NewsCheck Point Research
19th October – Threat Intelligence Report
Linked advisories
- CVE-2025-8088RARLAB WinRAR — RARLAB WinRAR Path Traversal Vulnerability
- CVE-2025-8088dtsearch: Path Traversal: '.../...//'
- CVE-2025-8088Security update for clamav
- CVE-2025-8088Security update for clamav
- CVE-2025-8088Security update for clamav
- CVE-2025-8088Security update for clamav
- CVE-2025-8088Security update for clamav
- CVE-2025-8088RARLAB WinRAR: WinRAR Path Traversal Vulnerability
- CVE-2026-102764BeyondTrust Remote Support — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- CVE-2026-102764BeyondTrust Remote Support: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
- CVE-2026-102764BeyondTrust Remote Support: Umgehung der Authentifizierung durch Spoofing
- CVE-2026-102764BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)
- CVE-2026-102764BeyondTrust Remote Support Security Restriction Bypass Vulnerability
- CVE-2026-104935Ivanti Connect Secure — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-104935Eine Schwachstelle zur Umgehung der Authentifizierung durch Spoofing in ICS vor Version 25.
- CVE-2026-104935October 2026 Security Update
- CVE-2026-104935Ivanti Connect Secure: Schwachstelle ermöglicht die Umgehung von Authentifizierung und Codeausführung
- CVE-2026-104935Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root
- CVE-2026-104935Active Exploitation of Vulnerability in Ivanti Connect Secure
- CVE-2026-35029LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
- CVE-2026-35029LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin rol…
- CVE-2026-35029BerriAI LiteLLM: Forced Browsing
- CVE-2026-35029LiteLLM: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
- CVE-2026-35029BerriAI LiteLLM: Forced Browsing
- CVE-2026-35029LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
- CVE-2026-35029Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update
- CVE-2026-59823LiteLLM: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
- CVE-2026-59823pip litellm: Server-Side-Request-Forgery (SSRF)
- CVE-2026-59823Open Source LiteLLM: Server-Side-Request-Forgery (SSRF)
- CVE-2026-59823LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
- CVE-2026-59823LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
- CVE-2026-59823LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
- CVE-2026-96951Microsoft Windows — Microsoft Windows Command Injection Vulnerability
- CVE-2026-96951Microsoft Windows: Befehlsinjektion
- CVE-2026-96951Windows Shell Security Feature Bypass Vulnerability
- CVE-2026-96951Microsoft Windows und Windows Server: Mehrere Schwachstellen
- CVE-2026-96951Microsoft Office Produkte: Mehrere Schwachstellen ermöglichen Privilegieneskalation
- CVE-2026-96951Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)
- CVE-2026-97229GitLab: Mehrere Schwachstellen
- CVE-2026-97229Security Advisory 2026-016 — Critical Vulnerability in GitLab CE and EE
- CVE-2026-97229GitLab Community Edition and Enterprise Edition — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- CVE-2026-97229GitLab: Ganzzahlüberlauf
- CVE-2026-97229Integer Overflow or Wraparound in GitLab
- CVE-2026-97229Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs
- CVE-2026-97229Integer Overflow or Wraparound in GitLab
- CVE-2026-97229Critical Vulnerability in GitLab Community Edition and Enterprise Edition
- CVE-2026-97229Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- CVE-2026-97229Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- CVE-2026-97229Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Affected vendors and products
- BerriAI BerriAI LiteLLM
- BeyondTrust BeyondTrust Remote Support
- GitLab GitLab
- Ivanti Ivanti Connect Secure
- LiteLLM LiteLLM
- Microsoft Microsoft Edge (chromium-based)
- Microsoft Microsoft Windows
- Microsoft Microsoft Windows 10 1607
- Microsoft Microsoft Windows 10 1809
- Microsoft Microsoft Windows 10 21H2
- Microsoft Microsoft Windows 10 22h2
- Microsoft Windows 10 Version 1607
More on October
Other advisories
- Not ratedosv:CLEANSTART-2026-HO16280HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023
- Not ratedosv:CLEANSTART-2025-OK79065Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nam...
- Not ratedosv:CLEANSTART-2026-QS58056HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023
- MediumCVE-2026-94290Rancher and Fleet October 2026 security release: any Rancher user could become cluster-admin on the management cluster (CVE-2026-94290)
- HighCVE-2026-20291Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
- HighCVE-2026-76490Cisco Expressway Series Security Hardening Release: October 2026
- CriticalCVE-2026-76475Cisco Unified Communications Products Security Hardening Release: October 2026
- CriticalCVE-2026-106071Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases
Other news entries
- European supermarkets that failed to act after French freezer attack are now feeling the heatNewsCSO Online
- Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal AccessNewsThe Hacker News
- Cybersecurity M&A Roundup: 37 Deals Announced in October 2026NewsSecurityWeek
- DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud EnvironmentNewsThe Hacker News
- Microsoft fixes Smart App Control broken by October Windows updateNewsBleepingComputer
- Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)NewsRapid7
- Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated ScriptsNewsThe Hacker News
- Ivanti patches two more Connect Secure zero-days chained in attacksNewsBleepingComputer
Source: https://research.checkpoint.com/2026/19th-october-threat-intelligence-report/
ID