EMINEM ENGINEER TO PLEAD GUILTY

Former Eminem studio engineer Joseph Strange is expected to plead guilty to illegally selling the rapper’s unreleased music

Strange allegedly sold the tracks for around $50,000 in Bitcoin. Investigators identified buyers and traced the crypto payments, leading them to Strange

He is scheduled to enter his guilty plea on October 22

@CveRecord

UK BREAK-UP PUSH?

Leaders of Scotland, Wales and Northern Ireland are expected to meet Monday in Cardiff to sign a deal supporting their right to decide their own constitutional futures

The agreement could strengthen calls for independence referendums and put new pressure on Westminster

The move comes as pro-independence parties lead all three nations

@CveRecord

POLISH DRUG SUSPECT ALLEGEDLY JOINED UKRAINIAN FORCES

A Polish man wanted over alleged large scale drug trafficking and illegal firearms activity has reportedly joined Ukrainian forces after fleeing Poland

A post by International Cyber Digest claims Marcin Andrzej Wojciechowski, wanted by Polish authorities, was later seen serving with Ukrainian forces and reportedly lost a leg

@CveRecord

RUSSIAN DRONE STRIKES TRAIN NEAR POLISH BORDER

A Russian drone struck the locomotive of a passenger train near the Ukraine Poland border, shortly after a special train carrying Boris Johnson, Günter Sautter, Jonathan Powell, Carl Bildt and other senior European officials passed through the same route.

The delegation was returning from the YES security conference in Kyiv.

Polish jets were scrambled as air raid sirens sounded near the border.

No injuries were reported.

@CveRecord

INTERESTING: PARDON BROKERS EXPOSED

Lobbyists Jack Burkman and Jacob Wohl were caught in a hidden camera operation offering to help a convicted felon obtain a presidential pardon for $300,000

They reportedly claimed their services included using influencers and political pressure to advocate for the case and push it toward President Trump Source

@CveRecord

SEC WARNS ABOUT PUMPFUN

The U.S. Securities and Exchange Commission (SEC) is reportedly monitoring activity on Pump.fun

Trading or developing on the platform may violate federal securities laws, potentially exposing users to enforcement action

The SEC is advising users to immediately stop such activities and consult legal counsel

Pump.fun users could face potential legal action

@CveRecord

Japanese 18+ Actress Hana Kuraki Dies at 25

Japanese adult film actress Hana Kuraki has died at the age of 25, with her management confirming her passing.

Kuraki made her debut with S1 in 2024 and gained a following in Japan and overseas.

The comguys are in mourning

Rest in peace, Hana Kuraki

@CveRecord

The Gemini Voice Scam

The Incident: Justice Department updates on September 15, 2026, detailed highly sophisticated social engineering attacks targeting cryptocurrency holders

The Risk: Scam actors do not use malicious links or direct code hacking; instead, they use realistic voice calls pretending to be Google and Gemini security support

The Impact: Tricked a single high-net-worth investor into manually authorizing the transfer of over 4,100 Bitcoin (worth roughly $240 million)

Fix: Never transfer digital assets or provide administrative approvals based on unsolicited phone calls. Always verify support requests through official platform dashboards

@CveRecord

CVE - 2026 - 20361

The Bug: A critical remote code execution (RCE) flaw was discovered inside the Cisco Secure Email Gateway appliance system

The Risk: Attackers can target the vulnerability directly over the network without requiring any login details or authentication

The Impact: Gives threat actors full root-level access to the system, allowing them to completely compromise corporate email servers

Fix: Cisco released emergency updates. Administrators must upgrade their appliance firmware version immediately to prevent unauthorized infiltration

@CveRecord

CVE - 2026 - 76460

The Bug: CISA added this critical flaw in Cisco Identity Services Engine (ISE) to its official Known Exploited Vulnerabilities catalog

The Risk: Hackers actively abused a loophole in Cisco's privileged APIs to bypass safety systems

The Impact: Full remote control over corporate network authentication systems

Fix: Cisco released direct code patches. System administrators must update immediately to prevent unauthorized access

@CveRecord

Threat Alert: Critical RCE Vulnerability Found in Kubernetes AI Tool

Identifier: CVE - 2026 - 6912
Severity: 9.8 Critical (CVSS 3.1)
Impact: Remote Code Execution (RCE) and Full Cluster Takeover

The Vulnerability
Security researchers have disclosed a severe vulnerability in a popular open-source Kubernetes extension used to manage distributed AI and machine learning workloads

How It Works
The flaw stems from missing authentication on a specific API endpoint responsible for managing cluster workloads. An unauthenticated attacker can send a malicious network request directly to this open port

The Risk
Exploitation allows attackers to execute unauthorized commands across the entire cloud cluster. Threat actors can manipulate machine learning data, steal proprietary AI models, or repurpose server infrastructure for crypto-mining

Remediation
DevOps teams must immediately update the extension to version 3.4.1 or later. Ensure that internal cluster ports are never exposed to the public internet

@CveRecord

Threat Alert: Millions of WordPress Sites Under Attack Hours After Patch

Identifier: CVE - 2026 - 87902
Severity: 9.2 Critical (CVSS 4.0)
Impact: Unauthenticated Local File Inclusion (LFI) and Remote Code Execution (RCE)

The Vulnerability
CISA has officially added a critical core vulnerability affecting WordPress to its Known Exploited Vulnerabilities catalog following a massive wave of automated scans targeting millions of websites

How It Works
The flaw lies in how the WordPress core resolves page templates. Attackers can exploit an input path traversal defect without any authentication, forcing the server to execute malicious local PHP files

The Risk
Threat actors have deployed automated botnets to target unpatched websites, allowing them to steal sensitive backend configuration files, access client databases, and take full control of infected web servers

Remediation
Website administrators must upgrade WordPress to versions 7.1.2, 7.0.6, 6.9.9, or respective branch backports immediately. Enabling web application firewall (WAF) rules to block template traversal paths is highly recommended

@CveRecord

Threat Alert: Zero-Day Exploit Compromises Hundreds of Network Switches

Identifier: CVE - 2026 - 107441
Severity: 8.8 High (CVSS 4.0)
Impact: Unauthenticated OS Command Execution and Credential Theft

The Vulnerability
Security firm Binarly has reported a critical zero-day vulnerability impacting ten models of Zyxel GS1900 series network switches. The flaw was discovered actively leaking root data even on devices that applied the vendor's previous security patches

How It Works
The defect lies in an out-of-bounds write flaw inside the web management CGI component. Attackers can send a specially crafted HTTP request to the device's management interface without any login credentials

The Risk
Threat actors have used this exploit to gain root privileges, hijack nearly 1,000 switches across 48 countries, and silently exfiltrate sensitive network configurations and hashed administrative credentials

Remediation
Zyxel has released firmware updates to address this specific exploit. Network administrators must immediately upgrade affected models to the new "Patch 3" firmware build to block active intrusion pathways

@CveRecord

Threat Alert: Bitget Exchange Discloses Massive Infrastructure Security Breach

Incident Type: Zero-Day Infrastructure Exploitation
Total Loss: $387.5 Million
Impact: Unauthorized Hot Wallet Transactions

The Attack
Cryptocurrency exchange Bitget confirmed a massive security breach affecting its wallet-signing infrastructure. Threat actors successfully exploited a zero-day vulnerability inside a third-party security product used by the exchange

How It Works
The attackers used the third-party vulnerability to bypass active defensive perimeters and harvest sensitive internal management database credentials. They then established a command-and-control tunnel to deploy malicious code packages directly into production containers. This allowed them to forge transaction authorization data and drain hot and warm wallets

The Risk
This attack highlights the growing risk of third-party software supply chains in the web3 space. The exploit completely bypassed standard multi-signature and key security layers without needing to steal the private keys themselves

Remediation
Bitget has paused affected infrastructure, updated the compromised systems, and assured users that its User Protection Fund will cover 100% of the losses

@CveRecord

Threat Alert: RCE Flaw Patched in Ray AI Framework Cluster Management

Identifier: CVE - 2026 - 101142
Severity: 9.8 Critical (CVSS 4.0)
Impact: Remote Code Execution (RCE) and AI Model Exfiltration

The Vulnerability
Security researchers have fixed a critical missing authentication vulnerability in Ray, the widely used open-source AI and machine learning infrastructure compute framework

How It Works
The cluster management dashboard fails to properly validate tokens on specific API endpoints. A remote attacker can send unauthenticated requests to the cluster port

The Risk
Exploitation allows attackers to run arbitrary code across the entire AI pipeline, manipulate training datasets, or completely steal proprietary machine learning models

Remediation
AI infrastructure teams must immediately update Ray to version 2.40.1 or later and ensure that cluster dashboards are not exposed directly to the public internet

@CveRecord

Threat Alert: Critical System Vulnerabilities Patched in Android

Identifier: Android Bulletin (Patch Level 2026-10-01)
Severity: Critical
Impact: Local Privilege Escalation and Remote Code Execution

The Vulnerability
Google has disclosed multiple severe flaws within the core Android System and Framework components that bypass internal system-level permissions

How It Works
The vulnerabilities exploit memory allocation errors. A malicious application can trigger these flaws silently in the background without needing user interaction

The Risk
Attackers can gain root-level access to the device. This allows them to bypass app sandboxes and potentially harvest local data like crypto wallet keys or secure application databases

Remediation
Users must upgrade their devices to the October 1, 2026 security patch level or higher immediately through system settings

@CveRecord

Threat Alert: Critical Server-Takeover Flaw Affects Web Infrastructure

Identifier: CVE - 2026 - 109618
Severity: 9.8 Critical (CVSS 4.0)
Impact: Unauthenticated Remote Code Execution (RCE)

The Vulnerability
Security researchers have disclosed a severe memory-safety defect, nicknamed PHP2Shell, in the core PHP engine. This vulnerability impacts millions of web servers globally, including crypto web interfaces, AI deployment endpoints, and content platforms

How It Works
The flaw stems from a use-after-free bug inside the file upload progress component. An attacker can send a specially crafted web request to a vulnerable server without needing any login credentials. This corrupts the server's memory state

The Risk
Exploitation grants an attacker full control over the underlying server. Threat actors can silently steal backend API credentials, access user databases, or alter website code. Security agencies have already confirmed active exploitation in the wild

Remediation
System administrators must immediately upgrade their server environments. The flaw is patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35

@CveRecord

Threat Alert: Account Hijack Flaw Discovered in Telegram Desktop

Identifier: CVE - 2026 - 107181
Severity: 8.6 High (CVSS 4.0)
Impact: Remote Account Takeover and Local File Extraction

The Vulnerability
Security researchers have disclosed a critical input validation flaw in Telegram Desktop versions prior to 7.2.9. The issue exists within the Inter-Process Communication channel used when handling external web links

How It Works
An attacker can craft a malicious external link and distribute it across public channels or websites. When a user clicks the link, the command injection triggers Telegram Desktop to silently exfiltrate session data and local configuration files to an attacker-controlled group

The Risk
If successful, threat actors can duplicate the victim's session and log in instantly, completely bypassing standard authentication checks and active session alerts

Remediation
Telegram has patched this vulnerability in version 7.2.9. Users must update their desktop clients immediately. Enabling a local application passcode provides secondary protection against session theft

@CveRecord