Cybersecurity News Briefing: October 23, 2026
Friday, October 23, 2026 · 9 stories
Today's briefing highlights critical remote‑code execution flaws in the Linux kernel’s KSMBD service, high‑severity denial‑of‑service and injection bugs across several Siemens products, and the United Kingdom’s proposal to impose up to 14 years imprisonment for subsea cable sabotage. Additional concerns include AI‑driven attack automation and the withdrawal of eMudhra’s global SSL/TLS services. Readers should prioritize applying the newly released Siemens firmware and library updates to mitigate immediate risk.
Top Stories
- CriticalVulnerabilityGlobalThe Hacker News
Two Critical CVSS 9.0 Remote Code Execution Flaws Discovered in Linux KSMBD
Two remote code execution vulnerabilities in the Linux kernel’s built-in SMB server KSMBD have been disclosed on public mailing lists. Both flaws received CVSS scores of 9.0, one can be triggered before network authentication and the other requires SMB Direct with RDMA. No fix is available in the mainline kernel yet.
Why it matters: Organizations should monitor KSMBD deployments and apply mitigations until a kernel patch is released.
- HighPolicy & RegulationEuropeThe Register
UK Proposes New Laws Giving Up to 14 Years Prison for Subsea Cable Sabotage
The United Kingdom plans to overhaul its subsea cable protection laws, introducing penalties of up to 14 years imprisonment and unlimited fines for intentional damage to critical underwater telecoms and energy infrastructure. The proposal also adds security duties for cable operators and new powers for ministers to direct protective actions.
Why it matters: Upgrade security policies for subsea infrastructure and prepare for stricter legal penalties on sabotage.
- HighVulnerabilityNorth AmericaCISA Advisories
Multiple Denial-of-Service Vulnerabilities Reported in Siemens APOGEE, TALON and Desigo Products
Several Siemens products, including APOGEE, TALON and Desigo PXC/PXM lines, contain multiple vulnerabilities that could cause denial of service and affect device availability. Siemens has issued new firmware versions for affected models and advises updating to the latest releases, while providing mitigations for products without immediate fixes.
Why it matters: Update Siemens devices to the latest firmware and follow recommended mitigations to avoid denial-of-service impacts.
- HighVulnerabilityNorth AmericaCISA Advisories
Siemens RUGGEDCOM APE1808 Devices Contain Template Injection and Authorization Flaws
Multiple security flaws have been identified in Siemens RUGGEDCOM APE1808 devices, including a template injection issue in the dashboard function, improper authorization, lack of administrator control, and a cross-site request forgery vulnerability. Authenticated users can craft malicious dashboards that execute payloads in victims’ browsers, potentially modifying data or disrupting the application.
Why it matters: Limit dashboard imports to trusted users and apply available patches to block template injection attacks.
- HighVulnerabilityNorth AmericaCISA Advisories
Path Traversal and Information Leak Vulnerabilities Found in Siemens SIMATIC S7 Webserver .NET Client Library
The .NET client library for Siemens SIMATIC S7 Webserver API is affected by path-traversal and sensitive error-message vulnerabilities that could let attackers write files outside intended directories or disclose internal information. Siemens has released an updated library version and recommends customers upgrade to mitigate the risks.
Why it matters: Upgrade to the patched .NET client library to eliminate path-traversal and information-leak risks.
- MediumMalwareEuropeHelp Net Security
Hackers Hijack Public AI Models to Automate Cyberattacks Using AI-Powered Tool
Researchers observed a malicious tool that scans the internet for publicly accessible AI models, then leverages those models to plan and execute cyberattacks while the model owner bears the compute costs. The tool’s instruction set was captured via a honeypot, revealing its use of AI prompts to automate breach activities.
Why it matters: Secure exposed AI model endpoints and monitor for unauthorized usage to prevent abuse in attack automation.
- InformationalThreat IntelligenceGlobalThe Hacker News
Weekly ThreatsDay Highlights Include Critical PHP, GitLab and Linux Vulnerabilities
The latest ThreatsDay briefing lists numerous recent security incidents, including critical remote code execution bugs in PHP and GitLab, serious Linux kernel issues, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. The roundup also notes stolen passwords and data exposure.
Why it matters: Stay informed of emerging vulnerabilities and prioritize patching of highlighted critical flaws.
- InformationalPolicy & RegulationGlobalThe Register
Indian CA eMudhra Exits Global SSL/TLS Market After Weak Private Key Exposure
Indian certificate authority eMudhra announced it will cease its global SSL/TLS certificate business following reports that some of its private keys were weak, including a key consisting of a single digit. The company cited low revenue contribution and rising compliance costs as additional reasons.
Why it matters: Organizations should verify the integrity of SSL/TLS certificates and consider alternative CAs after key-exposure incidents.
- InformationalThreat IntelligenceEuropeThe Register
Evolving Account Takeover Tactics Emphasize Stealthy Use of Compromised Email Accounts
Account takeover attacks now focus on compromising legitimate email accounts to impersonate trusted entities without triggering traditional email security alerts. Attackers often obtain credentials via phishing, increasingly aided by generative AI that crafts convincing lures. After gaining access, they may linger to test the account before executing theft, exfiltration or malware distribution.
Why it matters: Implement multi-factor authentication and monitor compromised accounts to detect stealthy takeover activity.