October 23, 2026
CYBER BRIEFING | October 23, 2026
Pillow RCE fix, M365 token spraying, Capcom 11.77M breach
By CyberMaterial
3 min read
Welcome to Cyber Briefing, your daily source for all things cybersecurity. We bring you the latest advisories, alerts, incidents, and news every weekday.
Today in 30 seconds
- Upgrade Pillow to 13.0.0. CVE-2026–112900 (CVSS 9.2) lets a crafted filename inject Ghostscript arguments, which can lead to RCE.
- Check Entra for rogue devices. Huntress tracked 497 stolen-token sign-ins across 79 organizations.
- Update x402 clients. Agents that auto-sign payments could be asked for their full balance.
- Capcom breach exposes 11.77M CAPCOM ID records. Expect phishing that impersonates Capcom.
Listen to our podcast here ⏬
https://open.spotify.com/episode/2k3CsONP8Gr22ZywJGIZiT?si=mULEZYZAQaSnJzwMjnUyHA
🩹 PATCH NOW
Pillow Fixes Filename Flaw That Can Lead to RCE (CVE-2026–112900) Pillow versions 2.6.0 through 12.3.0 pass a caller-controlled filename to Ghostscript when opening EPS files. A filename…