444 articles/72h
175 sources
updated

💣 Exploits

Top Stories 5

Cisco SD-WAN vulnerability CVE-2026-20127 exploited to install KeyDrift malware that harvests encryption keys

4 sources ¡ 4 articles

Talos reports that the APT group UAT-11473 leveraged the authentication‑bypass CVE‑2026‑20127 in Cisco SD‑WAN Catalyst Controllers to install the KeyDrift framework, which harvests control‑plane key material and provides persistent backdoor access. The campaign targets space, defense, aerospace and policy‑research entities and appears to share infrastructure with the Volt Typhoon “Silent Train” network.

Key points

  • UAT‑11473 exploited CVE‑2026‑20127, an authentication bypass in Cisco SD‑WAN Catalyst Controller, to gain unauthorized access.
  • The group deployed KeyDrift, a custom malware suite with components PolyFlame and LittleFilch that reside in controller processes and intercept decrypted control‑plane traffic.
  • KeyDrift stages extracted keying material in encrypted form and can act as an intermediate C2 host.
  • Targeted sectors include satellite services, defense, aerospace technology, and policy research, with infrastructure overlap to Volt Typhoon’s Silent Train network.
  • Cisco has issued a security advisory and a patch for the vulnerability.
Sources talosintelligence.com Bleeping Computer SecurityWeek The Hacker News 4 articles

Microsoft releases record 974 patches, fixing two exploited zero‑day flaws

5 sources ¡ 7 articles

Cisco disclosed a denial‑of‑service vulnerability in the SSL remote‑access VPN of its ASA and FTD firewalls that can be triggered by a crafted request when secondary authentication is enabled. The vendor has issued software updates to fix the issue; no workarounds exist aside from disabling secondary authentication.

Key points

  • The vulnerability resides in the SSL VPN service of Cisco Secure Firewall ASA and Secure Firewall Threat Defense when secondary authentication is configured, allowing an unauthenticated attacker to cause a device reload and denial of service.
  • Exploitation requires sending a crafted request during VPN connection; a successful attack forces the firewall to reboot unexpectedly.
  • Cisco has published software updates for affected releases and recommends disabling secondary authentication as a mitigation, though this reduces remote‑access security posture.
  • The advisory notes that only specific Cisco firewall products are vulnerable; cloud‑delivered firewalls and other listed models are not affected.
  • No public exploits or active attacks are reported, and Cisco’s advisory serves as the official guidance for remediation.
Sources cisco.com CSO Online Bleeping Computer The Hacker News SecurityWeek cisco.com SecurityWeek 7 articles

PHP Foundation issues emergency patches for critical “php2shell” RCE flaws (CVE‑2026‑109618/109619) after active exploitation

40 sources ¡ 85 articles

A China-linked hacking group combined PHP2Shell CVEs 2026-109618/109619 with a Linux kernel flaw to gain root on Palo Alto Networks firewalls. Palo Alto confirmed the attacks, issued patches for affected PAN‑OS versions, and warned that only a tiny fraction of internet‑exposed management interfaces were compromised.

Key points

  • Palo Alto Networks verified that a China‑linked group used PHP2Shell (CVE‑2026‑109618, CVE‑2026‑109619) together with the Fragnesia kernel privilege‑escalation bug to obtain root on PA‑Series and VM‑Series firewalls.
  • The campaign affected roughly 25 firewalls out of hundreds, representing about 0.02% of the global installed base with internet‑facing management interfaces.
  • Palo Alto released patches for PAN‑OS 10.2 through 12.2 and urged customers to restrict external access to management interfaces.
  • Telemetry shows over 22.6 million PHP instances potentially vulnerable, but attempts against WordPress have so far yielded no confirmed compromises.
  • Threat research firms observed that most attacks originated from a few IPs in the US, Netherlands and Germany, targeting healthcare and other sectors opportunistically.
Sources SecurityWeek blue-initiative.org CSO Online The Record by Recorded Future Bleeping Computer CSO Online The Hacker News crowdstrike.com europa.eu bbc.co.uk theregister.com Twitter/HackingLZ The Hacker News Bleeping Computer Bleeping Computer SecurityWeek arstechnica.com Twitter/IceSolst The Record by Recorded Future Bleeping Computer The Hacker News sans.edu SecurityWeek Bleeping Computer The Register Security qualys.com arcticwolf.com linkedin.com The Hacker News Twitter/HackingLZ Twitter/HackingLZ Twitter/HackingLZ virustotal.com openai.com Twitter/blackorbird Bleeping Computer SecurityWeek The Hacker News The Hacker News The Record by Recorded Future linkedin.com amazon.com hadrian.io google.com CSO Online Twitter/lorenzofb Bleeping Computer SecurityWeek SecurityWeek The Hacker News Twitter/HackingLZ dshield.org sans.edu eliastaylor.com CSO Online amazon.com The Record by Recorded Future SecurityWeek thephp.foundation Krebs on Security Rapid7 Research Blog Securelist Twitter/blackorbird The Record by Recorded Future cloudflare.com Bleeping Computer openai.com The Hacker News Twitter/AndrewMohawk Twitter/AndrewMohawk Twitter/craiu Twitter/AndrewMohawk wiz.io Cyberscoop CISA Cybersecurity Advisories The Hacker News SecurityWeek The Hacker News jackalsyn.com Twitter/blackorbird php.net Elastic Security Labs Bleeping Computer php.net Twitter/HackingLZ @HackingLZ @IceSolst @HackingLZ @HackingLZ @HackingLZ @JohnHultquist @JohnHultquist @blackorbird @lorenzofb @craiu @HackingLZ @blackorbird @AndrewMohawk @AndrewMohawk @craiu @AndrewMohawk @craiu @blackorbird @HackingLZ 85 articles

ARMORY CASTLE exploited BeyondTrust Remote Support zero‑day (CVE‑2026‑102764)

4 sources ¡ 5 articles

CISA added CVE‑2026‑41709 to its KEV list after confirming exploitation by the China‑linked group Warp Panda, which used the flaw to hide activity in US organizations. Patches are available in recent ESXi releases. The vulnerability was disclosed alongside other critical VMware bugs that have also seen active abuse.

Key points

  • CISA listed CVE‑2026‑41709, a low‑severity insufficient‑logging issue in VMware ESXi, as a known exploited vulnerability and recommended patching within two weeks.
  • CrowdStrike reported that the China‑nexus actor Warp Panda used the flaw as a zero‑day to reduce audit‑trail visibility in intrusions against US firms, including law firms.
  • VMware has released patches for the affected ESXi versions; the vulnerability was disclosed on July 29 alongside other critical VMware bugs.
  • Related VMware flaws CVE‑2026‑59309 and CVE‑2026‑59310 have also been observed in the wild, with the latter used to compromise hundreds of vCenter servers.
  • The activity underscores continued targeting of virtualization infrastructure by state‑linked threat actors.
Sources SecurityWeek The Hacker News Rapid7 Research Blog beyondtrust.com beyondtrust.com 5 articles

Check Point Issues Urgent Patches for Two Critical 9.8‑Rated VPN RCE Flaws (CVE‑2026‑85102/85103)

6 sources ¡ 7 articles

Palo Alto Networks disclosed two critical PHP remote code execution vulnerabilities that are being actively exploited against its management interfaces. The vendor listed affected and unaffected product versions and noted that patches are pending for PAN‑OS while some SaaS components have already been updated.

Key points

  • The vulnerabilities stem from improper handling of out‑of‑memory errors via longjmp(), leading to uninitialized or freed memory use.
  • Active exploitation targets PAN‑OS management interfaces exposed to the internet, raising a CVSS‑4.0 score of 9.2.
  • Palo Alto provided a product impact matrix and recommends restricting management access to a jump box.
  • Remediation patches have been released for Cortex XCORE and WildFire Cloud; PAN‑OS fixes are slated for upcoming releases.
Sources paloaltonetworks.com Twitter/HackingLZ SecurityWeek Unit 42 (Palo Alto) cybersecuritydive.com The Hacker News Unit 42 (Palo Alto) @HackingLZ 7 articles

Other Updates 10

Critical Brotli decoder out-of-bounds write (CVE‑2026‑111497) triggers emergency patches across Node.js, .NET, Python, PHP and other runtimes

15 sources ¡ 22 articles

CVE-2026-111497 lets attackers gain a shell on stock Node.js via a crafted Brotli payload, with active exploitation confirmed and a fix released.

Key points

  • The vulnerability stems from an invalid block‑switch in Brotli decoding, causing an out‑of‑bounds write that attackers can control up to ~2 GB away.
  • ELLIO reproduced the exploit on x86‑64 against plain Node HTTP server, official Node 24.22.0‑slim image, Express 5.3.0 and Koa 3, each yielding a service‑level shell.
  • Public exploit traffic was detected shortly after disclosure, confirming active exploitation in the wild.
  • Google’s upstream fix changes the decoder to return a proper error code for invalid switches, stopping the out‑of‑bounds write.
  • Node.js 22.x, 24.x and 26.x (plus end‑of‑life 20.x, 23.x, 25.x) are affected; the latter will not receive a patch.
Sources ellio.tech previdian.com Bleeping Computer SecurityWeek The Hacker News CSO Online Cyberscoop The Hacker News Rapid7 Research Blog Bleeping Computer Bleeping Computer SecurityWeek aikido.dev opensourcemalware.com github.com broccoli2shell.com qualys.com The Hacker News The Hacker News Twitter/hkashfi The Hacker News Twitter/AndrewMohawk @hkashfi @AndrewMohawk 22 articles

CISA Expands KEV Catalog with Multiple Actively Exploited Zero‑Day Flaws Across Major Vendors

4 sources ¡ 14 articles +1 source (SecurityWeek)

CISA adds two Ivanti Connect Secure flaws to its KEV catalog, citing active exploitation and urging swift remediation.

Key points

  • CISA’s KEV catalog now includes CVE‑2026‑111357, a missing authentication issue in Ivanti Connect Secure, and CVE‑2026‑118527, a predictable identifier generation flaw.
  • Both vulnerabilities are confirmed to be exploited in the wild, prompting the agency’s directive for federal agencies to prioritize patches.
  • The Binding Operational Directive 26‑04 mandates rapid remediation of KEV‑listed flaws on publicly exposed assets.
  • CISA encourages all organizations to adopt similar risk‑based vulnerability management practices.
  • Stakeholders can nominate additional exploited CVEs for inclusion via CISA’s KEV nomination form.
Sources CISA Cybersecurity Advisories SecurityWeek The Hacker News CISA Cybersecurity Advisories CISA Cybersecurity Advisories CISA Cybersecurity Advisories CISA Cybersecurity Advisories CISA Cybersecurity Advisories CISA Cybersecurity Advisories CISA Cybersecurity Advisories CISA Cybersecurity Advisories Bleeping Computer The Hacker News CISA Cybersecurity Advisories 14 articles

Oracle PeopleSoft SSRF (CVE-2026-35273) exploited by ShinyHunters for remote code execution

2 sources ¡ 2 articles

Oracle patched a three‑flaw PeopleSoft chain exploited by ShinyHunters, which was a zero‑day used in the wild.

Key points

  • Three distinct vulnerabilities in PeopleSoft’s Integration Gateway and Environment Management Hub were combined to achieve unauthenticated remote code execution.
  • Oracle released an out‑of‑band fix for CVE‑2026‑35273 on June 10, and the flaw is listed in CISA’s KEV catalog.
  • ShinyHunters (UNC6240) leveraged the chain from late May to early June, initially targeting universities and later expanding to multiple sectors.
  • The attack bypasses WAF rules by URL‑encoding the PSEMHUB path, highlighting the need for patching over perimeter defenses.
Sources The Hacker News Zero Day Initiative Blog 2 articles

Signaling protocol flaws in SS7 and Diameter enable tracking, interception and impersonation of mobile users

1 source ¡ 1 article

SS7 and Diameter signaling weaknesses let attackers track, intercept and impersonate mobile users, with real‑world incidents including a congressman’s phone hack.

Key points

  • Signaling attacks operate within carrier networks, allowing attackers to query subscriber IDs, real‑time location and reroute calls or texts.
  • Both protocols assume trust between operators; SS7 lacks authentication entirely, while Diameter’s optional protections are often not deployed.
  • Criminals have leveraged these flaws to steal bank one‑time passcodes, and Iranian‑linked actors reportedly used them to locate U.S. personnel abroad.
  • Research by Citizen Lab uncovered long‑running commercial surveillance campaigns targeting thousands of users across dozens of countries.
  • A public demonstration by a YouTuber showed call and text hijacking using only a phone number, highlighting the ease of exploitation.
Sources Bleeping Computer 1 articles

GitLab releases patches for critical AI Gateway flaw (CVE‑2026‑90970) that could enable command execution

4 sources ¡ 7 articles CVE-2021-22175, CVE-2021-39935, CVE-2026-0723 added ¡ rated more serious

CISA confirms wild exploitation of GitLab’s critical CI/CD regex compiler flaw (CVE‑2026‑97229) and urges immediate patching.

Key points

  • GitLab’s CI/CD regular‑expression compiler contains an integer‑overflow (CVE‑2026‑97229) that can allow unauthenticated code execution.
  • The vulnerability was patched in GitLab CE/EE 19.4.2, 19.3.5 and 19.2.8, and detection signatures were released for self‑managed instances.
  • CISA listed the flaw in its KEV catalog and issued a Binding Operational Directive requiring federal agencies to patch promptly.
  • Shadowserver reports nearly 2,800 Internet‑exposed GitLab CE instances, highlighting the potential attack surface.
  • GitLab’s platform serves over 50% of Fortune 100 companies and 70 million users worldwide, underscoring the broad impact.
Sources Bleeping Computer The Hacker News alpinelinux.org The Hacker News CSO Online Bleeping Computer The Hacker News 7 articles

TeamViewer patches three critical client flaws, including remote code execution via screen‑buffer overflow

4 sources ¡ 4 articles +2 sources (SecurityWeek, The Hacker News) ¡ CVE-2026-92372, CVE-2026-92374 added ¡ rated more serious ¡ merged with 1 other story

TeamViewer 15.83 patches a remote‑code execution flaw that lets a host attack the viewer in a remote session.

Key points

  • The vulnerability (CVE‑2026‑111585) scores 8.8 CVSS and allows a host to overflow a memory allocation on the viewer, causing a crash or code execution on Windows.
  • Remedio researcher Omri Dar disclosed the issue; TeamViewer confirms code execution is possible on some platforms but no wild attacks are known.
  • All TeamViewer Full Client, Portable and Android apps before version 15.83 are affected; updating to 15.83 or later resolves the issue.
  • The fix also addresses two other high‑severity flaws in the same bulletin and six additional issues in Remote Management add‑ons.
  • TeamViewer has not observed any exploitation and provides no workaround beyond applying the update.
Sources The Hacker News SecurityWeek teamviewer.com remedio.io 4 articles

WordPress core update race condition exploited within hours of patch release

2 sources ¡ 2 articles +1 source (The Hacker News)

WordPress core RCE bug draws ~63k attack attempts in 24 hours despite patch release.

Key points

  • The flaw allows unauthenticated code execution when the full‑package update’s installer is exposed in a web‑accessible staging path under wp‑content/upgrade.
  • Exploitation requires hitting a narrow window while WordPress unpacks the update, a race condition observed by Wordfence.
  • Wordfence blocked 62,969 attempts and identified two major sources polling sites for ~14.5 hours to catch the upgrade window.
  • Patch (v7.1.4) was released on Oct 28, 2026; site owners should upgrade immediately and watch for unexpected PHP files or admin accounts.
Sources The Hacker News SecurityWeek 2 articles

Drupal Commerce Core Authorization Bypass (CVE-2026-118539) Actively Exploited in the Wild

1 source ¡ 1 article

A critical Drupal Commerce Core flaw is under active exploitation, prompting urgent patch recommendations.

Key points

  • The vulnerability affects Commerce Core versions 0.0.0‑2.41 and 3.0.0‑3.3.13, allowing unauthorized access to routes and entity fields.
  • Drupal’s advisory confirms active exploitation in the wild but offers no details on attack scope or impact.
  • Users should upgrade to Commerce Core 3.3.13 or 8.x‑2.41, the versions that contain the fix.
  • The flaw was reported by security researchers Dan Puccetti, Marcus Johansson, and Robert Snyder.
  • The notice appears alongside active exploitation of unrelated PHP2Shell vulnerabilities, highlighting broader threat activity.
Sources The Hacker News 1 articles

Linux kernel TCP use‑after‑free (CVE‑2026‑98432) scores 9.8, patches pending for Ubuntu and RHEL

3 sources ¡ 3 articles +1 source (CSO Online) ¡ rated more serious

Anthropic demonstrated a remote‑root exploit for a critical Linux kernel flaw affecting MPTCP listeners, with patches now available for major distros.

Key points

  • The CVE‑2026‑98432 flaw is a use‑after‑free in the IPv4 TCP code, scored 9.8 by the Linux CVE team.
  • Anthropic’s unreleased Claude model bypassed KASLR to gain root on MPTCP‑enabled servers, taking about 53 minutes per exploit.
  • MPTCP is auto‑enabled in Go 1.24, potentially exposing Go‑based services that unknowingly run MPTCP listeners.
  • Patches have been back‑ported to upstream Linux and are being released for Ubuntu, RHEL, Rocky Linux, Debian and others.
  • Red Hat notes exploitation is complex and rates the issue lower for denial‑of‑service impact.
Sources Bleeping Computer CSO Online The Hacker News 3 articles

CISA alerts on critical EPICS Base flaws affecting industrial control systems

2 sources ¡ 2 articles

CISA advises updating EPICS Base to 7.0.11 after four critical bugs were disclosed and patched.

Key points

  • Four CVEs (CVE‑2026‑114595 to CVE‑2026‑114598) affect EPICS Base 7.0.10 and earlier, enabling memory corruption, DoS, and potential code execution via unauthenticated network requests.
  • The vulnerabilities were uncovered by Cipher, an autonomous research system from Causal Security, in under four hours of analysis.
  • CISA’s advisory recommends upgrading to EPICS Base 7.0.11; no public exploitation has been reported.
  • EPICS is widely used in scientific facilities such as ITER and the Advanced Photon Source, making the patches critical for research operations.
Sources SecurityWeek CISA Cybersecurity Advisories 2 articles

Additional Signals 25

GreyNoise reports active exploitation of PHP CVE‑2026‑109618/109619 (php2shell) with four confirmed attacks

1 source ¡ 1 article

Four confirmed php2shell exploits were observed, prompting CISA to list the CVEs as known‑exploited vulnerabilities.

Key points

  • GreyNoise tracked 414 attacker IPs targeting the php2shell flaws, with four successful exploit sessions from IP 2.59.133.151.
  • The exploit chain involved Apache2 spawning a shell that executed curl commands and a sleep delay.
  • CISA added CVE‑2026‑109618 and CVE‑2026‑109619 to its KEV list on 26 Oct 2026, signaling official advisory.
  • No patches or mitigations were reported, and no victim organizations were named.
  • The activity was limited to a single attacker IP and did not target critical‑infrastructure sectors.
Sources Twitter/ryanaraine @HackingLZ @ryanaraine 1 articles

VulnCheck analyzes exploitation of Gotenberg CVE-2026-42589 and the custom Go reverse shell cache_base

1 source ¡ 1 article

Active exploitation of Gotenberg’s CVE-2026-42589 delivers a Go reverse shell and a broader malicious toolkit.

Key points

  • VulnCheck’s canary network recorded 38 events from a Japanese IP that leveraged CVE-2026-42589 to execute Perl code through ExifTool metadata injection.
  • The attacker downloaded the cache_base binary via GitHub, a self‑hosted Gitea server, and a Node.js fetch fallback, then confirmed its presence on the host.
  • Binary analysis revealed a multi‑component toolkit hosted on GitHub, including additional backdoors, Windows privilege‑escalation utilities, PHP webshells, and suspicious CMS plugins.
  • Over a month, 1,358 exploitation events from 128 IPs were observed, with major clusters in Great Britain, Israel, and a Contabo‑hosted scanner in France.
  • The flaw, scored 9.8 CVSS, was fixed in Gotenberg 8.31.0, though it is not yet listed in CISA’s KEV catalog.
Sources vulncheck.io 1 articles

GoAhead embedded web server flaw lets revoked client certificates authenticate, enabling session decryption

3 sources ¡ 3 articles

FoxIO disclosed three TLS bugs in GoAhead, a web server used in hundreds of millions of devices, and released a patch for two of them.

Key points

  • Critical CVE‑2026‑115881 (CVSS 9.1) lets revoked client certificates be accepted when GoAhead is built with OpenSSL and mTLS is enabled.
  • A medium‑severity flaw in Mbed‑TLS builds weakens TLS 1.2 encryption, allowing offline decryption of captured sessions.
  • A chain‑length bypass (CVE‑2026‑115884, CVSS 7.4) defeats certificate‑chain caps in LibreSSL‑based deployments.
  • GoAhead 6.1.1, released on Aug 2, fixes the OpenSSL and Mbed‑TLS issues; mitigation steps are advised for the LibreSSL case.
  • FoxIO listed numerous vendors (e.g., Palo Alto Networks, HP, Siemens, Boeing) whose devices rely on GoAhead, but did not confirm vulnerable configurations.
Sources SecurityWeek foxio.io The Hacker News 3 articles

Chrome 150 Update Addresses Critical Memory Safety Vulnerabilities

1 source ¡ 2 articles

Chrome and Firefox updates close 200+ flaws, with critical bugs fixed and no known wild exploits.

Key points

  • Chrome 156 addresses 52 defects, four of which are critical, such as a FileSystem memory‑corruption flaw (CVE‑2026‑118306) that could enable sandbox escape.
  • Firefox 159 patches 167 defects, including 108 high‑severity use‑after‑free bugs and several sandbox‑escape and same‑origin bypass issues.
  • Mozilla also updated Thunderbird 159, Thunderbird 153.6, and Firefox ESR 153.6 and 115.44 with many of the same fixes.
  • Google and Mozilla state no known exploitation in the wild and recommend immediate updates for all platforms.
Sources SecurityWeek SecurityWeek 2 articles

Oracle releases October 2026 Critical Patch Update with 1,295 security fixes

6 sources ¡ 7 articles

Actors are probing a newly patched critical Oracle E‑Business Suite RCE vulnerability (CVE‑2026‑101767).

Key points

  • Oracle E‑Business Suite contains an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to remote code execution (CVSS 9.8).
  • The flaw was discovered by Horizon3.ai researchers and patched by Oracle in its October 2026 Critical Patch Update.
  • Defused Cyber observed exploratory exploit attempts against the vulnerability on October 27, indicating early probing activity.
  • Horizon3.ai provides mitigation steps and indicators of compromise, including specific POST requests and unexpected files in the application temp directory.
  • Previous critical EBS flaws (CVE‑2025‑61882, CVE‑2026‑46817) were actively exploited by the Cl0p ransomware group.
Sources The Hacker News Bleeping Computer SecurityWeek CSO Online tenable.com SecurityWeek oracle.com 7 articles

Electrum wallet vulnerability lets malicious server replace unconfirmed transactions and steal fee bumps

1 source ¡ 1 article

Electrum client can be tricked by a malicious server into signing higher‑fee transactions that pay an attacker.

Key points

  • A malicious Electrum server can swallow a user‑sent transaction and inject a conflicting, unsigned transaction into the client’s history.
  • If the user later uses Replace‑by‑Fee, the wallet signs the attacker’s transaction, resulting in loss of funds.
  • The bug stems from the light‑client design that does not verify signatures on unconfirmed, "is_mine" inputs.
  • Patch released in version 4.8.3 adds signature verification for mempool transactions.
  • Some servers are reported to be exploiting this attack in the wild.
Sources github.com 1 articles

Eight eMudhra certificate keys cracked; browsers and OSes block them

1 source ¡ 1 article

Compromised eMudhra certificates are being blocked across major browsers and operating systems after a key‑cracking incident.

Key points

  • Eight eMudhra certificate keys were cracked and publicly disclosed in October 2026.
  • Mozilla bug 2083449 and Google security blog detail mitigation steps and block deployment.
  • Google Play services pushed a block on Android devices on 19 Oct 2026; older or non‑Google devices require manual disabling.
  • Apple automatically blocks the affected certificates on iOS/iPadOS; Firefox updates its blocklist for Android.
  • A dedicated site provides platform‑specific instructions to verify and remove trust in the compromised roots.
Sources Twitter/IceSolst @IceSolst 1 articles

Drupal releases patches for critical Field UI remote code execution flaw (CVE‑2026‑108097)

2 sources ¡ 4 articles CVE-2026-118539, CVE-2026-9082 added ¡ rated more serious

Drupal reports active exploitation of a critical Commerce Core bypass vulnerability and urges immediate patching.

Key points

  • The Commerce Core module, used by over 42,000 Drupal sites, allows unauthenticated attackers to bypass access controls on e‑commerce routes and entity fields.
  • Drupal assigned a 21/25 severity score and confirmed the vulnerability is being exploited, though no specific attackers or victim sites were identified.
  • Patch releases fix versions 3.3.13 and 8.x‑2.41; administrators should upgrade and review order data for potential fraud.
  • The advisory notes that proof‑of‑concept code exists and that similar Drupal advisories this week cover multiple critical bugs, some with exploit code in the wild.
Sources SecurityWeek Bleeping Computer SecurityWeek Bleeping Computer 4 articles

Jenkins releases patches fixing deserialization, XSS, and agent command vulnerabilities

1 source ¡ 1 article

Jenkins patches several high‑risk flaws that could lead to remote code execution and XSS for privileged users.

Key points

  • The custom XStream deserialization filter in Jenkins 2.587 and earlier failed to block classes referenced via the resolves‑to attribute, enabling arbitrary object instantiation.
  • Improper validation of job config.xml files allowed stored XSS for users with Item/Configure permission.
  • Agent launch command conversion could execute arbitrary code on the controller when using the Command Agent Launcher Plugin.
  • Renaming items could follow symbolic links, permitting file reads from the controller filesystem.
  • Jenkins 2.588 and LTS 2.580.2 add post‑processing type checks and disable unsafe conversions to close these attack paths.
Sources jenkins.io 1 articles

Kaspersky uncovers new supply-chain malware targeting Asian government Windows systems

1 source ¡ 1 article

Kaspersky reports a novel supply‑chain malware, NetamLoader, aimed at a government‑specific Windows OS in Asia, with a single confirmed infection.

Key points

  • NetamLoader uses signed Microsoft binaries and a third‑party update tool to evade defenses and download additional payloads.
  • The malware was discovered in a directory used for Windows update packages, indicating a possible compromise of the update process.
  • Researchers suspect a supply‑chain attack but cannot confirm the source or the extent of the compromise.
  • Kaspersky has not linked the activity to any known state‑sponsored group and no victim agency was named.
Sources The Record by Recorded Future 1 articles

MLflow fixes unauthenticated SSRF and information disclosure in get-artifacts function

1 source ¡ 1 article

MLflow’s get‑artifacts SSRF bug is patched in version 3.17.0, ending unauthenticated data‑leak risk.

Key points

  • The flaw stems from insufficient URI validation in the get‑artifacts API, enabling remote attackers to request arbitrary internal URLs.
  • Exploitation does not require authentication, allowing disclosure of sensitive server‑side information.
  • MLflow released a fix in version 3.17.0 via a GitHub pull‑request.
  • The advisory was coordinated and publicly released on October 29 2026 after initial reporting on February 5 2026.
  • No known active exploitation, victim organizations, or financial losses were disclosed.
Sources ZDI Published Advisories 1 articles

Siemens releases patches for Mendix SAML authentication bypass (CVE‑2026‑89209)

1 source ¡ 1 article

Siemens patches a SAML replay bypass in Mendix modules, urging immediate updates per CISA advisory.

Key points

  • The vulnerability (CVE‑2026‑89209) affects Mendix SAML module versions prior to 4.2.4 for Mendix 10/11 and prior to 3.6.29 for Mendix 9, with a CVSS v3 score of 6.8.
  • Exploitation could let an unauthenticated remote attacker gain unauthorized access via IdP‑initiated SAML flows.
  • Siemens has released new module versions and recommends customers apply the updates and follow industrial security hardening guidelines.
  • CISA issued an advisory (ICSA‑26‑302‑01) and advises organizations to limit network exposure of control‑system devices.
  • The advisory emphasizes defensive measures such as firewalls, VPNs, and adherence to Siemens’ operational security guidelines.
Sources CISA Cybersecurity Advisories 1 articles

Apple's macOS developer tools still trust compromised eMudhra certificates, leaving git, curl and python vulnerable

1 source ¡ 1 article

macOS developer tools still trust compromised eMudhra roots, exposing git, curl and python3 to network interception.

Key points

  • Apple was alerted on 17 Oct about a breach of the eMudhra certificate authority; as of 28 Oct the bundled git, curl and python3 still trust the compromised roots.
  • macOS 27.2 released on 26 Oct reverted earlier manual mitigations, re‑exposing developers to potential credential theft and code tampering.
  • A simple test command can reveal whether a local git or curl installation is vulnerable; patched versions reject the forged certificates.
  • Apple has protected Safari but has not yet released an official fix for the developer‑tool chain, urging users to apply manual workarounds.
  • The vulnerability poses a supply‑chain risk for CI runners and other automated macOS build environments.
Sources we-have-a-problem.com 1 articles

Compromised eMudra Intermediate CA Keys Prompt Global TLS Block and Emergency Go Update

12 sources ¡ 17 articles

Eight eMudhra CA keys were weak single-byte values, leading to rapid compromise and browser revocation.

Key points

  • The researcher recovered all eight private keys, each consisting of a single non‑zero byte, from public certificates in under a second.
  • All affected intermediates were cross‑signed by Sectigo and were issued in April 2025, covering TLS and code‑signing use cases.
  • Chrome and Firefox blocked the intermediates via CRLSet and OneCRL, and later removed the eMudhra root from their trust stores.
  • The weakness stems from improperly generated P‑384 private keys with 47 leading zero bytes, making brute‑force trivial.
  • Non‑browser TLS clients that do not enforce Certificate Transparency remain vulnerable to misuse of these CAs.
Sources scotthelme.co.uk apple.com Bleeping Computer arstechnica.com CSO Online CSO Online emudhra.com blog.google The Record by Recorded Future The Hacker News Cyberscoop SecurityWeek CSO Online Bleeping Computer The Hacker News Twitter/dcuthbert The Hacker News @hkashfi @dcuthbert 17 articles

Hitachi Energy issues CISA advisory for OS command injection and Dirty Frag flaws in CoreTec control system

1 source ¡ 1 article

CISA warns of unpatched command‑injection and Dirty Frag bugs in Hitachi Energy CoreTec control‑system software.

Key points

  • The advisory lists CoreTec5 versions up to 3.4.0 and 5.0.0, and CoreTec4 up to 3.4.0 as affected.
  • Both CVEs receive a CVSS v3 score of 8.8, indicating high severity.
  • Exploitation could impact the confidentiality, integrity and availability of industrial control environments in the energy sector.
  • Hitachi Energy and CISA recommend minimizing internet exposure, using firewalls, VPNs and strict password policies as mitigations.
  • No vendor‑issued patch or fix is currently available; organizations must rely on defensive controls.
Sources CISA Cybersecurity Advisories 1 articles

Hitachi Energy TRO600 series devices affected by two critical RCE vulnerabilities

1 source ¡ 1 article

Two critical RCE flaws in Hitachi Energy TRO600 devices prompt CISA advisory for urgent mitigation.

Key points

  • Two CVEs (2026‑10756, 2026‑106087) affect TRO600 firmware versions up to 9.2.1.6 and 9.1.1.0, with a CVSS score of 7.5.
  • The flaws enable remote code execution and exposure of sensitive information on industrial control systems.
  • CISA recommends network isolation, firewalling, and VPN use to reduce exploitation risk.
  • Hitachi Energy’s internal team reported the issues to CISA; no patch is currently available.
  • The devices are deployed worldwide in the energy sector, a critical infrastructure domain.
Sources CISA Cybersecurity Advisories 1 articles

Electrum wallet patches vulnerability after malicious server exploit

1 source ¡ 1 article

Electrum patches a server‑side flaw that was used to trick users into signing inflated‑fee transactions, causing financial loss.

Key points

  • A malicious Electrum server could inject a fake payment and increase the transaction fee before the user signed it.
  • Developers confirmed the vulnerability was being exploited in the wild.
  • One user reported losing money due to the attack.
  • Electrum has now issued a patch to mitigate the issue.
Sources thedefiant.io 1 articles

Zero-Day Code Injection RCE Found in Ultralytics parse_model Function

1 source ¡ 1 article

A zero‑day RCE in Ultralytics' parse_model function enables remote code execution without a patch.

Key points

  • The flaw stems from insufficient validation of user‑supplied strings before they are executed as Python code in the parse_model routine.
  • Exploitation requires the target to visit a malicious webpage or open a crafted file, providing remote code execution in the user’s context.
  • ZDI reported the issue to Ultralytics in June 2026 and announced public disclosure in October 2026 as a zero‑day advisory.
  • No vendor‑issued patch or mitigation exists beyond limiting interaction with the affected component.
  • Credit for discovery goes to researcher Bongeun Koo.
Sources ZDI Published Advisories 1 articles

Zero-Day Code Injection RCE Found in Ultralytics parse_model Function

1 source ¡ 1 article

ZDI reports a zero‑day RCE flaw in Ultralytics' parse_model function that can be triggered by malicious web pages or files.

Key points

  • The flaw stems from insufficient validation of user‑supplied strings before they are executed as Python code in the parse_model routine.
  • Exploitation requires minimal user interaction: visiting a malicious URL or opening a malicious file.
  • Ultralytics has not released a fix; ZDI recommends limiting exposure to the affected component.
  • The advisory was coordinated and publicly released on 2026‑10‑28 after multiple update requests to the vendor.
  • Research credit is given to Bongeun Koo (@kiddo_pwn).
Sources ZDI Published Advisories 1 articles

Zero-Day Command Injection in Ultralytics torch_safe_load Enables Remote Code Execution

1 source ¡ 1 article

A newly disclosed zero‑day in Ultralytics' torch_safe_load function allows remote code execution via command injection.

Key points

  • The vulnerability requires user interaction, such as loading a malicious webpage or file, to trigger the exploit.
  • It resides in the torch_safe_load function, which fails to sanitize input before invoking a system command.
  • ZDI reported the issue to Ultralytics in June 2026 and announced public disclosure in October 2026 as a 0‑day advisory.
  • No vendor‑provided fix or patch exists; the only mitigation is to restrict user interaction with the library.
  • Research credit is given to Bongeun Koo (kiddo_pwn).
Sources ZDI Published Advisories 1 articles

Zero-Day Code Injection RCE Found in Ultralytics check_det_dataset Function

1 source ¡ 1 article

A zero‑day RCE flaw in Ultralytics' check_det_dataset function enables remote code execution via unsanitized input.

Key points

  • The vulnerability allows an attacker to run arbitrary Python code in the context of the current user on systems running Ultralytics.
  • Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file.
  • ZDI reported the issue to Ultralytics in June 2026 and announced public disclosure in October 2026 as a 0‑day advisory.
  • Mitigation guidance is limited to restricting user interaction with the affected product.
  • The advisory credits researcher Bongeun Koo for discovery.
Sources ZDI Published Advisories 1 articles

Zero-Day Remote Code Execution in Alpine iLX-F511 Framework Service Disclosed

1 source ¡ 1 article

ZDI reports a zero‑day RCE vulnerability in Alpine iLX‑F511’s framework service that allows unauthenticated root code execution.

Key points

  • The vulnerability affects Alpine iLX‑F511 devices and can be exploited by network‑adjacent attackers without authentication.
  • Exploitation grants arbitrary code execution with root privileges via an exposed dangerous function in the framework service.
  • ZDI notified the vendor in February 2026, but as of the advisory release on 28 Oct 2026 no fix has been issued.
  • Mitigation guidance is limited to blocking network interaction with the affected product.
  • The advisory was authored by researchers from Compass Security and is publicly available through ZDI.
Sources ZDI Published Advisories 1 articles

Zero-Day SSH Hard-Coded Credential Flaw Enables Remote Code Execution on Alpine iLX-F511 Devices

1 source ¡ 1 article

A zero‑day SSH credential flaw in Alpine iLX-F511 permits unauthenticated remote code execution, with no fix yet released.

Key points

  • The flaw resides in the SSH daemon of Alpine iLX-F511 devices, where hard‑coded credentials grant access without authentication.
  • Exploitation enables execution of arbitrary code under the telechips system account.
  • ZDI reported the issue in February 2026, but the vendor has not provided a patch as of the October 2026 advisory.
  • Mitigation is limited to restricting network access to the affected product.
  • The advisory was authored by Sina Kheirkhah of the Summoning Team and published as a zero‑day advisory.
Sources ZDI Published Advisories 1 articles

Zero-Day Remote Code Execution Flaw Discovered in Ultralytics torch_load Deserialization

1 source ¡ 1 article

A zero‑day RCE vulnerability in Ultralytics' torch_load function enables attackers to run code via malicious data, with mitigation limited to usage restrictions.

Key points

  • The flaw resides in the torch_load function, which deserializes untrusted data without proper validation.
  • Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file.
  • ZDI disclosed the issue on 2026‑10‑28 after multiple update requests to the vendor.
  • No vendor‑provided patch or fix is currently available; the advisory recommends restricting product interaction.
  • The advisory is classified as a zero‑day, with no known active exploitation in the wild.
Sources ZDI Published Advisories 1 articles

Zero-day heap overflow in Alpine iLX-F511 Bluetooth OBEX handling enables remote code execution

1 source ¡ 1 article

Alpine iLX-F511 Bluetooth OBEX processing contains a zero‑day heap overflow that allows unauthenticated remote code execution.

Key points

  • The flaw resides in the Bluetooth OBEX packet parser, which fails to validate user‑supplied length before copying data to a heap buffer.
  • Exploitation requires physical proximity to the device and does not need authentication.
  • Root‑level code execution can be achieved by crafted OBEX packets.
  • Vendor has not released a fix; mitigation is to block Bluetooth interactions with the product.
  • The advisory was publicly released on 2026‑10‑28 after a coordinated disclosure timeline.
Sources ZDI Published Advisories 1 articles