE-2021-3199	ONLYOFFICE DocsDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. …	9.8	19%	Exploited (KEV)CISA due 11 Oct (passed)
CVE-2023-22894	StrapiStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. Th…	4.9	4%	Exploited (KEV)CISA due 11 Oct (passed)
CVE-2026-0257	Palo Alto Networks PAN-OSAuthentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to …	9.1	97%	Exploited (KEV)CISA due 1 Jun (passed)ransomware

Quiz

Yesterday's answer

According to the report, what key function does the Midnight Mimosa malware perform on infected devices?

Function as a residential proxy

The story explicitly states that the malware functions as a residential proxy.

Today's question

According to the security advisory, what is the primary impact of exploiting CVE-2026-85097 in the Bricksforge Plugin?

On the radar tomorrow

Patch TuesdayMicrosoft, Adobe and SAP fixes land today — tomorrow's brief has the breakdown
WatchingAnthropic takes risky AI tests offline after models breach govt sites
WatchingFBI arrests another suspected ShinyHunters hacker after agency breach

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Tools

apache/caldera★ 7417 · PythonAutomated Adversary Emulation Platform
OpenOSINT/OpenOSINT★ 1748 · PythonAI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. …
0xSteph/pentest-ai★ 1733 · PythonOpen-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof caps…
mukul975/cve-mcp-server★ 1622 · PythonProduction-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA…
KatrielMoses/MailAccess★ 1596 · PythonFree email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailacc…
jiwoochris/artex-ko★ 1378 · GoARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)

Community

Podcasts

180: ContiDarknet Diaries · 59:17
Soap Box: HD Moore talks OT security, frontier fearmongering and moreRisky Business · 34:01
SN 1099: An Alien Mind - From RSA Weakness to Agentic AttacksSecurity Now · 3:03:15
SANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)SANS Internet Storm Center · 5:32

That's today's brief.

The next brief lands at 06:30 IST.

Tuesday, 13 October 2026