🛡️ Cybersecurity Vulnerability Watch

Week of: 2026-10-04 to 2026-10-10 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

1. Top Action Item

Patch the five Flax Typhoon–exploited vulnerabilities that CISA added to its Known Exploited Vulnerabilities (KEV) catalog this week, ahead of the October 11 federal remediation deadline. CISA made the KEV additions on Thursday after a China-linked threat actor (Flax Typhoon) abused the flaws, and the highest-rated is CVE-2015-3306 (CVSS 10.0), an improper access control issue in ProFTPD. If your organization runs ProFTPD or any of the other four affected products, treat this as this week's top priority and remediate before the deadline; the full list of the remaining four is in the linked advisory.

2. Exploited This Week

Flax Typhoon KEV additions — CVE-2015-3306 (and four others)

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVE-2015-3306 is CVSS 10.0; severity of the other four "see source"
• What's happening: A China-linked threat actor, Flax Typhoon, exploited five flaws that CISA has now added to its Known Exploited Vulnerabilities catalog, with an October 11 remediation deadline for federal agencies. The named flaw, CVE-2015-3306, is an improper access control vulnerability in ProFTPD.
• Fix: Apply the vendor fixes for all five flaws; federal agencies must remediate by October 11. See the linked advisory for the full product/CVE list and patches.

AhsayCBS backup utility — CVE-2026-105133

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS v4 score 5.5 (per source)
• What's happening: Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. The named flaw, CVE-2026-105133, is an improper authentication issue in the checkSysPwd() function.
• Fix: Apply the vendor patches for the AhsayCBS flaws. See source for the patched version and the second CVE.

3. Critical Patch Roundup

AnyDesk (Linux)

• Source: The Hacker News
• Link: The Hacker News
• Severity: see source (no CVE assigned)
• What's happening: Researchers published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk for Linux that grants attackers root access before anyone approves the connection. AnyDesk fixed the issue in version 8.0.3 in June, but the changelog described it only as a crash bug, with no CVE or security note.
• Fix: Update AnyDesk for Linux to version 8.0.3 or later.

Microsoft Windows

• Source: Microsoft MSRC
• Links: CVE-2026-72979 · CVE-2026-72982 · CVE-2026-68875 · CVE-2026-62744 · CVE-2026-69732
• Severity: see source (snippets are acknowledgement updates only)
• What's happening: MSRC published acknowledgment updates covering numerous Windows flaws, including Remote Code Execution issues in the DHCP Server (CVE-2026-72979), Netlogon (CVE-2026-72982), NTFS (CVE-2026-68875), Media Foundation (CVE-2026-62744), and the Link Layer Topology Discovery Protocol (CVE-2026-69732), alongside multiple Elevation of Privilege flaws (Fast FAT Driver, License Manager, Registry, WMI, Volume Manager Extension Driver, Device Association Broker Service, Win32k).
• Fix: Apply the corresponding Microsoft Windows security updates; confirm exact patched builds at MSRC.

AWS Bedrock AgentCore ("AgentCorruption")

• Source: Dark Reading
• Link: Dark Reading
• Severity: see source
• What's happening: A now-patched vulnerability in AWS Bedrock AgentCore could have allowed an attacker to use a single AI chatbot prompt to take over an organization's entire fleet.
• Fix: Confirm you are on the patched AgentCore release and review exposed agent deployments.

Adobe, Apple, Foxit Reader (Cisco Talos disclosures)

• Source: Cisco Talos
• Link: Cisco Talos
• Severity: see source
• What's happening: Talos' Vulnerability Discovery & Research team disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft products; all have been patched by their respective vendors.
• Fix: Update Adobe, Apple, and Foxit Reader software to current patched releases; Snort coverage is available to detect activity.

4. Home / SOHO Impact

• Update Windows now. This week's Microsoft advisories cover remote code execution flaws (DHCP Server, Netlogon, NTFS, Media Foundation, LLTD) plus several privilege-escalation bugs — install pending Windows updates and reboot.
• Patch AnyDesk on Linux to 8.0.3 or later. A public exploit lets an attacker get root access before you approve a connection.
• Update Foxit Reader and Adobe apps. Talos disclosed flaws in Foxit Reader and Adobe products that vendors have now patched.
• Keep your phone auto-updating. Researchers remotely hacked a fully patched Google Pixel 10 three times at Pwn2Own; Google receives these flaws and will issue fixes, so don't delay updates.
• Check your router firmware. TP-Link is now being sued by five U.S. states over router security and China-tie claims; regardless of the legal outcome, keep your router's firmware current.

5. Enterprise Impact

• Meet the October 11 KEV deadline. Patch the five Flax Typhoon–exploited flaws CISA added to KEV this week; the named ProFTPD flaw (CVE-2015-3306) is CVSS 10.0 and involves improper access control.
• Treat AhsayCBS as compromised-suspect. Patch it and hunt for web shells and XMRig miners (disguised as Microsoft Edge) on any affected backup servers.
• Force AnyDesk Linux to 8.0.3+. A working pre-auth RCE exploit granting root is public — inventory remote-access tooling and block unsanctioned installs.
• Run a full Windows patch cycle. Prioritize the server-facing RCE classes (DHCP Server, Netlogon) alongside the listed NTFS, Media Foundation, and LLTD flaws.
• Verify AWS Bedrock AgentCore is patched. The "AgentCorruption" issue could have enabled takeover of an entire agent fleet from a single prompt.
• Audit CI/CD and secrets. A credential-stealing GitHub Actions campaign compromised high-profile maintainer accounts and pushed malicious workflows into 340+ repositories — review workflows, rotate tokens, and pin actions.
• Inventory unmanaged AI agents. Reporting notes ~1,280 third-party products now embed AI, with only ~282 behind SSO — the rest are invisible to identity infrastructure and outside current governance.
• Enable detection. Talos published Snort coverage for the Adobe/Apple/Foxit/Microsoft vulnerabilities disclosed this week.

6. What To Patch First

1. ProFTPD + the other four Flax Typhoon flaws — CVE-2015-3306 and four others (exploited; CISA KEV, Oct 11 deadline)
2. AhsayCBS backup utility — CVE-2026-105133 and a second flaw (exploited in the wild; web shells/miners)
3. AnyDesk for Linux 8.0.3+ (public working pre-auth root exploit)
4. Microsoft Windows — this week's MSRC updates (RCE in DHCP Server, Netlogon, NTFS, Media Foundation, LLTD; widely deployed)
5. AWS Bedrock AgentCore — patched release (fleet-takeover risk; confirm exposure)
6. Adobe / Apple / Foxit Reader — current vendor-patched releases (Talos-disclosed, now patched)

Sources

• Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies — https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html
• Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge — https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
• Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access — https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html
• Microsoft, Adobe, Apple, and Foxit vulnerabilities — https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/
• CVE-2026-72979 Windows DHCP Server Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72979
• CVE-2026-72982 Windows Netlogon Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72982
• CVE-2026-68875 Windows NTFS Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68875
• CVE-2026-62744 Microsoft Windows Media Foundation Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62744
• CVE-2026-69732 Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69732
• 'AgentCorruption' Puts AWS Environments at Risk With Single Prompt — https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt
• Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories — https://thehackernews.com/2026/10/credential-stealing-github-actions.html
• TP-Link Sued by Four More U.S. States Over Router Security and China Ties — https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html
• Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own — https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html
• The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't — https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html