Hawkra Threat Dashboard

Active Exploits & Threat Groups

CISA has not added any new entries to its Known Exploited Vulnerabilities (KEV) catalog during this reporting period. This indicates that no new vulnerabilities have been publicly confirmed as being actively exploited by threat actors as of October 19, 2026. Consequently, no specific MITRE ATT&CK threat groups or their associated tactics, techniques, and procedures (TTPs) can be directly linked to recent KEV additions for this brief. Organizations should continue to prioritize patching and mitigation efforts for existing KEV entries to reduce their attack surface against known threats.

New Vulnerabilities

This period sees a significant number of newly disclosed critical severity vulnerabilities, many boasting a CVSS score of 9.8. Among these, CVE-2026-110372, impacting Brainstorm Force OttoKit suretriggers, describes an incorrect privilege assignment flaw allowing privilege escalation in versions up to 1.1.40. Similarly, CVE-2026-111911 identifies an authentication bypass vulnerability in phpMyFAQ versions 4.0.0 through 4.1.8, where WebAuthn registration endpoints fail to validate authentication or challenge. Another critical deserialization of untrusted data vulnerability, CVE-2026-110886, affects QuantumCloud Conversational Forms for ChatBot, leading to object injection. Additionally, CVE-2026-111998 highlights a severe default credentials vulnerability in Vanus 0.8.0 through 0.9.0, permitting unauthenticated remote attackers to gain cluster-admin access via a hardcoded admin token. These critical flaws often present straightforward attack vectors for adversaries to gain unauthorized access or elevate privileges within affected systems.

Beyond these critical issues, several high-severity vulnerabilities have also been disclosed. Notably, CVE-2026-107436 (CVSS: 8.8) describes a deserialization of untrusted data vulnerability in WP Chill Strong Testimonials, enabling object injection. Multiple high-severity issues also affect phpMyFAQ, including CVE-2026-111908 (CVSS: 8.3) for broken object-level authorization and CVE-2026-111882 (CVSS: 8.1) for an authentication bypass that allows IdP-authenticated users to skip TOTP two-factor authentication. In terms of exploit prediction, several older CVEs have shown notable increases in their EPSS scores, indicating a rising probability of exploitation. For instance, CVE-2025-57819 saw its EPSS jump by +0.08677, now at 0.95024, signifying a very high likelihood of exploitation. CVE-2025-1128 also experienced a significant increase of +0.13680, reaching an EPSS of 0.42446, suggesting a growing threat. These movements serve as an early warning for organizations to reassess and prioritize mitigation for these previously identified vulnerabilities.

In the News

• A breach at OpenCode's Console platform in mid-October 2026 exposed private API keys for OpenAI, Anthropic, and Google, indicating a credential theft and distillation attack.
• Delhi Police successfully prevented approximately ₹1.53 crore in potential additional losses by identifying and intervening with victims currently being manipulated by digital-arrest fraudsters.