Breaches, patches, and the exploits worth patching tonight.
Free. One email a day. Unsubscribe from the top of any issue.
Thursday, October 15, 2026
Today we examine a critical remote code execution patch for GitLab alongside supply chain risks targeting hardware wallets.
4 minute read
A newly patched flaw allows unauthorized actors to run arbitrary commands on self-hosted GitLab instances without authentication. Administrators need to apply the latest security updates immediately to protect their development pipelines from complete takeover. The vulnerability targets the platform's handling of specific user input parameters.
3 minute read
Web applications that process user-uploaded documents are at risk due to a command injection bug in the widely used Ghostscript rendering engine. Attackers can bypass sandbox restrictions simply by formatting a PDF to trigger specific interpreter commands. Systems using this library for thumbnail generation or document previewing should apply the vendor's hotfixes.
8 minute read
Security researchers have detailed a method to bypass Virtualization-based Security protections by targeting Isolated User Mode processes. By abusing specific system API calls, an attacker with local administrative privileges can execute arbitrary payloads inside secure enclaves. This technique highlights the evolving boundaries of Windows kernel isolation mechanisms.
3 minute read
Maintainers of the Racket language confirmed that unauthorized actors gained access to their package distribution systems and build servers. While no malicious packages have been identified in the wild, the team has rotated cryptographic signing keys and reset user passwords as a precaution. Developers utilizing the ecosystem are advised to audit their local dependencies and verify build signatures.
6 minute read
Physical supply chain attacks are mounting against cryptocurrency custody systems, with reports of modified hardware wallets shipping to users. Attackers intercept the devices in transit to load custom microcode capable of draining private keys during setup. Users are urged to verify device integrity seals and download updates only from verified local client software.
7 minute read
Automated scanning tools are actively checking exposed AWS API credentials specifically for permissions related to managed artificial intelligence models. Threat actors aim to hijack compute resources for unauthorized model inference or to steal proprietary training data. Securing IAM roles and monitoring for anomalous model API calls are now critical parts of cloud defense.
Want a different beat?
See all eleven newsletters and pick the ones that match your job.