🚨 Critical Windows Paint vulnerability allows remote code execution without authentication, CVE-2026-83844 Microsoft has disclosed a high-severity vulnerability in Windows Paint that could allow unauthenticated attackers to execute malicious code remotely without user interaction. Tracked as CVE-2026-83844, the flaw stems from an out-of-bounds read that could compromise the confidentiality, integrity, and availability of affected systems. The vulnerability carries a CVSS score of 8.1 and affects Microsoft Paint versions earlier than 11.2605.91.0. Microsoft has released a security fix, and administrators are urged to ensure Paint is updated. There are currently no confirmed reports of active exploitation.

🚨🇺🇸 Anthropic model weights allegedly exposed through misconfigured AWS S3 bucket An actor using the handle "localizer" claims to have obtained a 7 GB shard of Anthropic's alleged "Claude Fable 5" model weights from a misconfigured AWS S3 bucket associated with Amazon Bedrock. The actor claims the complete model consists of 640 shards totaling approximately 8 TB, but says only one shard was retrieved before access was restricted. Screenshots showing a .safetensors file, model metadata, and a hexadecimal dump have been published as alleged proof. The actor is now offering the material for sale. Claim is currently unverified. The authenticity of the files and their connection to Anthropic have not been established. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it.

🚨🇺🇸 Massive leak reportedly exposes more than 41,000 U.S. Homeland Security employees A group calling itself the Department of Peace claims it compromised a Department of Homeland Security system and obtained records belonging to employees across ICE, CBP, CISA and several other DHS agencies. The dataset reportedly contains names, work emails, cellphone numbers, job assignments and facility locations. It also exposes memberships in internal access groups associated with undercover and covert operations, wiretap programs, Palantir software, Cellebrite tools and xAI’s Grok chatbot. ⠀ Journalists who reviewed the material found records connected to undercover ICE personnel and other sensitive law enforcement roles. The data has since been released publicly with a searchable interface. The group reportedly gained access using a compromised Okta single sign-on account. DHS, ICE and CBP had not publicly confirmed the breach or responded to requests for comment at the time of publication.

🚨🇦🇪 Telegram zero-day can enable code execution through malicious animated content A vulnerability in Telegram’s rlottie animation library can allow attackers to execute arbitrary code within the application process. Tracked as CVE-2026-111105, the flaw carries a CVSS score of 7.0 and was publicly disclosed by Trend Micro’s Zero Day Initiative after remaining unresolved at the client-code level. ⠀ The vulnerability is caused by improper validation of attacker-controlled animation data, resulting in a write before the beginning of an allocated memory buffer. ⠀ Despite reports describing the flaw as a zero-click sticker attack, ZDI’s final advisory says user interaction is required. The victim must visit a malicious page or open a malicious file for exploitation to occur. ⠀ Telegram told ZDI that server-side sticker validation mitigates the vulnerability. However, ZDI continued seeking a client-side fix and ultimately published the issue as a zero-day advisory on October 15. ⠀ No affected client versions, patched versions or confirmed in-the-wild attacks have been disclosed. Users should keep Telegram updated and avoid opening untrusted animated files, sticker packs or external links until a client-side fix is confirmed.

🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0. ⠀ Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8. PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases. ⠀ The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected. ⠀ Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.