Monday, 12 October 2026

1 verified finding from 1 run · the settled record for this UTC day, in the classic brief order.

Criticality

Kind

Topic

Region

TL;DR · the day in one read

01Bricksforge's Pro Forms upload flaw is exploited without login since 7 October; fixed in 4.0.1 and 3.1.8.10. Patchstack reports that CVE-2026-85097, an unauthenticated arbitrary file upload in the Pro Forms module of Bricksforge, a paid WordPress add-on for the Bricks page builder, has been targeted in the wild since 2026-10-07: it lets an attacker with no account get a PHP file written to the uploads directory and executed, on versions up to and including 3.1.8.9 with Pro Forms active (about 6,000 active installations). Bricksforge's changelog of 2026-10-08 lists the fix in 4.0.1 and Patchstack names 3.1.8.10 for the 3.x line; the exploitation report rests on Patchstack's telemetry. →

NOTABLECVE-2026-85097exploitedNATOB2

CVE-2026-85097, Bricksforge for WordPress: an unauthenticated upload in the Pro Forms module writes attacker PHP into the uploads directory, exploited since 7 October; fixed in 4.0.1 and 3.1.8.10 (CVSS 9.8)

Bricksforge's Pro Forms module checks a file's type when it is first uploaded but trusts the file metadata the client sends when the form is submitted, in particular the url field of the temporaryFileUploads parameter (Patchstack, 2026-10-08). An attacker obtains a nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, uploads a GIF/PHP polyglot that passes the type check, then submits a form whose file path names that image and whose url ends in a PHP extension; the plugin writes the image's content to the PHP path and one request to it executes the code (Patchstack, 2026-10-08). Versions up to and including 3.1.8.9 are affected (Patchstack, 2026-10-08). The vendor's changelog lists the fix in 4.0.1 (Bricksforge, 2026-10-08), while Patchstack names 3.1.8.10 as the fixed build of the 3.x line, which the public changelog does not list (Dr. Web, 2026-10-09). Dr. Web credits Wordfence with a CVSS score of 9.8 and Patchstack with 10.0 (Dr. Web, 2026-10-09).

Patchstack's telemetry first recorded exploitation attempts on 2026-10-07 at 21:47 UTC, from 63 distinct source addresses, and it calls the activity automated without attributing it (Patchstack, 2026-10-08). Patchstack describes exploitation attempts and says an attacker with execution can deploy web shells, modify site content, read data and persist (Patchstack, 2026-10-08). It counts about 6,000 active installations (Dr. Web, 2026-10-09), Previdian tags the flaw "PoC available" (Previdian, 2026-10-08), and the flaw is not in CISA's KEV catalog (Dr. Web, 2026-10-09).

Detection

In web server and WordPress access logs, POST requests to /wp-json/bricksforge/v1/form_submit or to admin-ajax with the bricksforge_form_submit action that carry a temporaryFileUploads value pairing an image path with a PHP-extension destination, preceded by a call to the nonce endpoint and repeated with changing extensions, case or encodings, from 2026-10-07 onward; in file-integrity and endpoint telemetry, new PHP files in the WordPress uploads tree, the plugin's temporary upload folder first, and web requests to them (Patchstack, 2026-10-08). Patchstack says a site that ran a vulnerable version without protection should have its historical logs and the host reviewed for unexpected PHP files, unusual application activity and unauthorized changes (Patchstack, 2026-10-08); Dr. Web adds a check of the user list for unknown administrator accounts (Dr. Web, 2026-10-09).

This vulnerability is currently being targeted in the wild.

Patchstack 2026-10-08

It affects every site with Pro Forms active, including sites whose forms use no upload fields, so updating is strongly recommended.

Bricksforge (vendor changelog) 2026-10-08

Patchstack has observed automated attacks from 63 different IP addresses since 7 October. (translated from German)

If the licence has lapsed, the fix may not arrive at all. (translated from German)

Dr. Web 2026-10-09

Previdian records an exploitation-related signal (poc available).

Previdian 2026-10-08

vulnerability12 Oct 03:21Zsingle-sourceOpen finding →

Sources: Patchstack · Bricksforge (vendor changelog) · Dr. Web · Previdian

02Action items1 item

Find every WordPress site that your organisation, its web agencies or its hosting suppliers run with Bricksforge and update it to version 4.0.1 (3.1.8.10 on the 3.x line) now, treating any site that was reachable and unpatched since 2026-10-07 as one to search for dropped PHP files.
FindingCVE-2026-85097

Verification & coverage notes1 run

2026-10-12T0256Z-intel · Sonnet 5.5 · window 26 h · 1 entry published

Verification & coverage notes

Quiet Monday window: the 26 h window (2026-10-11T00:57Z to 2026-10-12T02:57Z) followed a weekend, and the newest item on every authority source (NCSC-CH, NCSC-NL, BSI, CERT-FR, CERT-EU, CERT.at, CISA, ENISA, Europol, OFAC) is dated 2026-10-09 or earlier. The mechanical KEV diff found no CISA KEV addition inside the window (catalog 2026.10.08) and no RANSOMWARE-flag flip on a covered CVE, and S1 read the catalogue itself and agrees. Four sub-agents returned seven candidate items (S1 three, S2 none, S3 one, S4 three), all marked borderline by their authors. One new entry ships and no existing entry changed: no deep dive, no critical. The scheduled vendor cycles (Microsoft Patch Tuesday, SAP, Adobe) land on 2026-10-13 and Oracle's CPU on 2026-10-20, so none fell in this window; Microsoft's early October release has no exploited or publicly disclosed CVE in its structured fields.

Published: 2026-10-12/cve-2026-85097-bricksforge-pro-forms-upload-php-exploited (notable): a pre-auth upload-to-PHP flaw in a paid WordPress add-on, exploited since 2026-10-07 per Patchstack's telemetry, vendor fix available. It is first coverage from a rotational source's lookback (PD-7(d); Patchstack's primary is dated 2026-10-08, outside the 26 h window); no earlier record carries a disposition for it, because the 2026-10-11 S1 raised it from outside its slice. Relevance ground, stated here and not in the entry: an exploited unauthenticated code-execution flaw with a vendor fix clears PD-11(b), the vendor is German and the add-on is sold to site builders in the DACH region, and no source shows a Swiss public-sector deployment, so the priority is notable and the entry is held short.

borderline-drop: Ricardo (SMG Swiss Marketplace Group), about 890,000 accounts with names, addresses and phone numbers exposed, announced 2026-10-09 (S4, re-raised from lookback; the 2026-10-11 fire already dropped it), Swiss home region and victim-confirmed, but a private consumer marketplace with no vector, no actor and no public-sector nexus (incident floor); the only mappable technique would rest on the word "vulnerability" alone.
borderline-drop: ShinyHunters / FBI portal case, arrest of a Canadian ransomware-negotiation executive and the group's no-release statement (S4, update-of; the 2026-10-11 fire already dropped the arrest), a law-enforcement development with no tradecraft or hardening content, the identity rests on Krebs's sources and court records the FBI has not confirmed.
borderline-drop: IDC Frontier IDCF Cloud fourth report of 2026-10-09 (S4, update-of), a response-organisation notice with no technical, scope or recovery fact beyond the covered entry.
borderline-drop: expired-domain script hijack delivering the P7 DarkSword iOS chain through a dead analytics tag (S3; Report URI, iVerify), exploitation of the domain re-registration rests on one researcher who sells a script-integrity product, no independent report, no public-sector site named, and the iOS chain was already dropped by the 2026-10-10 fire.
borderline-drop: Chrome 155 stable, 247 security fixes, no exploitation statement (S1), already dropped by the 2026-10-10 fire.
borderline-drop: "PoC available" tags on CVE-2026-107406 and CVE-2026-84411 (S1), Previdian's tag, and S1's own look at the GitHub repositories shows README-only exploit-sale or lure pages, not exploit code; low confidence, attacker-adjacent URLs, and neither covered entry claims a public proof of concept.
borderline-drop: SmarterMail build 9777 (post-authentication, aggregator-only CVE), Apache Struts S2-075 to S2-078 (denial of service or disclosure, no code execution), Zimbra 10.1.21, the NCSC-NL Kiteworks bulletin, Android and Apple bulletins, the EUVD weekend batch, and the Cisco, HPE, IBM Verify, Splunk and Veeam bundles that earlier fires held below the gate, no exploitation, no public exploit, no established constituency exposure (S1).
borderline-drop: CloudSEK NEBULA (executive summary only, full report gated, no nexus), Booz Allen OT-lab study of frontier models (lab only, whitepaper gated), Zenity AgentCorruption (patched, vendor disputes the framing), OpenAI's influence-operations report, the MonsterCloud indictment, the Silent Ransom Group leak-origin story, ASOS breach (consumer retailer, vector unconfirmed) (S3).
borderline-drop: Swiss leak-site claims with no victim statement or press confirmation (Camandona SA, Hotel Delfino Lugano, Boullard Musique, dd-automation, stuecheli, Rueeggerseg AG); claim-only listings fail PD-6 (S2, S4).
out-of-window: Zug draft cantonal Information Security Act and ordinance in consultation since 2026-07-15 (comments to 2026-11-09, S2), a draft with a comment deadline, not an obligation, and 89 days old.

Backlog (state/coverage_backlog.md): all four open rows were re-gated on today's facts and none changed state, so nothing is appended; each stays held on its named condition with its expiry unchanged. IBM Guardium Data Protection CVE-2026-85542 and the four related unauthenticated flaws: none is in CISA KEV, IBM's bulletin makes no exploitation statement and no constituency deployment surfaced (expires 2026-10-14). SafePay claim on ARA-Region Lyss-Limpachtal and Payload claim on Netech: ransomware.live shows no press confirmation, no Swiss press report exists and the victims' own sites carry no notice (both expire 2026-10-14). Beyond Gravity: every public account still traces to the single company statement of 2026-10-02, with no vector, actor or data named (expires 2026-10-20).

Single-source: 2026-10-12/cve-2026-85097-bricksforge-pro-forms-upload-php-exploited: Patchstack is the only observer of the exploitation; Dr. Web restates it, the vendor changelog confirms an upload fix in 4.0.1 without naming the CVE, and the CVE record's assigner (Wordfence) scores it 9.8 where Patchstack scores it 10.0. The CISA enrichment on the CVE record lists exploitation as none, stamped about three hours after the Patchstack article.

Rotation: ranking used the derived cursor; 81 standard or candidate records (S1 27, S2 24, S3 30) were set aside as attempted in the previous two fires, and S4's pool of 19 breach and ransomware sources is smaller than a slice, so nine of its twelve records were swept although the previous two fires had attempted them.

Coverage gaps: apa-ots (no listing or feed route; WebSearch only); swissinfo-ger (the extracted homepage is a stale 2026-09-29 snapshot); cloudsek-triad (executive summaries only; the full report is gated); sentinellabs and proofpoint listings recipes re-confirmed. Reader credit: extract fell through to the metered reader on community.citrix.com, psirt.global.sonicwall.com and source.android.com, and one key rotated on an HTTP 402.

For the next audit: (1) an optional improvement on 2026-10-06/denmark-cpr-population-register-third-party-access-breach: TV 2 Kosmopol, relaying Ritzau on 2026-10-09, says the CPR office's notification states the actor did not use the access for the whole period and that the compromise appears to have stopped on 2026-09-20, which reconciles the minister's ten days with Ritzau's 21 days and 17 hours that the entry sets side by side; (2) S1 suggests a cheap gate for any "PoC available" claim: the unauthenticated GitHub repository search plus the contents API separates exploit code from README-only exploit-sale repositories; (3) S3 flags the DNSSEC root key rollover of 2026-10-11 as a watch item only if a resolver-outage report appears.

Source health: the probe covered 241 records (240 relevant, 1 stale: threatpost, already demoted and handled) and its UNSOLVED list was empty, so no repair was owed this run. Verification: two iterations, no entry dropped. Iteration 1 (truth 4, editorial 7, advisory 3) found attribution and citation slips, the unaccounted-for 4.0.0 release, a missing public proof-of-concept statement and a duplicated action; all but the unreadable VulnCheck listing were fixed. Iteration 2 (truth 1, advisory 2) found one clause attributed to Patchstack that its page does not state, and it was removed. The low-residual early exit applies (truth plus editorial is 1, no F1 or F4), so the residual of 1 was remediated after the last pass and not re-verified.