The CyberSec Intelligence team presents the daily cybersecurity bulletin for October 11, 2026. Today’s analysis highlights new actively exploited vulnerabilities in critical systems, numerous security breaches of critical severity in popular web platforms, and the publication of functional exploits in the specialized press.
Actively exploited vulnerabilities
- CVE-2015-5477 (ISC BIND): A data processing error allows remote attackers to cause a Denial of Service (DoS) attack via TKEY queries.
- CVE-2016-3081 (Apache Struts): A command injection vulnerability allows remote arbitrary code execution via the method prefix when Dynamic Method Invocation is enabled.
- CVE-2023-22894 (Strapi): Cleartext storage of sensitive information allows attackers with access to the admin panel to discover user details. It can be chained with CVE-2023-22621 for remote code execution (RCE).
- CVE-2021-3199 (ONLYOFFICE Docs): A path traversal vulnerability when using JWT allows remote code execution via “/..” sequences in the image upload parameter.
- CVE-2015-3306 (ProFTPD): Improper access control allows attackers to read and write arbitrary files via the “site cpfr” and “site cpto” commands.
- CVE-2026-88779 (Citrix NetScaler): Incorrect restriction of operations within the bounds of a memory buffer in NetScaler ADC and Gateway can lead to a Denial of Service (DoS) attack.
New critical vulnerabilities
- CVE-2026-85531 (Sipay OpenCart Virtual POS): Improper verification of cryptographic signature in the OpenCart Virtual POS module allows signature spoofing through incorrect validation (maximum severity, CVSS 9.8).
- CVE-2026-86405 (Sipay PrestaShop Virtual POS): Similar vulnerability of faulty signature validation in the PrestaShop module, allowing spoofing (CVSS 9.8).
- CVE-2026-108107 (PHPNuxBill): Unauthenticated SQL Injection vulnerability in the REST endpoint radius.php, allowing the extraction of customer data and credentials through “time-based blind” SQLi attacks (CVSS 9.8).
- CVE-2026-104732 (WordPress Advanced IP Blocker): Complete bypass of authentication in the 2FA process through incorrect session validations, allowing full takeover of the site by unauthenticated attackers (CVSS 9.8).
- CVE-2026-107645 (WordPress Blocksy Companion): Privilege escalation to “seller” account level (Dokan) due to disabled nonce checks for registration (CVSS 9.1).
- CVE-2026-94589 (WordPress Extensions For CF7): Arbitrary file upload via the extcf7_submit function due to lack of extension and MIME type validation, allowing RCE (CVSS 9.8).
- CVE-2026-103889 (WordPress 3D Product configurator for WooCommerce): Remote code execution via the “xpv_image” parameter generated in a Dompdf HTML template with PHP execution enabled (CVSS 9.8).
- CVE-2026-97670 (WordPress Avada Builder): Authorization bypass allowing invocation of arbitrary hooks, potentially leading to permanent destruction of site content (CVSS 9.1).
- CVE-2026-104801 (WordPress PPOM): Arbitrary file deletion from the server (such as wp-config.php) and arbitrary file read due to insufficient file path validation in the rename function (CVSS 9.1).
- CVE-2026-104803 (WordPress WPCOM Member): Authentication bypass in the social-login flow, facilitating login as any user, including administrator (CVSS 9.8).
- CVE-2026-108551 (openapi-typescript-codegen): JavaScript code injection via unfiltered values interpolated in string templates within OpenAPI documents (CVSS 9.8).
- CVE-2026-108598 (Floci): Code injection in VtlTemplateEngine allowing unauthenticated attackers to execute operating system commands (CVSS 9.8).
From the security press
- No CVE associated (AnyDesk Linux): Security researchers have published a fully working exploit that provides pre-authentication root access on AnyDesk Linux systems, allowing remote code execution before the user accepts the connection. Details in the The Hacker News article.
- CVE-2026-107406 (Citrix NetScaler): Citrix has issued patches for a critical buffer overflow vulnerability in NetScaler ADC and Gateway, in SAML implementations, which can lead to remote code execution or Denial of Service. Details in the The Hacker News article.
What we recommend
To ensure the integrity of the IT infrastructure and the protection of sensitive data, we recommend implementing the following measures:
- Rigorous patch management (Patch Management): Immediately update the affected WordPress plugins, software platforms (Strapi, BIND, ProFTPD, AnyDesk), and Citrix network equipment to the latest secure versions.
- Software asset inventory: Perform a complete inventory of all modules and integrations used in e-commerce platforms (OpenCart, PrestaShop, WooCommerce) to quickly identify vulnerable components.
- Disabling insecure or unused features: If you use Apache Struts, make sure to disable Dynamic Method Invocation if it is not strictly necessary, and limit public access to administrative endpoints.
- Log monitoring (Log Monitoring): Implement detection rules in SIEM systems to identify SQL injection attempts, suspicious file uploads, or unusual authentication requests.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
