Severity Daily

IT and AI security incidents, checked against the primary source

[Severity Daily @severitydaily]

When the CVE record, the CVSS score, and the federal deadline all disagree, how does your team decide what gets patched first?

[Severity Daily @severitydaily]

The fix named for a 9.6 in Unitree's Go2 robot is four version lines behind the firmware the companion record still calls affected. Both landed 584 milliseconds apart. No exploitation reported.

https://t.co/ju0uFMHIw0

[Severity Daily @severitydaily]

Oracle (@Oracle) issued a second 9.1 Java alert over eMudhra, and its own page says updating Java does not remove the two roots — you delete them by hand with keytool. No exploitation reported.

https://t.co/GTQoTmANny

[Severity Daily @severitydaily]

Python scored its eMudhra certificate exposure 9.4 critical against every CPython ever released, and the pull request its own record tags as the patch has not merged. No exploitation reported.

https://t.co/Iutj2NpzSq

[Severity Daily @severitydaily]

Wasmtime's critical sandbox escape stopped being exploitable in March, in a Cranelift patch submitted for a 3% compile-time speedup. Nobody called it a security fix until last week. No exploitation reported.

https://t.co/092UOzFady

[Severity Daily @severitydaily]

Both of Friday’s newly exploited flaws are due Monday, October 26; the Arista VeloCloud one needs only a read-only account. And in four of the day’s eleven stories, the named fix cannot be installed.

https://t.co/IrScyfgLmt

[Severity Daily @severitydaily]

Federal deadline Monday, October 26, set by CISA (@CISAgov). Collabora's exploited Nextcloud app can only be attacked while it is not running, and disabling it does not help. Upgrade or remove.

https://t.co/fe5qlMH0Xs

[Severity Daily @severitydaily]

The only fix on record for an 8.8 code-execution flaw in Hugging Face Datasets is an unmerged pull request from the person who found it. Every released version is in range. No exploitation reported.

https://t.co/sEdMG5JBSz

[Severity Daily @severitydaily]

Capcom says it has not confirmed any compromise of customer-set passwords, and the same notice says 196 accounts had their passwords changed without authorization. 11,774,247 records exposed.

https://t.co/JjfIY9Ue1W

[Severity Daily @severitydaily]

Oracle (@Oracle) blocks sixteen eMudhra certificates in its out-of-band Java fix. Azul blocks eight. Same denylist file, shipped the same day. No exploitation reported.

https://t.co/LSdrULjGhd

[Severity Daily @severitydaily]

Of the five perfect 10.0s in Thursday’s ten stories, patch YOOtheme Pro for Joomla first — fixed in 5.0.53. Microsoft’s three cloud 10.0s name no date the flaw existed and leave nothing to install.

https://t.co/InsxkABCne

[Severity Daily @severitydaily]

Incus fixed two critical host escapes on both LTS branches and announced neither release. The only document naming 6.0.7 and 7.0.2 is a CVE VulnCheck (@VulnCheckAI) published four weeks later. No exploitation reported.

https://t.co/DxAqHoVGmT

[Severity Daily @severitydaily]

EDK2's new 9.5 lets an attacker corrupt firmware during PXE boot, before Secure Boot measures anything. The fix merged into master a week ago; no stable tag has it. No exploitation reported.

https://t.co/uLNxoeot8m

[Severity Daily @severitydaily]

Updating Node.js does not fix the Brotli decoder RCE on Debian — the runtime links the system brotli, and every Debian release still ships an affected copy, unfixed. No exploitation reported.

https://t.co/UxQ8q5kOrS

[Severity Daily @severitydaily]

GitLab (@gitlab) patched a CVSS 10.0 regex overflow on October 12. The one it patched Wednesday lists that fix among its affected versions, and reaches back to 7.0. No exploitation reported.

https://t.co/knPwYErSB8

[Severity Daily @severitydaily]

Wednesday's call: SiteGuard, due Friday, October 23. Capture its diagnostics before patching — updating can erase the attack traces. The louder story, Microsoft on ConnectWise, has nothing to patch.

https://t.co/ZrkGrMSqze

[Severity Daily @severitydaily]

Microsoft's headline calls the ConnectWise (@ConnectWise) campaign AI-driven. Its own telemetry: 151,000 automated sign-in attempts, zero successful logins. A stolen app credential did the work.

https://t.co/r5zmgJhdgM

[Severity Daily @severitydaily]

Federal deadline Friday, October 23: Plex says its takeover chain is being widely exploited, and its four CVE records score no link above 7.2. CISA (@CISAgov) gave half the chain until November 3.

https://t.co/bGB0aeqsa7

[Severity Daily @severitydaily]

Eight eMudhra CA keys were compromised, and they sit in sixteen certificates. Two of the eight sign code rather than TLS, so the browser fixes cover six. No exploitation reported.

https://t.co/yTuCh3tnw7

[Severity Daily @severitydaily]

PHP reserved the right to ship its critical release early if the details leaked. The details leaked. The release time did not move, and neither CVE exists in any published record.

https://t.co/mpz3Xsfq1v

[Severity Daily @severitydaily]

Patch the 7.8 first. None of Tuesday's six 9.9s is being exploited. The one flaw a vendor says attackers are already using is scored local-only, annotated exploitation none, and listed in no catalog.

https://t.co/3KBzyvv8St