- Home
- Threat level
- 28 October 2026
Threat level on 28 October 2026
Daily snapshot from the Blacknote live engine.
Blacknote threat level
Threat profile
Last 7 days
- 0–19Low
- 20–39Guarded
- 40–59Elevated
- 60–79High
- 80–100Severe
- Ransomware activity (weight 25%): 46 of 100, 31 victims claimed in 24 h
- Actively exploited vulnerabilities (weight 25%): 72 of 100, 8 newly exploited (7 d) · 40 critical CVEs (7 d)
- Confirmed data breaches (weight 20%): 7 of 100, 1 breaches added (7 d) · 78 incident reports (7 d)
- Official warnings (weight 15%): collecting, 0 NCSC warnings (14 d)
- Community signals (weight 15%): 98 of 100, 112 HN stories
Events that day
-
31 new victims claimed on ransomware leak sites in the last 24 hours
13 active groups. Claims are unverified; victims are not named here.
-
Critical vulnerability CVE-2026-118579 (CVSS 9.8)
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the…
-
Critical vulnerability CVE-2026-118690 (CVSS 9.8)
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log…
-
Critical vulnerability CVE-2026-61567 in WWBN (CVSS 10)
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named…
-
Critical vulnerability CVE-2026-61564 in WWBN (CVSS 10)
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles…
-
Critical vulnerability CVE-2026-117574 (CVSS 9.1)
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request…
-
Critical vulnerability CVE-2026-118633 in Sophos (CVSS 9.2)
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions)…
-
Critical vulnerability CVE-2026-115893 in bytecodealliance (CVSS 9.9)
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
-
Critical vulnerability CVE-2026-118690 in SignalK (CVSS 9.3)
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log…
-
Japan Airlines warns of data breach as country grapples with multiple cyber incidents
Hackers stole passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers.
-
Critical vulnerability CVE-2026-117574 (CVSS 9.1)
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request…
-
Critical vulnerability CVE-2026-63190 in fearlessgeekmedia (CVSS 9.4)
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP…
-
Critical vulnerability CVE-2026-118264 in labstack (CVSS 9.1)
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket…
-
Critical vulnerability CVE-2026-103406 in Juniper Networks (CVSS 9.8)
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session…
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put…
-
34 new victims claimed on ransomware leak sites in the last 24 hours
12 active groups. Claims are unverified; victims are not named here.
-
Critical vulnerability CVE-2026-103409 (CVSS 9.8)
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated…
-
Critical vulnerability CVE-2026-103406 (CVSS 9.8)
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session…
-
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to…
-
Sony ISP subsidiary data breach exposes 2.5 million customer records
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal…
-
Moldova investigates possible foreign involvement in major government cyberattack
Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens' personal data and government digital infrastructure,…
-
Critical vulnerability CVE-2026-103409 in Juniper Networks (CVSS 9.8)
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated…
-
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus…
-
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand,…
-
UK to look at making software companies liable for cyber breaches
The new U.K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has…
Indicative assessment by Blacknote Intelligence, not an official threat level. How the score works.
Archive