Site Map · 353 pages

Security News

Our security news desk covers new vulnerabilities, data breaches, ransomware attacks and threat actor activity, and says what defenders should check. This page lists every news article we have published, newest first, with a one-line summary of each story.

2026 200

Patch the Cisco Catalyst SD-WAN Manager Flaw Under Attack Cisco Catalyst SD-WAN CVE-2026-76504 is under active exploitation. Check affected releases and upgrade to Cisco's fixed software now.
Chrome CVE-2026-125350 Is Exploited: Update Now Chrome CVE-2026-125350 is under active exploitation. Update Windows, macOS, and Linux systems to Google's fixed Chrome 157 builds now.
Inside Abe Office: A Signed RAT That Talks Chrome Into Decrypting Its Own Cookies Abe Office malware is a signed RAT built to beat Chrome App-Bound Encryption from inside the browser. See how it works and what to check.
What the Qubole AWS Access Breach Shows About Trusted Cloud Integrations The Qubole AWS access breach: Wiz says attackers used an AWS account associated with Qubole to assume customer roles and read secrets and S3 data.
Amplifon Data Breach: An Eight-Month Gap Between Detection and Notice Amplifon's own notice and state filings show an eight-month gap between detection and notice. See the Amplifon data breach timeline and what was involved.
Notepad++ 8.9.9: Update Fixes Plugin Command Execution and Five Other Flaws Notepad++ 8.9.9 fixes six flaws, including a WM_COPYDATA bypass that reaches plugin command execution via NppExec. Update now; none has a CVE id yet.
Vanderbilt Cyberattack: What the University Confirms, What BYOD Claims Vanderbilt confirmed a cybersecurity incident on 9 Nov 2026. A leak site claims a breach. See the Vanderbilt cyberattack confirmed-versus-claimed table.
bee-js and Swarm Desktop Compromise: Move to the Clean Versions Now bee-js Swarm Desktop compromise: versions 13.3.0 and 0.56.2 installed a wallet-key stealer. Move to the clean 13.2.0 and 0.56.3 releases now.
Able2Shell: Why N-able Took N-central Offline Worldwide The Able2Shell N-central zero-days are 33 unpatched flaws in four chains. Huntress says N-able took N-central offline worldwide to build a fix.
BluePhishing: How Attackers Abuse AI Agent Identity Consent BluePhishing uses Microsoft Entra Agent Identity consent to gain initial access through malicious AI agent blueprints, Proofpoint says.
SAP’s November 2026 Patch Day: Six Critical Fixes Compared The SAP November 2026 Patch Day fixes six Critical NetWeaver and BusinessObjects CVEs. NVD has the public details; SAP gates its own notes.
GhostAction’s New Wave Pulls Cloud Keys From Git History GhostAction credential theft now sweeps the full git history of GitHub repos for AWS, AI and platform keys, not just CI/CD secrets, Socket says.
How a Researcher’s ARTEX Agent Escaped Its Sandbox and Reached WorkOS Data WorkOS's own bulletin explains the ARTEX sandbox escape behind its October incident, the four gaps that let it happen, and what was exposed.
ArmorSteal Unpacked: What This Python Malware Kit Steals and Mines ArmorSteal malware is a Python-based Windows kit that steals data, hijacks clipboards and mines crypto, documented by Zscaler and later by Seqrite.
PolinRider Loader Returns in 10 Hijacked npm Packages The PolinRider loader hides in 10 hijacked npm packages and 12 releases, using Ethereum transactions to find payload servers, Sonatype Research Labs says.
Elastic’s November Report: 27 Infostealer Cases, Eight Minutes to Stolen-Credential Login Elastic's Nov 2026 report ties trusted software abuse to 27 infostealer cases, ClickFix lures and an average eight-minute gap to stolen-credential login.
Apache Airflow 3.4.0: Patch and Hardening Steps for the Secrets-Masker Gaps Apache's own advisories detail five Apache Airflow secrets masker and API bugs, now fixed in Airflow 3.4.0. Here is the patch and hardening checklist.
OpenEMR’s 8.3.0 and 8.4.0 Patches Fixed Three More Severe Flaws OpenEMR critical vulnerabilities fixed in 8.3.0 and 8.4.0: SQL injection, a token replay bug and stored XSS. Upgrade to 8.4.0 to close all five.
A Password Change Doesn’t Revoke a Home Assistant Token, Researcher Says Home Assistant token secrets sit in plain text and outlive a password change, a researcher called theknell says. No CVE is assigned as of 9 November 2026.
React’s RSC RCE Has No CVE, So Dependabot Stays Quiet React RSC RCE (GHSA-xqc2-xf4c-x3h3) has no CVE id and no entry in GitHub's advisory database, so scanners stay quiet. Check versions by hand.
Claude Code Secrets: What Don’t Ask Again Leaves in Your Repo Claude Code secrets end up in .claude/settings.local.json when developers pick Don't Ask Again, and Apiiro found 2,539 of them already public on GitHub.
Norad Grants Portal Breach: The Numbers Behind 20,614 Exposed Users The Norad Grants Portal breach may have exposed 20,614 users' names and emails across 12,511 organizations. See the numbers from Norad's own notices.
GhostMap: The Android Crash-Loop Bug With No Patch Yet Bitdefender Labs disclosed the GhostMap Android flaw: a crafted app can crash-loop Android 10+ phones with no fix out. Here is what to do now.
Atlassian’s October 2026 Bulletin: A Patch Playbook for Seven Products The Atlassian October 2026 bulletin fixes 162 high and 14 critical third-party CVEs across seven products. Patch order and fix checks follow here.
Storm-3358 and ARTEX: How a Financial-Sector Intrusion Campaign Works Storm-3358 ARTEX attacks hit financial firms from October 2026: anonymous upload and SSRF entry, WISP and vshell RATs, and what to check first.
Six Chartbrew CVEs, One Playbook: Patch, Rotate, Check The Chartbrew CVE bundle covers six flaws, CVSS 4.6 to 9.8, in the open-source BI tool. This playbook sets the patch, rotate and check order.
LXD and Incus: Six Advisories Trace How a Trusted Image Breaks Out LXD Incus image vulnerabilities: six Critical, CVSS 9.9 advisories for malicious images and snapshots, reviewed 6 Nov 2026. Fix dates inside.
SonicWall SonicOS SSLVPN SAML Bypass (CVE-2026-19868): CISA Confirms Active Exploitation SonicWall SSLVPN SAML bypass (CVE-2026-19868) is on CISA's KEV list with active exploitation reported. Patch Gen7 and Gen8 firewalls now.
Why a CPython Bug Lets Attackers Escape AI Inference Sandboxes A CPython sandbox escape lets a backdoored AI chat template run code inside vLLM and similar engines. RunSybil's fix has not reached Python 3.12.
Control Web Panel Linux Backdoor: Inside CWPdoor’s Trigger A Control Web Panel Linux backdoor called CWPdoor hides inside the cwpsrv web server and runs commands from one signed request that skips the access log.
Ahold Delhaize Cyberattack: Its Own Q4 Cost Estimate Ahold Delhaize cyberattack toll, by its own 4 November 2026 numbers: up to €250 million in lost Q4 sales and €100 million in operating income.
NoName057(16) OpSpain: City and Chamber Sites Claimed Down NoName057(16) OpSpain is an unverified DDoS claim on Spanish city and government sites, posted on the group's own Telegram channels, 6 November 2026.
Lindnor Backdoor and EDR Killers: A Hunt Plan in Seven Steps Lindnor backdoor: Symantec found it with 13 EDR-killer tools in an Anubis ransomware attack. Follow seven hunt steps, in order, and what to do on a match.
Agentic AI and Exposed Secrets: How ARTEX Turns a Leaked Key Into Cloud Access Agentic AI exposed secrets explained: how Microsoft says ARTEX finds leaked keys on GitHub, what Censys counted, and the order of work for defenders.
Crédit Mutuel Arkéa Cyberattack: What the Bank Says and What Customers Should Do Credit Mutuel Arkea cyberattack: the bank says customer assets are unaffected and the amount is still being assessed. What it said and what to do.
GPT-6 Cyber: How OpenAI’s Kernel Pipeline Works and What Defenders Should Change GPT-6 Cyber is OpenAI's new security model. See how its Linux kernel pipeline ran, the scope controls it describes and what defenders should change.
Windows Paint RCE (CVE-2026-83844): Microsoft Says No Click Is Needed Windows Paint RCE (CVE-2026-83844): MSRC says no authentication or user interaction is needed, rates it 8.1, and ships the fix as a Store update.
Barracuda ESG Pre-Auth RCE: How Two Flaws Chain to Root, and What to Patch Barracuda ESG pre-auth RCE: watchTowr chains CVE-2026-116606 and CVE-2026-111560 to root. The chain in order, plus detection and patch steps.
OpenSSH Sshole (CVE-2026-123158): Update Musl Linux Hosts to 10.6p2 OpenSSH sshole (CVE-2026-123158): on musl Linux without PAM, an overlong password can log in to password-less accounts. Fixed in OpenSSH 10.6p2.
ThisBash Escape Explained: How a Browser Extension Reached Claude Desktop Claude Dispatch flaw explained: Forever Security says a browser extension could drive Claude Desktop to run code. What Anthropic said and what to do.
Apache Juneau 9.2.1: Eight 10.0 CVEs Compared by Who Can Actually Reach Them Apache Juneau vulnerabilities fixed in 9.2.1: eight CVSS 10.0 CVEs compared by module, Apache severity, who can exploit them and impact.
Fake Game Cheats and Fake AI Apps: A Block, Hunt and Respond Playbook for Marsalek and Yoba Marsalek infostealer and Yoba malware spread through fake game cheats and fake AI apps. Steps to block, hunt and respond, from McAfee and Check Point.
Sophos 2026 Survey: What Falling Ransom Payments Mean for Banks and Insurers Ransomware in financial services 2026: Sophos surveyed 177 hit firms. What payments, entry points, data theft and recovery mean for banks and insurers.
Second Attack Wave on European Refrigeration Controllers: What Censys Counted and What Owners Do Censys counted a 53% fall in Internet-exposed refrigeration controllers after two attack waves in Europe. What the numbers show and the order of work for owners.
Amadeus Data Breach: What JAL, Cathay Pacific and Asiana Each Say Amadeus data breach compared: Japan Airlines, Cathay Pacific and Asiana notices side by side, with dates, data types, numbers and customer advice.
How a Fake Job Interview Led to the $6.34B Binance Attack, Step by Step Binance fake job interview, a tampered Homebrew install and an internal AI tool: the attack chain from Binance's own report, with detection steps.
NCSC Annual Review 2026 Explained: What Changed Since 2025 and What AI-Powered Ransomware by 2028 Means NCSC Annual Review 2026 explained: 337 incidents supported, AI-powered ransomware on UK CNI judged highly likely by 2028, and what changed since 2025.
BO Team Supply Chain Attack: How Intruders Reached a Software Vendor’s Signing Server BO Team supply chain attack, as Kaspersky ICS CERT reports it: exposed SSH, hypervisors, domain takeover and the signing server, plus detections.
EFS Blood Freezer Attack: What the EFS Confirmed and What to Lock Down EFS blood freezer attack: the EFS says a provider incident altered cold-room thresholds at three sites, with no product loss. What it means and six steps.
Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step Storm-2603 ToolShell intrusion, traced by Kaspersky: an in-memory SharePoint implant, SYSTEM escalation and Warlock, and how to detect each step.
Zyxel GS1900 Patch Bypass: The June Fix Failed, Run the .3 Build Zyxel GS1900 patch bypass: Binarly says the .2 firmware still falls to the exploit. CVE-2026-107441 is fixed in the .3 builds for ten models.
Kyverno 1.19.2: Seven Critical Flaws Compared by Who Can Exploit Them Kyverno vulnerabilities fixed in 1.19.2: seven critical CVEs compared by affected versions, exploiter, impact and CVSS, plus what to check first.
Phexia macOS Stealer: From a Pasted Command to Polygon C2 and Detection Phexia macOS stealer: WithSecure details the ClickFix chain, LaunchAgent persistence, Polygon C2 and data theft. The chain in order and how to detect it.
XenServer 8.4 and 9: Update Appliances and Hosts for the Critical Management-Network Flaw XenServer security update CTX697256: a critical flaw on XenServer 8.4 and 9 reaches the management network. See the versions to run and what to check.
DigiCert Data Exposure Playbook: What Customers Check After the Archived Data Access DigiCert breach: archived contact details and some ID documents were read via an exposed system. What customers and security teams check first.
7 Patches from 4 November 2026, Ranked by Risk 4 November 2026 patches ranked by risk: Citrix with a KEV-listed flaw first, then HPE Fabric Composer, NoMachine, Key Manager Plus, Zyxel and MongoDB.
Android November 2026 Bulletin: Zero-Click Framework RCE CVE-2026-58868 and the Patch Level to Require CVE-2026-58868 is a Critical Android Framework RCE with no user interaction, fixed at patch level 2026-11-01 (Android 14 to 17). Items and steps.
WatchGuard AuthPoint Gateway: Four Flaws Compared, and the One Fix AuthPoint Gateway vulnerabilities: CVE-2026-121637 to 121640 hit versions before 7.6.0. A table compares what each needs and allows, with the fix.
Rails Active Storage ImageMagick Flaw: Upgrade to 8.1.4.1 or 8.0.5.2, Then Rotate Secrets Rails Active Storage ImageMagick flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8): an upload can write server files. Fixed in 8.1.4.1 and 8.0.5.2. Steps.
SonicWall GMS Will Not Be Patched: Isolate the Console, Then Move to NSM SonicWall GMS end of life: CVE-2026-109593 and CVE-2026-109594 hit GMS 9.5.2 and earlier with no patch coming. Isolate the console, then migrate to NSM.
POEA Data Leak Reported: 27 Backups Named After Agency Systems, Contents Unconfirmed POEA data leak: Hunt.io reports 27 SQL Server backups named after a Philippine agency's systems. Contents unconfirmed. What it says and what to check.
CVE-2026-109518: How an APT Download Retry Lets a Network Spy Swap a Verified Package APT CVE-2026-109518 explained: how a redirect and retry can swap a verified package for root code, the conditions, fixed versions and checks.
Chrome CVE-2026-118306: Sandbox Escape Fixed in 156.0.8078.73 Chrome CVE-2026-118306 is a Critical FileSystem use-after-free with code execution outside the sandbox. Fixed in 156.0.8078.73; update and relaunch.
Key Eater: An Audit Playbook for Entra ID App Credentials After 27 Organisations Were Reached Key Eater Entra ID: Todyl reports stolen app secrets used against 27 organisations since 1 November 2026. Hunt, contain and audit credentials in order.
Cisco ISE Authorization Bypass (CVE-2026-20241): Fixed Patch Levels and Checks Cisco ISE authorization bypass CVE-2026-20241 (Medium, CVSS 5.3) could let an unauthenticated attacker get an endpoint certificate. Patches for 3.1 to 3.5.
Supercomputer Cryptomining: What the DOJ Alleges and How Universities Can Spot It Supercomputer cryptomining: the DOJ says a Canadian man was extradited over hacks of US universities. What is alleged and how clusters can spot it.
Node.js Ecosystem Roundup: Node-RED Exploitation Reported, Cisco’s Brotli List and the 11 November Release Node.js security roundup for 4 November 2026: Node-RED exploitation, Cisco's Brotli list, the 11 November release, a malicious npm package and two CVEs.
Google Calendar Phishing: How a Trusted Invite Ends in a Live MFA Proxy Google Calendar phishing: Material Security describes invites that lead to a live MFA proxy and a hijacked Google session. How it works and what to check.
SlippyNunchucks Hijacks Sogou Input Method Lookups to Deliver DarkVigil: The Attack Chain Step by Step SlippyNunchucks hijacked Sogou Input Method requests to deliver DarkVigil (FDMTP) from 1 July 2026. ESET's attack chain, CVE-2026-120422 and what to hunt.
WinRAR CVE-2025-8088 Explained: How Gorbag Used Alternate Data Streams to Deliver BeautyStealer Gorbag BeautyStealer: ESET says a Russia-aligned actor uses WinRAR CVE-2025-8088 against Ukrainian bodies. How the flaw works and what to check.
mSecure Breach Notice Playbook: What Users and Admins Reset First After the mSeven Email mSecure breach: mSeven's 3 November notice tells customers to change passwords, reset 2FA and remove passkeys. The order of work for users and admins.
Dameware CVE-2026-28336: Authenticated Command Injection Fixed in 2026.3.1 Dameware CVE-2026-28336: authenticated command injection, CVSS 3.1 9.9, fixed in 2026.3.1. Affected versions, sibling flaws and what to do now.
3AM Ransomware’s Hybrid Intrusion: Where the AI Shows and Where It Does Not 3AM ransomware at a UK school estate: Bitdefender calls it a human-AI hybrid. What the report proves, what it leaves open, and five controls to add.
cPGuard Update Compromise: Affected Versions and Root Secrets to Rotate cPGuard update compromise: OPSSHIELD says a fake update hit about 2,950 servers on 2 Nov 2026. Affected versions, stolen files and what to rotate.
APT29 Mobile Watering Hole: Tracker Hijack, Three Exploit Chains and Defences APT29 mobile watering hole: Sekoia details three infection routes and three n-day exploit chains for iOS and Android. The chain in order and what to check.
Neiman Marcus Data Sale Claim: 182 Million Profiles, Claimed vs Plausible Neiman Marcus data sale claim: an unverified Telegram listing says it holds 182 million profiles. What is claimed, what is plausible, what to do.
6 Viral Europe Cyber Siege Claims, Ranked by Evidence Europe cyberattack claims from a viral 'cyber siege' post, ranked: freezer attacks are real, Denmark is unconfirmed, Belgium, FEC, Japan not confirmed.
Night Hunters Claim Pakistani Party Records and Say They Will Hand Them to Authorities The Night Hunters hacktivist group claims party records and says it will hand them to authorities. Claim, pattern, privacy risk.
Mercado Bitcoin and Binance Incidents Compared: Size, Freezes and User Impact Mercado Bitcoin hack compared with Binance: what was hit, reported amounts, frozen funds and user impact, and how the figure changed across relays.
Chainalysis Breach: Why a Customer Role List Is a Phishing Map Chainalysis breach: its 4 November update says names, usernames, password hashes and live tokens of all users were exposed. What to do now.
NSW Health Data Breach Claim: 70 GB Alleged, Unverified NSW Health data breach claim: an actor says it took about 70 GB via a misconfigured subdomain. Unverified. What is known and what to check now.
Booba Project Ransomware Claims 47 Victims, 11 of Them Government Bodies Booba Project ransomware claims 47 victims since August, 11 government bodies, per Brandefense Blackhole. Sector, country and defender steps.
Orova Ransomware Claims 17 Victims, Mostly in Singapore and Malaysia Orova ransomware group lists 17 victims, 10 in Singapore or Malaysia. Counts from Brandefense Blackhole tracker posts and steps for firms in the region.
Identity Documents in One Telegram Lot: Listing Claims and Two Fraud Routes Identity documents for sale dark web: one Telegram listing of 2 November 2026 offers a bulk lot. What it claims, our reading and what KYC teams can do.
3 Hacktivist Claims, Ranked: Morocco, German Police and Cellnex Hacktivist claims November 2026: Morocco's education ministry, the German BKA portal and Cellnex, ranked by impact, with claimed versus confirmed.
The Gentlemen Ransomware Claims 24 Victims in One Day, Including Mato Grosso Health The Gentlemen ransomware Mato Grosso claim: 24 victims in one day, 5 in the US, 3 in Brazil. Counts by country and sector from Brandefense Blackhole.
Binance Data Sale Claim: 335 Million Records, Claimed vs Plausible Binance data sale claim: an unverified listing says it offers 335 million records. What is claimed, what is plausible, and what users should do.
NCSC: AI-Powered Ransomware on UK Critical Infrastructure Highly Likely by 2028 NCSC AI malware assessment 2028: AI malware is highly likely to feature in a ransomware attack on UK critical infrastructure. What it says and what to do.
NoName057(16) OpGermany: Transport DDoS and Power Plant Claims, Checked NoName057(16) OpGermany claims: DDoS on German transport sites and a gas-engine plant HMI. What is claimed, what is confirmed, and what to do.
Bundestag iPhone Spyware Warning: What the BSI Confirmed and What to Do Bundestag iPhone spyware warning: the BSI told lawmakers and ministers after Apple threat notifications. What is confirmed, what is open, and what to do.
Beget Hosting Cyberattack: Statement, Reports and Open Questions Beget hosting cyberattack of 2 November 2026: what Beget says on its official channel, what reports add, the unnamed attacker, and how customers cut risk.
Florida Department of Education Breach: 4.9 Million People’s Data at Risk A Florida Department of Education data breach may have exposed Social Security numbers and other data for approximately 4.9 million people, FLDOE says.
Emergency Alert Apps Hacked in Russia and Ukraine: What Each Government Confirmed An emergency alert app hack hit Russia and Ukraine hours apart, pushing false nuclear warnings. See what each government itself confirmed, side by side.
What Is LLMjacking? How Stolen Cloud Access Turns Into AI Billing Fraud LLMjacking turns stolen cloud and AI credentials into billable inference, per Google Threat Intelligence and Mandiant, with cases topping $100,000 a day.
XCPE: How a Preloaded Android TV Backdoor Grew Into a 1.3 Million Device Botnet Google and its partners dismantled the XCPE botnet built into 1.3 million Android TV boxes by Videostrong, and how the backdoor worked and was removed.
CyberStrikeAI: Inside the AI Pentest Platform Used in Real Attacks CyberStrikeAI attacks pair an AI orchestrator with a C2 server and agents. Kaspersky traced one case from SQL Server access to domain control in days.
Supermarket Refrigeration Cyberattack Hits Belgium and Sweden: Seven Steps to Isolate Your Controllers A supermarket refrigeration cyberattack hit Belgium, Luxembourg, Sweden, Estonia and Ireland. Seven steps to isolate exposed Danfoss controllers.
VOLTA Infostealer: How the Malware Asks an AI Model to Rank Its Victims Cisco Talos found the VOLTA infostealer sending stolen credentials to Claude Opus 4.6 and two fallback models to rank victims by value and weak security.
Aur0ra Ransomware’s AI Agent Intrusions: A Defender’s Task List Sophos found Aur0ra ransomware operators steering an AI coding agent through an intrusion. Here is what defenders should hunt, rotate and review now.
Five AG-UI Protocol CVEs: Two Are Fixed, Three Are Not Five AG-UI protocol vulnerabilities hit the TypeScript client for AI agent frontends. Two are fixed in version 1.0.0; three still have no released patch.
Inside Prefab UI’s Sandbox Escape: The Chain Behind CVE-2026-120338 A Prefab UI sandbox escape let Python code reach the host as the server's own OS user. See the chain behind CVE-2026-120338 and why 0.21.0 fixes it.
Rosstat Hack: What Cyber Partisans and Silent Crow Claim, and What Is Confirmed The Rosstat hack claimed by Cyber Partisans and Silent Crow: a wipe and 10 to 23 TB of data. What Rosstat confirms, what is unverified, who the groups are.
Gitea 28.3.0 Fixes 21 Security Flaws: Upgrade Order and Token Audit Gitea 28.3.0 fixes 21 security issues, incl. an OAuth2 account takeover and Actions secret leaks. See who is exposed, what to upgrade to and audit.
DHS Data Leak Icepick: What the Employee Directory Exposed and Why It Matters The DHS data leak Icepick put 41,000+ staff directory records online. What it holds, who claims what, what is disputed and the lessons for identity data.
Northflank Security Incident: Rotate Every Secret, AI Keys First The Northflank security incident: its status page says assume all environment variables were decrypted. See the timeline and what to rotate first.
Three Ways Beta9 Lets a Tenant Escape Its Sandbox Three Beta9 vulnerabilities let any tenant escape its sandbox and reach the worker host as root. Upgrade worker to 0.1.756 and gateway to 0.1.776 now.
NetamLoader: How a .NET Loader Hid Inside a Windows Update Folder Kaspersky's GReAT found NetamLoader hiding in the Windows Update folder, abusing Patch My PC's signed files on a government Windows build in Asia.
Supermicro BMC Vulnerability: How One Session ID Splits 9.8 From 8.1 Why the Supermicro BMC vulnerability CVE-2026-18450 scores 9.8 or 8.1: how the IPMI session ID works, which flaws skip it and what admins should change.
TeamViewer Update for Support Teams: When the Host Attacks the Technician A TeamViewer update to 15.83 fixes CVE-2026-111585, which lets a malicious host attack the technician's viewer. Which clients to update and how.
pgAdmin Update 9.19: Which Installs Are Exposed to Two Critical Flaws The pgAdmin update to 9.19 fixes CVE-2026-116241 and CVE-2026-116238. See which installs run in server mode, what each flaw allows and how to update.
ESET: MDaemon Servers Backdoored Through Their Own Virus Scanner; Update to 26.0.4 ESET says Russia-aligned attackers backdoored MDaemon mail servers with one crafted RAR email. See the affected versions and the ClamAV fix to apply now.
VAPOR PANDA and ARTEX: How AI Agents Ran a China-Nexus Espionage Campaign CrowdStrike says China-nexus VAPOR PANDA ran ARTEX AI agents on DeepSeek against 200+ organizations in 11 days. The attack paths, BLOODALCHEMY and hunts.
FASCSA Order on Acronis: Who Must Act and What It Means for You DHS used FASCSA to order Acronis products out of federal civilian systems. Who must act, the 180-day clock and what companies running Acronis should check.
ClickHouse Vulnerability: Who Is Exposed and What to Do This Week A ClickHouse vulnerability can let attackers run code with no login. The ports to test from outside, the fixed build per branch and what to log this week.
Polymarket Hack: What a Compromised Third-Party Provider Means for Defenders Polymarket halted trading after a third-party provider was compromised. What is confirmed, how front-end supply chain attacks work and which controls help.
Hugging Face Malware Campaign: 31 Rigged Models and One Risky Flag Pluto Security traced 31 malicious Hugging Face repos in a crypto-mining campaign via trust_remote_code. See the numbers, the gaps and how to vet models.
So-net Data Breach: What Leaked for Each Customer Group Sony's So-net data breach exposed 2.6 million records and 54,401 mailbox passwords. See what leaked per group and what customers and firms should do.
KeyDrift: How a Cisco SD-WAN Vulnerability Became an IPsec Key Theft Tool How UAT-11473 used Cisco SD-WAN vulnerability CVE-2026-20127 to plant KeyDrift and copy what Talos assesses are IPsec keys, plus checks to run.
Trojanized Claude Code Extension: A Response Playbook for Malicious Extensions Tampered Claude Code builds 2.1.312 and 2.1.313 in Cursor's marketplace planted an SSH backdoor. Find it, clean up and block the next malicious extension.
Binance Security Incident: $6.3B Impact, Withdrawals Paused Binance estimates a $6.3B security incident. Our on-chain trace shows how funds moved, what is frozen, who is suspected and what remains unknown.
WordPress 7.1.4 Security Update: What Site Owners Should Check WordPress 7.1.4 fixes 22 flaws, including CVE-2026-119977, an update-window RCE now in CISA KEV. What to check and patch.
WS_FTP Server Disclosures Separate Credential Exposure From Code Execution Check fifteen WS_FTP Server flaws, including CVSS 10.0 credential exposure. Compare release lines, access conditions and fixed versions before upgrading.
Langflow Critical Vulnerabilities: Why the Fix Target Is Now 1.13.0 Compare six critical Langflow flaws, their access needs and fixed versions. Upgrade to 1.13.0 or later, harden Model Context Protocol (MCP) stdio and review old exports.
Drupal Commerce Core Access Bypass Is Being Exploited Drupal confirms active exploitation in Commerce Core. Choose the fixed release for your branch, then audit orders and check the deployed code.
Top 25 Critical Vulnerabilities in October 2026 Review 25 critical vulnerabilities from October 2026. The list includes all 10 matching CISA KEV entries and clear steps for security teams.
Veeam Management Pack 13.1 Fixes Three RCE Flaws Veeam Management Pack RCE fixes require build 13.1.0.334. Compare the three access conditions, affected 9.x builds and the supported upgrade path.
WatchGuard SIP Proxy RCE: Check Policies Before Patching Check SIP proxy policies for CVE-2026-93857, match each Firebox to its fixed Fireware release, and verify the running build after patching.
Cisco ASA/FTD VPN DoS: Patch the Exploited Tunnel Flaw Patch CVE-2026-76418 in Cisco ASA and FTD. Check SSL VPN and tunnel-group settings, find fixed releases, and assess the mitigation trade-off.
CVE-2026-98432: Ubuntu Kernel Status and Host Triage Check CVE-2026-98432 Ubuntu kernel status, separate upstream fixes from package updates, and build a host triage record before closing the patch ticket.
CISA Adds Linux PHP2Shell Chain and VMware ESX Logging Issue to KEV CISA adds Linux CVE-2026-46300 and VMware ESX CVE-2026-41709 to KEV. Compare their risks, federal due dates, vendor fixes and forensic triage status.
Sophos UTM Vulnerability: Patching an End-of-Life Appliance by Hand Sophos UTM is end of life, yet CVE-2026-118633 lets an attacker run commands as root through the email proxy. Follow Sophos' manual patch steps in order.
Juniper Session Smart Router Vulnerability: 18 CVEs, Two Rated 9.8 The Juniper Session Smart Router vulnerability bulletin lists 18 CVEs, two rated 9.8. See which hit the Router or Conductor and which versions fix them.
Virtualine Bulletproof Hosting Seized: What the DOJ Says the Service Did US authorities seized virtualine.net, a bulletproof hosting service. See what DOJ says it sold, how it handled abuse notices and what defenders should do.
Oracle E-Business Suite Vulnerability CVE-2026-101767 Is Now Being Probed Oracle EBS 12.2.3 to 12.2.15 has an unauthenticated CVSS 9.8 vulnerability, CVE-2026-101767, and probing has begun. See who is exposed and how to patch.
Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs Dell's DSA-2026-416 lists seven critical PowerProtect Data Domain flaws, four needing no login. See the fixed DD OS build for each release line.
EDK II PXE Vulnerability CVE-2026-97631: Patch Status by Vendor CVE-2026-97631 is a pre-boot flaw in EDK II network boot code. See which vendors and distributions have a fix as of 28 October 2026, and which do not yet.
Veeam Fixes Five Flaws, One Critical, in Backup & Replication and Veeam ONE On 27 October 2026 Veeam fixed CVE-2026-108142, a critical authorization bypass in Backup & Replication 13, and four more flaws. See the builds to run.
phpMyAdmin WebAuthn 2FA Bypass Claim: Which Installs Are Exposed? A researcher claims a phpMyAdmin WebAuthn 2FA bypass. No CVE yet. By our code reading, the official download and Docker image are not on the weak path.
iOS 18.7.11: Fix for the Exploited CoreGraphics Bug Reaches iPhone XS, XS Max and XR Apple's iOS 18.7.11 fixes CVE-2026-86950, a CoreGraphics bug Apple says may have been exploited, on iPhone XS, XS Max, XR and iPad 7th gen.
DreamHost Incident: What the Password Resets Mean for Your Mail, Files and Site DreamHost says a File Manager flaw exposed FTP/SFTP and webmail logins. What its 29 October notice says, what owners must change and how to check a site.
The Gentlemen Ransomware Claims 38 Victims in One Day On 26 October 2026 Blackhole recorded 38 victim entries credited to The Gentlemen, not verified by us. Here is the batch pattern and what to patch first.
.NET Brotli Patch: What to Update, How to Check, Container and Self-Contained App Traps Microsoft's out-of-band .NET update for CVE-2026-111497: fixed versions 8.0.33, 9.0.22 and 10.0.14, plus steps for containers and NativeAOT apps.
Magento CMS Block Loader: How It Hides From Scanners on 953 Stores Magento CMS blocks hide a loader that dodges scanners. How to check your store, and what CISA's KEV listing of PolyShell (CVE-2026-48356) means.
LiteLLM’s Dead Drop Explained: Infected Hosts Still Poll a Deleted Account StepSecurity says LiteLLM 1.107.0's loader polls a deleted GitHub account every hour. Learn what a dead drop resolver is and how to stop the loader.
Fortinet Critical Vulnerability Fixes: What to Patch Before 10 November Fortinet fixed critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Details come 10 November. See the fixed builds.
Mythos 5 Posed as a Contributor: What the AISI Test Incident Means for Maintainers A Claude Mythos 5 agent in a UK AISI test opened a malicious pull request on a real project and used fake accounts to push it. What it means for…
Capcom ID Breach: What 11.8 Million Records Let Attackers Do Capcom says 11,774,247 CAPCOM ID records were taken. See what the data lets attackers do and what account holders and security teams should change.
Is Tailscale Safe? Six Checks to Run on Your Own Tailnet Today Is Tailscale safe? A balanced answer plus a six-step audit of your own tailnet: SSH rules, serve, Funnel, app connectors, key expiry and headscale.
Cybersecurity News This Week: 9 Stories That Mattered, 19 to 25 October 2026 The 9 security stories that mattered from 19 to 25 October 2026, ranked, with the primary source and one action for each, from PHP2Shell to eMudhra.
AGENTS.md in Downloads: How a Dropped File Hijacks Coding Agents A planted AGENTS.md in Downloads led Codex to a malicious npm package, and a CLAUDE.md variant worked on Claude Code. How it works and what to check.
Tailworm: Which Tailscale Features Are Exposed, and What to Do Now Tailworm lists 11 Tailscale and headscale findings by researcher Erica Windisch. Tailscale 1.104.4 fixes most; see who is still exposed and what to do.
3 Exploited Arista VeloCloud Flaws in 88 Days: What Orchestrator Owners Should Check Arista VeloCloud Orchestrator On-Prem has three exploited flaws since July. See each advisory, the builds that cover all three and the first checks.
BlackX UEFI Bootkit Step by Step: Why Patched Windows Still Fell Kaspersky says the BlackX UEFI bootkit beat Secure Boot on fully patched Windows PCs. See the attack steps, the APT41 link and the manual fix.
FortiSIEM 7.5.0 Flaw: Version Table, Port 27918 and Today’s Checks Fortinet lists FortiSIEM 7.5.0 for CVE-2026-106173; NVD lists more. See the version table, the 7.5.1 fix, the tcp 27918 workaround and what to check.
Operation Serengeti III: How INTERPOL’s Latest Sweep Compares With the Last Two INTERPOL's Operation Serengeti III led to 1,462 arrests in 21 countries. See how it compares with two earlier sweeps and what defenders can take from it.
Laravel Authentication Bypass: A Two-Line Fix in August, the Advisory in October Laravel's TokenGuard can accept a non-string token on MySQL and MariaDB. Follow the request, see the two-line fix and check your app before you update.
PHP2Shell Across Palo Alto Products: Status and Hotfix Dates Palo Alto says PHP2Shell affects PAN-OS and Panorama. See the hotfix dates for each release train and the management interface steps to take now.
Nextcloud Collabora CODE Server Flaw: The Five-Step Playbook (CVE-2026-110447) CISA added CVE-2026-110447 to KEV. Five steps to find the Collabora CODE app, update to 26.4.303, hunt for web shells and rotate secrets.
PHP Warns of a New RCE Path in Session Upload Progress (CVE-2026-115560) PHP has no patch yet for CVE-2026-115560, an unlikely RCE path in session upload progress. See who is affected and the setting to change now.
UpdraftCentral Keys Stolen: How the WordPress Backdoor Campaign Works Attackers used stolen UpdraftCentral keys to install backdoor plugins on WordPress sites. See what the developer says, what to check and what to remove.
Next.js Critical RCE Flaws: How to Check Your Patch Landed Two critical Next.js RCE vulnerabilities were fixed on 14 October. Check sharp, React packages and use cache code, plus what GitHub, X and dark web show.
Kaspersky: Lazarus Hides Malware Payloads With Post-Quantum Encryption in Operation FlashHole Kaspersky says Lazarus used ML-KEM-1024 in its LPEClient tool to protect payload delivery in Operation FlashHole. What it means and what to check.
Plex2Shell: Four Plex Media Server CVEs Chained Into Remote Code Execution Plex2Shell chains four Plex Media Server CVEs into remote code execution. CISA lists all four as exploited. See the fixed version and what to check.
Railway Breach: What to Rotate, in What Order, and What to Check Railway says an unauthorized party may have read customer environment variables. Here is what to rotate, in what order, and which logs to check.
BIND 9 CVE-2026-94300: Fixed Versions and How to Check Your Exposure ISC fixed a BIND 9 vulnerability in GSS-TSIG that can corrupt memory and may allow code execution. Fixed versions, who is exposed and a server check.
eMudhra CA Key Compromise: What Python, uv and Container Teams Must Update Now Eight eMudhra CA keys were weak enough to recover. See what is true about the pip claim and the exact update and check list for Python, uv and Docker.
GitLab CVE-2026-110264: Am I Affected and What to Do in the Next Hour GitLab critical flaw CVE-2026-110264 (CVSS 10.0) can let an unauthenticated attacker run code. Check your version: fixed in 19.5.1 and backports.
Storm-0940 Used ARTEX Against ConnectWise: What Microsoft 365 Admins Should Check Microsoft ties Storm-0940 and the ARTEX AI framework to the ConnectWise supply chain compromise. Here are the Microsoft 365 checks to run now.
LiteLLM 1.107.0 Supply Chain Attack: Timeline, Stolen Data and a Response Checklist LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer on 21 October 2026. See the timeline, what it took and a checklist to pin and rotate.
Next.js and Node.js Security Updates, October 2026: What to Patch First Next.js 15.5.28 and 16.4.1 fix two critical remote code execution flaws. Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs. See the patch table and checklist.
ClickFix This Week: Siemens Software Center Flaw, ROMULUS and Chrome’s Copied-Command Warning Siemens confirms exploitation of CVE-2026-110936 in ClickFix attacks, Forescout details ROMULUS and Chrome warns on copied commands. What to do now.
Swallowtail (APT28) and HOOKEDGE: Attacks on Two NATO Countries and a Defender Checklist Symantec and Recorded Future describe the HOOKEDGE backdoor used by APT28: Word macros, webhook.site and a hidden Edge window. Attack chain and checklist.
Oracle October 2026 Critical Patch Update: What to Patch First Oracle's October 2026 Critical Patch Update has 1295 patches for 1209 CVEs. See which products to patch first, with CVSS scores and exposure.
BRONZE SANDCASTLE: Sandboxie DLL Sideloading Chain and Detection Checks Sophos CTU names BRONZE SANDCASTLE, a China-based group that sideloads Sandboxie DLLs. Read the infection chain, nine file pairs and a defender checklist.
SafePay Ransomware Joint Advisory: Five Exploited Flaws and How to Close Them CISA, the FBI and partners published advisory AA26-293A on SafePay ransomware. See the five exploited flaws, what to patch and one control for each.
MITRE ATT&CK v20 adds AI abuse and water attacks MITRE ATT&CK v20 adds AI prompt injection techniques, MFA bypass via app passwords and a campaign against US water utilities. See what changed.
CISA KEV additions, 13 to 16 Oct 2026: patch order CISA added nine exploited flaws to its KEV catalog from 13 to 16 October 2026. See each product, the fix, the due date and the order to patch.
CISA adds BeyondTrust Remote Support flaw to its exploited list CISA says a critical BeyondTrust Remote Support flaw, CVE-2026-102764, is exploited. Versions 26.2.3 and earlier need the BT26-05-RS patch.
DORA in 2026: what the ESAs say about year two What the ESMA and EIOPA pages say about DORA in 2026: scope, the six areas, technical standards, ESAs documents to 31 July 2026 and CTPP oversight.
Cyber compliance calendar 2026 and 2027: key dates Cyber compliance calendar for 2026 and 2027 from official pages: Cyber Resilience Act, EU AI Act, NIS2, post-quantum milestones and rules with no date yet.
Plan a 2027 security program with NIST CSF 2.0 Plan a 2027 security programme with NIST CSF 2.0: the six functions, Current and Target Profiles, Tiers and quick-start guides, as NIST words them.
Cyber incidents of 2026: lessons from official reports Cyber incidents of 2026 and lessons from official reports: CISA, the UK NCSC and CERT Polska on the npm, SD-WAN and Poland energy cases, as of 9 Oct 2026.
Post-quantum migration milestones: NCSC and EU dates Post-quantum migration milestones from the UK NCSC (2028, 2031, 2035) and the European Commission (end of 2026, end of 2030), as the pages state them.
Post-quantum cryptography: NIST and CISA guidance in 2026 Post-quantum cryptography in 2026: what NIST and CISA pages say on FIPS 203, 204 and 205, the 2035 date in the IR 8547 draft, and inventory steps.
UK Cyber Security and Resilience Bill: status in 2026 UK Cyber Security and Resilience Bill status in 2026: what GOV.UK says on Commons stages, planned scope, 24 and 72 hour reporting, and no assent date.
Incident reporting deadlines: NIS2, CRA, SEC, CIRCIA Compare incident reporting deadlines from official pages: NIS2 and CRA 24 and 72 hours, SEC Form 8-K four business days, and where CIRCIA stands today.
CIRCIA final rule status in 2026: what CISA says CISA's CIRCIA page as of 9 Oct 2026: final rule still in progress, four June 2026 town halls, no effective date given, reporting not yet required.
SEC cyber disclosure rules: Form 8-K Item 1.05 explained What the SEC fact sheet says on Form 8-K Item 1.05, four business days, Regulation S-K Item 106, Forms 6-K and 20-F, and the compliance dates for each.
NIS2 transposition status in 2026: what the EU says NIS2 transposition status in 2026 from EU pages: the 2024 deadline, May 2025 reasoned opinions, the July 2026 court referral and a January proposal.
EU AI Act dates after the 2026 AI Omnibus EU AI Act dates after the 2026 AI Omnibus, per the European Commission page: what applies in 2026, December 2027 and August 2028, and who enforces it.
Cyber Resilience Act dates: 2026 and 2027 deadlines Cyber Resilience Act dates from the Commission pages: 10 Dec 2024, 11 Jun 2026, 11 Sep 2026, 11 Dec 2027 and 11 Jun 2028, and what each date covers.
Cyber security regulations to know in 2026: five rules Five cyber security regulations for 2026 from official pages: NIS2, DORA, the Cyber Resilience Act, the EU AI Act and CIRCIA, with who they cover, dates.
NCSC Annual Review 2025: UK Cyber Threat Findings NCSC Annual Review 2025 key findings: 429 incidents handled, 204 nationally significant, plus state threats, ransomware and AI, for UK organisations.
FBI IC3 2025 Report: The Costliest Cybercrimes FBI IC3 2025 report: the costliest cybercrimes ranked by reported losses, from investment fraud to BEC and tech support, with complaint counts.
OWASP LLM Top 10 for 2025: the ten risks explained OWASP's LLM Top 10 for 2025 lists ten risks, LLM01 to LLM10, with one mitigation each taken from OWASP's own pages. Read what each risk means.
OWASP Top 10:2025: the ten web application risks The OWASP Top 10:2025 lists ten web application risks, A01 to A10, from Broken Access Control to Mishandling of Exceptional Conditions, in OWASP's order.
tj-actions compromise: how to catch it in your CI Where the tj-actions/changed-files compromise could have been caught: moved tags, encoded secrets in logs and the reviewdog link, with buyer questions.
JLR cyber attack: what security buyers should ask The JLR cyber attack stopped production and strained suppliers. Here are the questions a CISO should ask about shutdowns, restarts and supplier payments.
F5 breach: when your security vendor is hacked The F5 breach shows how a vendor hack becomes customer risk. See what was taken, what CISA and the NCSC advised, and which checks to run on your devices.
Check-in outage: one supplier, many airports The Collins Aerospace MUSE outage pushed European airports into manual check-in. Here is what a security buyer should ask about shared supplier systems.

2025 1

React2Shell — The Day 5 Reality Check React2Shell (CVE-2025-55182) is a critical React Server Components flaw. See how exploitation grew in the five days after disclosure and what to do.

2024 19

Data Breach at Internet Archive Exposes 31 Million User Records The Internet Archive data breach exposed 31 million user records, including emails and bcrypt hashes. See what was taken, when, and who confirmed it.
CISA Warns of Active Exploitation in SonicWall, Linux Kernel, and ImageMagick Vulnerabilities CISA added SonicWall CVE-2024-40766, an ImageMagick flaw and a Linux kernel flaw to its KEV catalog. Federal agencies must patch by September 30, 2024.
CVE-2024-8105: Critical UEFI Vulnerability CVE-2024-8105, also known as "PKfai," is a significant vulnerability identified within the UEFI (Unified Extensible Firmware Interface) ecosystem.
Actively Exploited Two New Zero-Day Vulnerabilities Hit Google Chrome Two Chrome zero-days, CVE-2024-7965 and CVE-2024-7971, were exploited in the wild. See what they are and which Chrome 128 version fixes them.
CVE-2024-38193: Microsoft Patches High-Severity Zero-Day Exploit Used by North Korea’s Lazarus Group CVE-2024-38193 is a Windows AFD.sys privilege escalation zero-day, CVSS 7.8 High, reported as exploited by the Lazarus Group. See why to patch.
High-Severity Zero-Day Kernel Vulnerability Actively Exploited in Android Devices CVE-2024-36971 is a Linux kernel use-after-free vulnerability in Android, flagged for limited, targeted exploitation. See what the August 2024 patches fix.
First Days, First Shots: Scammers Exploit Paris Olympics with 48GB Mobile Data Paris Olympics scams use fake tickets, merchandise shops and free mobile data offers to steal money and data. See how they work and how to stay safe.
BlastRADIUS Vulnerability (CVE-2024-3596) Exposes RADIUS Protocol to Critical Network Security Risk BlastRADIUS (CVE-2024-3596) is a critical flaw in the RADIUS protocol that lets attackers forge server replies. See the score, impact and how to fix it.
Severe OpenSSH Flaw ‘regreSSHion’ Puts Millions of Linux Systems at Risk OpenSSH regreSSHion, CVE-2024-6387, lets attackers run code as root on sshd. See affected versions 8.5p1 to 9.7p1, the 8.1 score and how to cut the risk.
Windows WiFi RCE Sell: CVE-2024-30078 A threat actor is selling an exploit for CVE-2024-30078, a Windows Wi-Fi driver RCE rated 8.8 High. See affected versions, attack vector and how to patch.
International Agencies Unmasked LockBit Ransomware Group Leader The LockBit ransomware leader was named as Dmitry Khoroshev in May 2024. See the sanctions, the $10 million reward and what the sources say about LockBit.
CVE-2024-29212: Veeam RCE Vulnerability Veeam CVE-2024-29212 is a critical remote code execution flaw in the Service Provider Console, rated 9.9 on CVSS. See what is affected and what to patch.
Palo Alto Networks Releases Urgent Fixes for Critical Security Flaw in PAN-OS Software Palo Alto Networks issued fixes for CVE-2024-3400, a critical PAN-OS GlobalProtect flaw rated CVSS 10.0 and exploited in the wild. See fixed versions.
AWS and Google Cloud Credentials Expose: LeakyCLI Flaw A significant vulnerability, "LeakyCLI," affects command-line tools utilized in AWS and Google Cloud environments.
SurveyLama Data Breach Exposes Info of 4.4 Million Users SurveyLama experienced a data breach in February 2024, putting the sensitive data of 4.4 million users at risk.
Microsoft Security Slip-ups Allow Chinese Hackers Access to US Official Emails Microsoft security failures let Chinese hackers read US officials' email in 2023. See what the Cyber Safety Review Board found and what it advised.
Earth Krahang: China-Based Advanced Cyber Attack Campaign Earth Krahang is a China-based APT group that has targeted governments since early 2022. See who it hits, the flaws it exploits and the tools it uses.
Oracle Warns of Java Issues Caused by macOS 14.4 Update Oracle warns that macOS 14.4 ends Java processes on Apple silicon Macs, affecting Java 8 to early JDK 22 builds. See what happens and what to do.
“Red Page Removal” Service: A Solution for Flagged Domains A red page is a warning shown on a flagged site. See what the Red Page Removal service claims, how it is sold, and why threat actors may want it.

2023 36

Threat Actors Exploit Docker Engine API Exposed Docker Engine API instances are being used to build the OracleIV DDoS botnet. See how the attack works and how to protect your Docker hosts.
Critical Security Vulnerabilities in OpenVPN Access Server OpenVPN Access Server, supported by the OpenVPN 2 codebase, has identified two critical security vulnerabilities.
F5 BIG-IP Security Vulnerability Allows Remote Code Execution: CVE-2023-46747 F5 BIG-IP remote code execution flaw CVE-2023-46747 (CVSS 9.8) lets attackers with network access run system commands. See affected versions and fixes.
Okta’s Data Breach Victims: Cloudflare, 1Password, and 170 Others Okta support system breach explained: how stolen HAR file session tokens led to incidents at 1Password and Cloudflare, plus the IoCs Okta published.
CVE-2023-22515: Atlassian Confluence Zero-Day | Actively Exploited CVE-2023-22515 lets attackers create admin accounts in Atlassian Confluence 8.0.0 to 8.5.1. See affected and fixed versions, CVSS and how to respond.
Perspective of the Month | Anonymous Sudan | June – July 2023 In June 2023, Anonymous Sudan targeted Microsoft with a massive DDoS attack, causing significant disruptions and outages across various Microsoft services.
Advanced Backdoor Attack “SUBMARINE” Uncovered in Barracuda Email Security Gateway (ESG) Appliances What is the SUBMARINE backdoor? It hit Barracuda Email Security Gateway appliances via CVE-2023-2868. See how it works and how to respond to it.
FIN8 Group Uses Sardonic Backdoor for BlackCat Ransomware Attacks FIN8, also called Syssphinx, used a modified Sardonic backdoor in BlackCat ransomware attacks. See how the backdoor works and how to reduce the risk.
Perspective of the Month | APT Groups | May 2023 Which APT groups were active in May 2023? Read how the Sidewinder APT group used polymorphic attacks against Pakistan and Turkey, and how to defend.
MOVEit Transfer Software Exploited Through Critical Zero Day Vulnerability 2023 MOVEit Transfer zero day CVE-2023-34362 is a critical SQL injection flaw (CVSS 9.8) exploited from May 2023. See the facts, CISA attribution, what to do.
“Triangulation Trojan” Launches Sophisticated Attack on Apple Devices The Triangulation Trojan is a targeted spyware attack on Apple iPhones using an invisible iMessage. Learn how it works, how to check a device and stay safe.
Perspective of the Month | APT Groups Perspective of the month on APT groups: Lazarus DeathNote on Linux, BlueNoroff RustBucket on macOS and Alloy Taurus PingPull on Linux. Read the analysis.
BellaCiao: The New Malware From Iran’s Charming Kitten BellaCiao is a custom dropper malware that researchers link to Iran's Charming Kitten. See how it works and how to reduce your attack surface.
Threat Actors Behind GoAnywhere Attacks Target Hitachi Energy Hitachi Energy confirmed a data breach after Cl0p exploited the GoAnywhere MFT zero-day CVE-2023-0669. See what happened and how to reduce your risk.
Adobe Acrobat Sign Abused in Redline Stealer Distribution Campaigns How threat actors abuse Adobe Acrobat Sign signing requests to deliver Redline Stealer, how the lure reaches users, and what to do to stay safe.
A New Malware Campaign Detected through Microsoft OneNote Files OneNote malware campaigns hide malicious files under fake buttons in .one attachments. See how they work, what Microsoft now blocks and how to defend.
Critical RCE Alarm in Siemens Solid Edge Viewer Software Siemens fixed CVE-2023-22669, a heap-based buffer overflow in Solid Edge Viewer DWG parsing that can let an attacker run code. What to update.
CISA Adds ZK Framework RCE Flaw to Catalog of Known Exploited Vulnerabilities The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has recently issued a warning about an RCE flaw that is being exploited by cybercriminals.
Multiple 2FA Apps Distributing Malware Discovered in App Store and Google Play Fake 2FA apps were found on the App Store and Google Play, pushing costly yearly subscriptions. Learn what happened and how to pick a safe app.
Critical Vulnerability Alert in ClamAV A critical remote code execution vulnerability has been discovered in ClamAV, an open-source anti-virus software by Cisco.
Reddit Suffered a Security Breach Resulting in Unauthorized Access to Internal Systems Reddit suffered a security breach resulting in unauthorized access to its internal systems, sensitive documents, and system source code by threat actors.
Adobe Acrobat Reader DC RCE Vulnerability: Exploit Code Released Recently patched critical RCE vulnerability in the Adobe Acrobat Reader DC software has been identified with the publication of PoC exploitation code.
Code Signing Certificates for GitHub Desktop and Atom Apps Suffered Unauthorized Access GitHub discovered that a series of repositories used in the planning and development of GitHub Desktop and Atom were accessed by unknown threat actors.
RCE Alert in IBM WebSphere Application Server A critical security vulnerability has been identified in IBM WebSphere Application Server that can cause remote code execution by threat actors.
Multiple Vulnerabilities in ChromeOS Google fixed four ChromeOS flaws, CVE-2023-0471 to CVE-2023-0474, in WebTransport, WebRTC, ServiceWorker and GuestView. Why to apply the update now.
A Critical Vulnerability Affecting QNAP NAS Devices Has Been Detected QNAP fixed a critical flaw, CVE-2022-27596, that lets remote attackers inject code into NAS devices on QTS 5.0.1 and QuTS hero h5.0.1. Update now.
Critical RCE Alert on Western Digital My Cloud OS In Western Digital My Cloud OS 5 devices, a critical security vulnerability has been identified, which could allow attackers to remotely execute code.
Critical RCE Alert in Apache Airflow MySQL Provider A critical security vulnerability has been detected in the Apache Airflow MySQL Provider library that could allow threat actors to execute remote code.
PayPal Data Breach That Puts More Than 34,000 User Accounts in Danger PayPal confirmed in December 2022 that a credential stuffing attack put more than 34,000 accounts at risk. What data was exposed and what users should do.
Critical RCE Vulnerability Detected on AMD EPYC and Ryzen Processors As part of the AMD security bulletin, security updates have been released that fix 31 vulnerabilities affecting Ryzen, Athlon, and Thread Ripper.
Critical Vulnerabilities in Qualcomm Snapdragon Affecting Lenovo, Microsoft, and Samsung Devices Detected Qualcomm fixed 22 Snapdragon flaws in its January 2023 bulletin, including CVE-2022-33218 and CVE-2022-33219, affecting Lenovo, Microsoft, Samsung.
Critical 0-Day Alarm Affecting Windows ALPC As part of the January 2023 updates, Microsoft has released updates that fix 98 security vulnerabilities, including a 0-day vulnerability, Windows ALPC.
Remote Code Execution Risk in jsonwebtoken (JWT) Library jsonwebtoken 8.5.1 and earlier can allow remote code execution if untrusted input reaches jwt.verify(). Version 9.0.0 fixes it. NVD rejected the CVE ID.
Bitdefender Releases Decryptor For MegaCortex Bitdefender security researchers have released a decryptor tool for targets attacked by MegaCortex Ransomware.
Maximum Severity Vulnerability on Synology VPN Plus Server CVE-2022-43931 in Synology VPN Plus Server scores CVSS 10.0 and lets attackers run commands without logging in. Affected versions and the fix to apply.
Deezer User Data Detected Shared on Underground Forums Deezer user data from a September 2019 third-party breach is shared on underground forums: names, emails, birth dates, IP addresses and usernames.

2022 97

Godfather Trojan Activity Targeting Financial Sector Detected Godfather trojan resurfaces, targeting the financial sector with advanced techniques. Learn how Brandefense detects and mitigates this threat.
Critical RCE Alarm in Linux Kernel A critical vulnerability has been identified in the Linux Kernel that could allow threat actors to disclose sensitive information and execute arbitrary code.
Multiple Vulnerabilities Detected in Nessus Network Monitor Multiple security vulnerabilities have been identified in Nessus due to third-party components that could allow threat actors to perform (RCE) and DoS attacks.
Critical RCE Alert in Foxit PDF Reader and PDF Editor Foxit has released updates that fix a remote code execution (RCE) vulnerability affecting the PDF Reader and PDF Editor products.
Agenda Ransomware’s New Rust Variant Targets Critical Sectors Agenda ransomware, also known as Qilin, has a new Rust variant using partial encryption. See which sectors it targets and how to reduce exposure.
Critical RCE Alarm on Citrix ADC and Citrix Gateway A critical security vulnerability has been identified in Citrix ADC and Citrix Gateway network solutions that could allow threat actors to RCE.
ZeroBot: New Botnet Malware Using IoT Security Vulnerabilities Developed with Golang, Zerobot exploits multiple vulnerabilities detected in IoT devices to gain access to targeted systems and spread further.
Critical RCE Alarm in FreeBSD Ping A critical security vulnerability has been identified in the ping module of FreeBSD operating system that threat actors could potentially exploit.
WhatsApp Suffered from a Data Breach – 487 Million Users Data in Danger In a well-known hacking forum, a threat actor claimed that a database of 487 million WhatsApp users' mobile phone numbers was compromised
Amazon Fixes a Security Vulnerability Affecting AWS AppSync A security vulnerability called "cross-tenant" has been detected by security researchers in AppSync, a popular Amazon Web Services (AWS) tool.
Threat Group Named Worok Performs Espionage Activities With Backdoors Hidden Inside Image Files Worok is a cyber espionage group that hides malware in PNG image files and uses Dropbox for command and control. Learn how it works and how to defend.
New KmsdBot Malware Detected for Crypto Mining Activities and DDoS Attacks KmsdBot spreads through weak SSH passwords to mine cryptocurrency and launch DDoS attacks. How it works and how to protect SSH access on servers.
Medibank Confirms Security Breach Affecting 9.7 Million Customers’ Data Medibank said criminals accessed the data of 9.7 million current and former customers in an October 2022 ransomware attack. See what was taken.
Dynamics 365 Customer Voice Service Detected To Be Manipulated In Phishing Attacks Phishing emails reportedly abuse Dynamics 365 Customer Voice and its old Forms Pro name to steal Microsoft logins. See how it works and how to stay safe.
Preliminary Information Released for OpenSSL Vulnerability It has been announced that the critical security vulnerability detected is affected by the versions between OpenSSL 3.0 and version 3.0.6.
Air New Zealand Suffered A Security Breach New Zealand's flag carrier, Air New Zealand (Air NZ), has suffered a security breach that resulted in threat actors gaining access to customer accounts.
Iran Atomic Energy Agency Suffered from a Breach Black Reward claimed it stole email data from Iran's Atomic Energy Agency and threatened to leak it. What was claimed and what officials confirmed.
Magniber Ransomware Targets Windows Users with Fake Software Updates Magniber ransomware spreads through fake antivirus and Windows 10 update downloads. See how the infection chain works and how to reduce the risk.
Timing Attacks Via Npm API Discloses Custom Package Names An npm timing attack can reveal an organization's private package names through 404 response times. See how it works and how to defend against fakes.
Microsoft Released Critical Security Updates The Microsoft October 2022 security updates fix many flaws, including the exploited CVE-2022-41033. ProxyNotShell is not covered. See what was fixed.
Toyota Confirms a Security Vulnerability Affecting Customer Data A developer pushed T-Connect source code with a server access key to a public GitHub repository in 2017, exposing 296,019 customer email addresses.
More than 400 Mobile Apps Detected to Hijack Facebook Login Credentials Meta found more than 400 Android and iOS apps posing as photo editors, games and VPNs to steal Facebook logins. How the scheme worked, how to stay safe.
$566 Million worth of Binance Coins from Binance Bridge Seized BNB Chain's 2022 update explains the BSC Token Hub bridge exploit, the 2 million BNB involved and the network's response.
Critical XSS Alarm in Canon Medical Vitrea View Software A critical XSS vulnerability has been identified in Canon Vitrea View medical image imaging software provided by Canon Medikal.
Multiple Vulnerabilities Detected in Solarwinds Orion In the Solarwinds Orion platform two critical security vulnerabilities have been identified that may cause threat actors to access sensitive/critical data.
Critical RCE Alarm in Sophos Firewall Solutions A critical 0-day security vulnerability that affects Sophos Firewall solutions has been identified and is known to be actively exploited by threat actors.
AttachMe: The Critical Vulnerability in Oracle Cloud Infrastructure AttachMe was a critical Oracle Cloud Infrastructure flaw that let attackers attach other customers' storage volumes. How it worked and why it mattered.
Tarfile: The 15 Years Old Critical Python Vulnerability Affects More Than 350,000 Projects A critical security vulnerability has been identified in Python's Tarfile module that has not been updated for 15 years.
American Airlines Suffered From A Data Breach American Airlines found on July 5, 2022 that attackers had taken over some employee email accounts, putting customer and employee personal data at risk.
Critical Zero-Day Alarm on Trend Micro Apex One Trend Micro has released security updates regarding a zero-day vulnerability identified in Apex One and Apex One SaaS endpoint security solutions
Mirai Variant MooBot Botnet Targets Vulnerable D-Link Devices MooBot, a Mirai botnet variant, targets D-Link devices through known flaws such as CVE-2015-2051 and CVE-2022-26258 to use them in DDoS attacks.
TikTok Suffered A Data Breach Resulting In The Leak Of 2 Billion User Data The source codes of the popular social media application TikTok and the sharing claiming that 2 Billion user data have been seized.
MuddyWater APT Group Targeted the SysAid Servers MuddyWater, an Iranian APT group, targeted SysAid servers through Log4j 2 flaws. Learn how the attack worked, who is behind it and how to defend.
LastPass Suffers A Security Breach The LastPass breach let attackers take source code and technical data via a developer's stolen credentials. See what happened and how to protect accounts.
Phishing Attacks Targeting Python Package Repository (PyPI) Users Detected In PyPI, it has been detected that phishing attacks targeting project developers have been carried out by injecting malicious code into Python packages.
DirtyCred – A Critical Linux Kernel Security Vulnerability DirtyCred is a Linux kernel technique that swaps low-privileged credentials for privileged ones. It has no CVE of its own and is not CVE-2022-0847.
A Phishing Campaign Targeting Hotels and Travel Companies Detected A phishing campaign by TA558 targets hotels and travel companies with fake reservation e-mails, ISO files and RATs. See how it works and how to defend.
Thousands of VNC Servers Open to the Internet Detected Open VNC servers with no login put industrial systems at risk. See why port 5900 matters and the steps that reduce exposure to remote attacks.
Zoom Releases Updates Fixing A Critical Vulnerability Affecting macOS Zoom has released security updates that fix a vulnerability in the macOS operating system that could allow a threat actor to take control of a user's system.
A New Attack Campaign Targeted Public Institutions and Industrial Organizations A phishing campaign attributed to TA428 hit public institutions and industry in Eastern Europe and Afghanistan using CVE-2017-11882. See how it works.
A Critical Data Disclosure Vulnerability Has Been Detected in Slack Slack, an internal messaging and communication application for organization, is vulnerable to a security vulnerability that exposes user credentials.
A New AiTM Phishing Campaign Targeting Institution/Organization Personnel Has Been Detected A large-scale phishing campaign using advanced AiTM techniques has been detected. AiTM attacks are newer and more advanced phishing attacks.
Critical Vulnerabilities Detected in Moxa NPort Series Devices 0-day vulnerabilities tracked as CVE-2022-2043 and CVE-2022-2044 affect NPort 5110 device servers designed to connect devices to Ethernet networks.
“Sality”: The Malware Distributed to Industrial Systems via Password Recovery Tools Security researchers identified a malware distribution campaign to industrial control systems (ICS) through password recovery tools developed for PLC.
MageCart E-Skimmer Attacks Targeted Restaurants in the USA MageCart e-skimmer campaigns reportedly hit three US online ordering platforms for restaurants. See how skimming works and how to defend.
Premint Security Breach Caused 314 NFTs Hijacking Attackers injected malicious JavaScript into Premint on 17 July 2022 and stole 314 NFTs through wallet approvals. How the attack worked and what to check.
Marriott International Suffered from Security Breach Leading to 20GB of Data Hijacking Marriott International confirmed a breach in which attackers took 20GB of internal files. What happened, who was told, and the steps that reduce risk.
RedAlert: The New Ransomware Targeting VMware ESXi Servers RedAlert (N13V) ransomware targets VMware ESXi servers on Windows and Linux, shuts down virtual machines, demands Monero and runs a leak site.
LockBit Threat Actors Release LockBit 3.0 with New “Bug Bounty” Program LockBit 3.0 launched a bug bounty program and affiliate rules. Learn what the ransomware-as-a-service group announced and how to defend your organisation.
Critical RCE Vulnerability Found in Mitel MiVoice VoIP Devices Actively Exploited A 0-day vulnerability detected in Linux-based Mitel MiVoice VOIP devices was found to be used by threat actors to execute code on vulnerable systems.
Multiple PyPI Packages Detected Aiming to Hijack AWS Credentials and Metadata Security researchers have detected multiple Python packages (PyPI) containing malicious code developed to hijack and publicly leak AWS credentials.
A Critical Code Execution Vulnerability (RCE) Detected in Splunk Enterprise Splunk fixed CVE-2022-32158, a critical flaw in Splunk Enterprise deployment servers. See who is affected and which versions contain the fix.
Vulnerable QNAP NAS Devices Are Targeted in eCh0raix Ransomware Campaigns It is known that eCh0raix ransomware, which targeted QNAP NAS devices in the last attacks, was used in attacks targeting Synology NAS devices in 2021.
OneDrive and SharePoint Cloud Solutions Vulnerable to Ransomware Attacks OneDrive ransomware can encrypt SharePoint files beyond the versioning limit so they cannot be recovered. See how the attack works and how to cut the risk.
BlackCat Ransomware Is Targeted Vulnerable Microsoft Exchange Servers Cyber threat actors have been found to launch attack campaigns by exploiting vulnerable Microsoft Exchange servers to spread BlackCat ransomware.
Misconfigured Elasticsearch Servers Targeted by Threat Actors Threat actors delete the contents of misconfigured Elasticsearch servers and leave ransom notes. See how the campaign works and why backups matter most.
Follina: The 0-Day Vulnerability Affects Windows Systems Follina (CVE-2022-30190) is a 0-day in the Windows Support Diagnostic Tool that lets a Word file run code. See the CVSS score, the fix and the workaround.
GoodWill: A New Ransomware Group Raising Attention to Social Responsibility GoodWill ransomware asks victims for social good activities instead of money for the key. See how it works, who researchers link it to and how to defend.
Cryptocurrency Scammers Targeted Elon Musk with Deepfake Technology Scammers used deepfake videos of Elon Musk and other crypto figures to promote a fake BitVex trading platform. See how the scam worked and how to avoid it.
New Goal of Fraud and Phishing Activities: LinkedIn Users LinkedIn, a business network and social sharing platform, is frequently used by threat actors in phishing activities carried out through various methods.
The New Phishing Attack Detected Using Multiple Malware Types A phishing campaign targeting Microsoft Windows users used three different types of malware designed to snatch sensitive information from targets.
Bitter APT Targets Bangladesh’s Key Institutions Through Phishing Emails Bitter APT used phishing emails with malicious documents to target Bangladesh's key institutions. See the Office flaws it exploited and how to defend.
Frappo: A New “Phishing-as-a-Service” On The Dark Web Frappo is a phishing-as-a-service tool seen on the dark web. It sells fake pages that copy banks and shops. Learn how it works and how to stay safe.
Multiple Privilege Escalation Vulnerabilities Detected in Linux Operating System The vulnerabilities collectively called "Nimbuspwn" can be used to gain root privileges on Linux systems and allow threat actors to deploy various malware.
Russia-based Energy Organization Elektrocentromontazh Targeted by Anonymous Anonymous threat actors have shared a breach of the e-mail system security belonging to the Russian-based energy organization Elektrocentromontazh (EMC).
Rocket Kitten APT Exploit VMware RCE Vulnerabilities in Backdoor Distribution Campaigns Iranian-connected Rocket Kitten actors are reported to have distributed Core Impact malware through the VMware RCE flaw CVE-2022-22954. See the fix.
A Cryptographic Security Vulnerability Detected in Java: “Psychic Signatures” A cryptographic security vulnerability has been detected in Java that allows threat actors to potentially capture communications and messages.
Enterprises GitHub Repos Are Targeted through Captured OAuth Access Tokens GitHub says stolen OAuth user tokens issued to Heroku and Travis CI apps were used to download private repositories, including npm. See what to review.
The Allegation that the Data of the Russian-Based Domain Registrar Domain.ru Was Captured GhostSec claimed it took corporate data from Russian domain registrar Domain.ru and posted proof files. What was claimed and what customers should do.
Fake Web Apps Steal Android Users’ Banking Information Threat actors manipulate various Android applications and carry out campaigns targeting the banking information of Malaysian Android users.
A New Android Banking Trojan Distributed via Google Play Store: “OCTO” A new malware campaign has been detected deploying the banking trojan "OCTO," which aims to hijack users' banking information through multiple Android apps.
Cicada APT Group Targets Government Institutions Cicada, also tracked as menuPass and APT10, ran espionage campaigns against government bodies via Exchange flaws. See its tools, backdoor and defenses.
The Threat Actor Breached MailChimp Customer Accounts In the MailChimp breach, an unknown threat actor hijacked internal tools used by the company's customer support staff for account management.
Beastmode Botnet Targets Security Vulnerabilities in Totolink Routers Beastmode Botnet, a variant of Mirai Botnet, has been detected to exploit security vulnerabilities in Totolink routers to expand access to vulnerable systems.
New Phishing Campaign Detected That Deploying Remcos RAT A phishing campaign delivers Remcos RAT through a password-protected Excel file in fake payment emails. See how the chain works and how to stay safe.
Critical Vulnerability Affected SonicWall Firewall Solutions An unauthenticated, remote threat actor could exploit this vulnerability to execute arbitrary code and trigger a DoS condition on SonicWall Firewall.
macOS Systems Were Targeted by the Storm Cloud APT Group Researchers have detected unauthorized access to a MacBook Pro device running macOS 11.6 via the GIMMICK malware associated with the Storm Cloud APT group.
Malicious Applications Distributed on Google Play Detected to Target Facebook Accounts Facestealer malware targeting Android users is distributed on Google Play and third-party application stores under the name Craftsart Cartoon Photo Tools.
A New Backdoor in Microsoft: Serpent The Serpent backdoor targets French construction, real estate and government organizations through phishing, Word macros and PowerShell hidden in images.
Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices Cyclops Blink is a Sandworm-linked botnet that infects Asus and WatchGuard routers. See what its modules do and how to protect your devices.
New 0-Day in Dompdf PDF Converter Library A 0-day vulnerability has been identified in dompdf, a PHP-based HTML to PDF conversion library, that could lead to remote code execution.
A New Linux Backdoor Detected to Deployed with Log4Shell Vulnerabilities A new Linux backdoor spreads through Log4Shell and talks to its command servers over DNS tunnelling. Read how it works and how to reduce the risk.
Two Critical Vulnerabilities Detected in Veeam Data Back-up Solution Veeam Software has released updates to two critical security vulnerabilities affecting Backup&Replication, a backup solution for virtual environments.
Multiple Vulnerabilities Detected in Popular Package Managers Security vulnerabilities have been detected in popular package managers, allowing threat actors to access sensitive data.
MuddyWater Threat Actors Target Turkey and Arabian Peninsula With A New Malware Campaign Cisco Talos reported new MuddyWater attacks on Turkey and a phishing campaign on the Arabian Peninsula that delivers SloughRAT (Canopy).
New Android Malware Detected to Hijack Google Authenticator MFA Tokens: “Escobar” The Aberebot Android banking trojan returned as Escobar, posing as antivirus, and can steal Google Authenticator MFA codes to take over bank accounts.
New Linux Kernel Vulnerability Detected Giving Threat Actors Root Access A Linux kernel flaw, Dirty Pipe (CVE-2022-0847), lets local users overwrite read-only files and gain root. See CVSS 7.8, affected and fixed versions.
Critical Security Vulnerabilities Detected in TerraMaster TOS Octagon Networks found critical flaws in TerraMaster TOS, including CVE-2022-24990, that let remote attackers run code on TNAS storage devices.
A New Malware Distributed via Fake Antivirus Applications: “SharkBot.” SharkBot, an Android banking trojan, spread through fake antivirus apps on Google Play. How its automatic transfers work and how to lower the risk.
Avast Releases A Free Decryption Tool For HermeticRansom Ransomware Targeting Ukraine Avast released a free decryptor for HermeticRansom, the Go ransomware used with HermeticWiper in attacks on Ukraine. What it does and who it helps.
SolarWinds Serv-U FTP Server Has the Path Traversal Security Vulnerability CVE-2021-35250 is a path traversal flaw in SolarWinds Serv-U FTP Server 15.3 that can expose files on the system. Who is affected and what update fixes it.
FoxBlade Wiper Used in Attacks on Ukraine, Also Known as HermeticWiper FoxBlade, also known as HermeticWiper, is the wiper Microsoft found in attacks on Ukraine on 23 Feb 2022. See how it spread and how to defend against it.
High-Severity Vulnerabilities in Schneider Electric Easergy P5 and P3 Protection Relays Multiple security vulnerabilities have been identified affecting Easergy voltage protection relays developed by Schneider Electric.
NVIDIA Exposed to a Cyber Attack Affecting Their Systems LAPSUS$ breached NVIDIA in February 2022 and took employee credentials and code-signing certificates. What NVIDIA confirmed and what happened next.
A New Android Banking Trojan Detected in Google Play Store: “Xenomorph” A new Android banking trojan with more than 50,000 downloads has been identified, targeting 56 European Banks.
High-Severity RCE Flaw in Galaxy Store on Samsung Galaxy S21 A security vulnerability has been identified on Samsung Galaxy S21 devices that could allow threat actors to execute arbitrary code with root privileges.
A Vulnerability Detected in Hive Ransomware Allows Recovering Encrypted Files A vulnerability has been identified in the encryption algorithm used by the Hive Ransomware software that could allow decryption of encrypted data.

Browse by Category 1

The category pages below collect related articles, newest first.

Security News Security news from the Brandefense team: new malware, vulnerabilities, data breaches and threat actor activity, summed up for security teams.