The DarkWeb Headlines Patch Watch Desk is the part of the DarkWeb Headlines newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 15 articles so far. See the editorial policy or report an error.
A critical vulnerability in Siemens Industrial Edge Device Kit allows authenticated users to access restricted internal APIs and potentially delete system data.
A critical vulnerability in IBM i HTTP Server Administration allows authenticated attackers to execute code on versions 7.3 through 7.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a critical path traversal flaw that allows authenticated users to cause denial of service.
Unauthenticated attackers can exploit CVE-2026-109573 in phpMyFAQ versions prior to 4.1.9 to steal credentials and modify database records through a flawed escape mechanism.
The easy-pdf-merge library allows attackers to run operating system commands by injecting shell characters into file paths or configuration options.
A security researcher received a $90,000 bounty from Google for reporting a remote code execution flaw, as shared on Reddit.
CISA added five exploited vulnerabilities to the Known Exploited Vulnerabilities catalog with a compliance deadline of October 11, 2026.
TrendForce data shows non-China laptop production will drop to 21% in 2026, reversing previous diversification efforts due to rising expenses.
The NVD rates CVE-2026-62031 as critical, noting that unauthenticated SQL injection flaws in Stylemix uListing versions up to 2.2.0 allow remote attackers to execute arbitrary code.
The VillaTheme AFFI WooCommerce plugin contains a critical deserialization flaw allowing remote object injection attacks on sites running version 1.0.10 or earlier.
Federal agents detained a Canadian firm executive on Thursday amid an investigation into the hacking group that compromised sensitive FBI agent data.
Meta declined Anthropic’s bid for additional AI compute resources earlier this year, highlighting the intense competition for infrastructure in the artificial intelligence sector.
The National Vulnerability Database rates CVE-2026-93945 as critical, exposing sites running Axiomthemes Balance versions through 1.12.0 to object injection attacks.
A critical flaw in the Advanced IP Blocker plugin allows unauthenticated attackers to bypass login controls and take over WordPress sites.
An authorization bypass in Microsoft Bookings allows remote attackers to elevate privileges, rated 9.9 on the CVSS scale by the NVD.