Daily briefing · October 24, 2026
Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and Postiz
Verdict of the day — calm
The day is rated CALM: none of the 76 new vulnerabilities reached weaponized status, none are under active exploitation (KEV), and none were seen by VulnCheck ahead of CISA. Even so, 12 critical flaws were published, led by token forgery in Postiz, a cluster of PHP object injection bugs in WordPress plugins and an authentication bypass in asVereinbase. The tone is one of monitoring, with attention to internet-facing, unauthenticated flaws.
Today’s brief
- CALM verdict: 0 weaponized, 0 in active exploitation, 0 seen by VulnCheck before CISA.
- 76 new CVEs, 12 of them critical; the top 10 are all critical, with CVSS between 9.3 and 9.9.
- Postiz has two critical flaws (CVE-2026-115933 and CVE-2026-115932), involving forged tokens and arbitrary file reads.
- WordPress plugins dominate: object injection in Prime Mover, Paytium and Newsletters, plus an authentication bypass in asVereinbase and SQL injection in two plugins.
12
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
In Postiz, a route lets a user obtain a validly signed token with arbitrary claims, since session, invitation and password reset tokens share the same secret and carry no marker of purpose. This opens the door to impersonation and privilege escalation in affected instances.
2
The Prime Mover plugin (up to 2.2.1) deserializes untrusted input in its migration routine, and an unauthenticated attacker can plant a crafted object through the comment mechanism. PHP object injection on public WordPress sites can lead to severe impact, depending on the available gadget chains.
3
Paytium (up to 5.0.5) is affected by deserialization of untrusted data, enabling object injection. As a payments plugin, it deserves priority in review on sites that process transactions.
4
The Newsletters plugin (up to 4.18.1) has an object injection flaw caused by deserializing untrusted data, with CVSS 9.8. It is a high-severity bug in a widely installed plugin and calls for prompt updating.
5
The asVereinbase plugin (before 1.1.8) accepts an empty stored value as a valid password or second factor, allowing an unauthenticated attacker to log in as any user, including an administrator. A proof of concept exists, which raises the practical risk of full site takeover.
6
In Postiz, an authenticated user can make the publishing worker read an arbitrary server file and send it as an attachment to a Discord server. The result is leakage of sensitive files, such as configuration and secrets, from the host.
7
The Unitree Go2 robot (up to 1.1.11.4) allows remote OS command injection through the set_volume function. A fix exists in version 1.1.11.5, and networked robots should be updated and isolated.
8
CPython adds a denylist of known compromised certificates to the ssl module, rejecting them regardless of the SSLContext policy. It is more of a hardening measure than a classic exploitable flaw, but it is relevant for environments that rely on Python's TLS validation.
9
Product Filter by WBW (up to 3.4.6) is vulnerable to blind SQL injection, which can allow data extraction from the WooCommerce store database. The EPSS score is low, but the exposure of public stores justifies updating.
10
The Newsletters plugin (up to 4.18.1) also has an SQL injection flaw, with CVSS 9.3. Combined with the object injection flaw in the same plugin, it makes upgrading a priority for anyone using it.
Ransomware today
Recent ransomware activity remains concentrated on Brazilian victims. Over the last 30 days the most active groups were N0n (6 victims, all in Brazil), thegentlemen (5), emperador (4), incransom (3), akira (2) and Vexy Ransomware (2), all with their listed victims in the country.
N0n 6thegentlemen 5emperador 4incransom 3akira 2Vexy Ransomware 2
Active groups & APTs
Groups with recent activity or updates include Elderwood (China), Lazarus Group (North Korea), APT29 (Russia), WIRTE, TA577 and vicesociety. No known victims are associated with any of them in the data for this period.
Brazil focus
Recent Brazilian victims span several sectors: GTL Concreto e Logística and MPI LTDA (emperador), Suhai Segurança Pessoal, CLIMEDI, Universidade de Passo Fundo and Pantanal Agrícola (thegentlemen), Prafesta (N0n) and Hospital Sírio-Libanês (THE SEVEN DEADLY SINS). Healthcare and education stand out among the affected organizations.
GTL Concreto e Logística LTDA
Suhai Segurana Pessoal
CLIMEDI
Hospital Sírio-Libanês
Prafesta Ind. e Com. de Embalagens Ltda
Universidade de Passo Fundo
Pantanal Agricola
MPI LTDA
Today’s recommendation: Update the affected WordPress plugins (Prime Mover, Paytium, Newsletters, asVereinbase and Product Filter by WBW) and Postiz to the fixed versions, and rotate secrets on Postiz instances that may have been exposed. Update the Unitree Go2 to 1.1.11.5 and restrict network access to the device.
Even on a calm day, critical flaws in exposed components keep appearing, and the only way to know whether they affect you is to validate your own attack surface.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →