ThreatsDay Bulletin: 27 Stories, and the Theme Is "It Only Takes One Gap"
This week's ThreatsDay roundup from The Hacker News, published October 15, 2026, bundles roughly 27 separate items — from a four-flaw Adobe Experience Manager exploit chain to a crypto drainer that reads its instructions out of DNS TXT records, an NVIDIA GPU driver bug that escapes containers straight to host root, and a WordPress backdoor that reinstalls itself after cleanup. As the original bulletin puts it, "sometimes a stolen login, a forgotten setting, or one small mistake is enough." Below are the nine most significant items from the roundup, led by the four named in the original headline.
1. Adobe Experience Manager RCE Chain
Researchers disclosed a four-flaw exploit chain in the cloud version of Adobe Experience Manager (AEM) that strings together an unauthenticated Digital Asset Manager (DAM) bulk-import function, a stored cross-site scripting (XSS) flaw, unsafe XML parsing, and arbitrary Groovy script execution through the /bin/asynccommand endpoint. Chained together, the four bugs let an unauthenticated attacker reach remote code execution on a cloud AEM instance. Adobe has patched the flaws; on-premises AEM deployments are not affected, only the cloud SKU.
2. "Noir" Crypto Wallet Drainer Hides Its Backend in DNS
A cryptocurrency wallet drainer tracked as Noir skips the usual theft playbook entirely — it never asks for a seed phrase, password, or private key. Instead, the malicious site queries a DNS TXT record over public DNS-over-HTTPS (DoH) resolvers to locate its backend infrastructure, which is hosted on Cloudflare Pages, and then tricks a connected wallet into granting spending/approval permissions on a token contract. Because the victim technically "approves" the transaction, many wallet security prompts don't flag it as a classic drain. Researchers suspect the kit's drainer logic was AI-assisted based on code structure and comment patterns.
3. NVIDIA "Bad UVM" Flaw Enables Container Escape to Root
NVIDIA patched CVE-2026-47595 (CVSS 7.5), nicknamed "Bad UVM," in its Linux GPU driver's Unified Virtual Memory (UVM) subsystem. The bug fails to preserve memory permissions correctly, letting an unprivileged process write to memory that should be read-only. Researchers showed the flaw can be chained to inject exploit code into nvidia-persistenced, a privileged daemon, achieving full root escalation on the host — and critically, escaping out of a GPU-enabled container into the underlying Linux system. Any shared GPU infrastructure (cloud AI/ML hosts, multi-tenant inference platforms) running an affected driver is exposed until patched.
4. Self-Healing WordPress Backdoor Uses EtherHiding
A new WordPress backdoor installs itself as a must-use (mu) plugin — a plugin type WordPress loads automatically and that doesn't appear in the normal plugins list — and ships multiple self-healing mechanisms so it reinstalls itself if an admin deletes it. It resolves its command-and-control location via EtherHiding, a technique that hides C2 addresses inside Ethereum smart contract data rather than a conventional domain or IP, making takedown far harder. Once active, it creates rogue administrator accounts, harvests credentials, modifies site content, and attempts to spread to other WordPress installs reachable from the compromised host.
5. Three New RATs: Harassment, Discord C2, and Screen Spying
Three distinct remote access trojans surfaced this week. KGB RAT stands out for built-in psychological harassment features — "screamer" audio jump-scares and forced fake blue-screen-of-death crashes — layered on top of standard RAT functionality. CikaBika Bot, written in Rust, uses Discord as its command-and-control channel and deploys via a Nim-based loader that leverages DLL hijacking for persistence. BotHelper RAT, a .NET trojan, focuses on live screen surveillance, continuously streaming the victim's desktop back to its operator.
6. Qilin and Settra Ransomware Actively Exploit PAN-OS Auth Bypass
Affiliates of the Qilin and Settra ransomware operations are actively exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS, to gain initial access to victim networks before deploying ransomware payloads. Internet-facing PAN-OS management interfaces that remain unpatched are the direct exposure point.
7. Three Critical, Unauthenticated RCE and Injection Bugs
A trio of high-severity flaws drew particular attention for being both unauthenticated and already weaponized or trivially exploitable. Samsung's QA-Board carries CVE-2026-110392 (CVSS 9.8), an unauthenticated shell command injection. SiteGuard WAF has CVE-2026-106931 (CVSS 8.5), a command injection flaw already being actively exploited in the wild. And a WebAlliance eCommerce platform carries CVE-2026-108065 (CVSS 9.8), a SQL injection bug for which no patch has been announced at time of writing — making it the riskiest of the three for any site still running the affected version.
8. Rounding Out the Bulletin
The remaining items span infrastructure and enterprise software: a Xen hypervisor virtual-machine escape bug, a remote code execution flaw in MyReport Updater, a server-side request forgery (SSRF) issue in the Harbor container registry, and a code-execution bug in the NSD authoritative DNS server. None carry the severity of the headline items individually, but together they widen this week's attack surface across virtualization, container registries, and DNS infrastructure — environments that are typically treated as "plumbing" and patched on a slower cadence than user-facing applications.
Why It Matters
Taken together, this week's bulletin reinforces a pattern the Hacker News editors call out directly: most of these incidents didn't require a novel breakthrough exploit — they required overlooking a cloud-only code path (Adobe), trusting a wallet-approval prompt (Noir), running a GPU driver a version behind (NVIDIA), or missing a plugin that doesn't show up in the normal admin list (the WordPress backdoor). Defense-in-depth and patch cadence, not any single silver-bullet control, are what close these gaps.
Recommendations
For Security Teams
- Inventory which AEM instances are cloud vs. on-prem, and confirm the cloud-only RCE chain is patched — don't assume on-prem deployments share the exposure.
- Patch internet-facing PAN-OS management interfaces for CVE-2026-0257 immediately; Qilin and Settra affiliates are actively using it for initial access.
- Hunt for must-use (
mu-plugins) WordPress plugins that weren't deployed intentionally — they don't appear in the standard plugin list and are a growing persistence technique.
For Infrastructure and Platform Teams
- Patch NVIDIA GPU drivers against CVE-2026-47595 on any multi-tenant or container-based GPU infrastructure; treat container-escape bugs on shared compute as critical regardless of CVSS base score.
- Prioritize the three unauthenticated RCE/injection bugs (Samsung QA-Board, SiteGuard WAF, WebAlliance eCommerce) for immediate patching or compensating network controls where no patch exists yet.
- Review exposure on "plumbing" systems — Xen, Harbor, NSD — that often lag behind application patch cycles.
For End Users and Wallet Holders
- Treat any unexpected wallet "approval" or "spending permission" prompt as equivalent to a password request — the Noir drainer relies on victims clicking approve without reading what they're authorizing.
- Periodically review and revoke standing token approvals using a wallet-approval checker, even for sites visited only once.
Key Takeaways
- The Adobe AEM RCE chain only affects the cloud SKU and is already patched — but it shows how four individually low-impact bugs (XSS, unsafe XML parsing, bulk import, script execution) can combine into full RCE.
- The Noir drainer's DNS-TXT-record C2 lookup and reliance on wallet "approvals" rather than credential theft make it harder to detect with traditional phishing heuristics.
- CVE-2026-47595 ("Bad UVM") in NVIDIA's Linux driver is a container-escape-to-root bug — a serious risk for any shared GPU/AI infrastructure still on an affected driver version.
- The self-healing WordPress backdoor's use of EtherHiding (C2 addresses stored in Ethereum smart contracts) continues a trend of threat actors using blockchain data as censorship- and takedown-resistant infrastructure.
- Qilin and Settra ransomware affiliates are actively exploiting a PAN-OS authentication bypass (CVE-2026-0257) for initial access — unpatched management interfaces remain a top ransomware entry point.
- Across the bulletin's 27 items, the common thread is exploitation of overlooked configuration, trust assumptions, or slow patch cycles rather than novel zero-day research.