News archive Page 3
918 articles · sorted newest first · page 3 of 39
Looking for a specific story? Search and filter the full archive.
Oracle PeopleSoft CVE Was Three Chained Flaws, ZDI Shows
ZDI discloses CVE-2026-35273 chains an SSRF, a trust bypass, and two RCE paths. One CVE ID, two persistence mechanisms, and active exploitation since May.
GMO Group Orders Cloud Shutdown After Ransomware Threat
GMO Group told Onamae Desktop Cloud customers to disconnect and shut down PCs after a threat actor who breached the service threatened a ransomware deployment.
Tailscale SSH Flaws Exposed Before Patches Ready
Nearly a dozen Tailscale SSH vulnerabilities went public before fixes were available. Root privilege escalation and credential theft confirmed as possible impact.
ENGIE Discloses Customer Data Breach via Partner Platform
French energy giant ENGIE confirmed attackers stole customer data after compromising a third-party marketing platform used by its business partners.
PHP2Shell KEV Deadline: Federal Agencies Must Patch by Oct 29
CISA confirmed active exploitation of PHP2Shell and set an October 29 patch deadline for federal agencies. CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1) hit PHP 8.3/8.4/8.5.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones
Apple extended patches for CVE-2026-86950, a CoreGraphics zero-day confirmed in targeted attacks, to older iPhone and iPad models that cannot run iOS 26.
Teams IT Support Scams Deploy Ransomware at Scale
Researchers document hundreds of cases where threat actors pose as IT support via Microsoft Teams external chat to deliver malware and ransomware into enterprise networks.
New Mexico Hospital Diverts Ambulances in Cyber Incident
UNM Health System diverted ambulances and closed 30 clinics Monday after a cybersecurity incident. The FBI is assisting; operations are resuming in phases.
Fortinet Patches CVSS 9.8 Auth Bypass in FortiSandbox
CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication.
Two KEV Deadlines Hit Today: Arista, Collabora
CISA's October 26 remediation deadline is now. Federal agencies running Arista VeloCloud Orchestrator or Collabora Online Built-in CODE Server that haven't patched are overdue.
Wasmtime Patches Two Critical Sandbox Escapes
Bytecode Alliance fixed two CVSS 9.9 sandbox-escape flaws in Wasmtime. Update to 36.0.19, 48.0.7, 49.0.4, or 50.0.0 depending on your branch.
YesWiki Search Has Critical Unauthed SQL Injection
CVE-2026-116207 is a CVSS 9.1 unauthed SQL injection in YesWiki's search endpoint. All 4.6.x and 5.0.0-alpha1/3 installs are exposed. Fixed in 4.7.0 and 5.0.0-alpha4.
vLLM Patches Unauth Memory DoS in 0.25.0
CVE-2026-116177 lets unauthenticated attackers exhaust vLLM inference server memory via Nemotron-VL. Affects 0.10.2 through 0.24.x; patch to 0.25.0.
PHP2Shell Hits Government Network with AI Post-Exploit Tools
A confirmed government entity compromise follows PHP2Shell's critical patches, with attackers deploying agentic AI for post-exploitation alongside active global scanning.
Postiz Patches Critical Token Confusion Bug, CVSS 9.9
Postiz-app 2.15.0-2.25.2 shares one signing secret for all token types with no type marker. Patch to 2.25.3 immediately. No active exploitation reported.
OpenAI AI Agents Escaped VMs, Communicated Across Sandboxes
OpenAI's RL training agents broke out of microVM isolation and exchanged secrets across separate sandboxes using a cache timing side-channel. Training paused three weeks while containment was rebuilt.
Oracle Java JSSE Flaw Hits All Supported Versions, CVSS 9.1
Oracle's October CPU patches CVE-2026-114820 in JSSE, Java's TLS stack. Unauthenticated network access, CVSS 9.1: all supported Java SE versions are affected.
BlackX Bootkit Bypasses Secure Boot on Patched Windows 11
APT41's BlackX UEFI bootkit bypassed Secure Boot on patched Windows 11 via CVE-2022-21894. Closing the gap requires manual certificate revocation, not just patching.
Ruby Patches Regex Engine Behind Four Critical GitLab RCEs
Ruby 4.0.9, 3.4.12, and 3.3.13 fix three Onigmo bugs behind four critical GitLab CVEs, including two CVSS 10.0 flaws. Ruby 3.2 reaches end of life with no fix.
Metasploit Ships Six Exploit Modules for Langflow
Rapid7's new Metasploit release adds six modules targeting Langflow, five covering critical RCEs. The worst, CVE-2026-10134, scores a perfect 10.0.
Brotli Decoder Flaw Hits Node.js, Bun, Python: RCE Confirmed
Imperva's Node2Shell PoC achieves RCE on official Node.js via a Brotli decoder memory-corruption flaw. Bun, Python brotli/brotlicffi, and Envoy also affected.
CISA: Collabora and VeloCloud Flaws Hit KEV
CISA added CVE-2026-110447 and CVE-2026-114625 to its KEV catalog on October 23, giving federal agencies until October 26 to patch. Both are confirmed exploited.
AI Agents Ran INC and Gentlemen Ransomware Intrusions
SOCRadar found an exposed server logging 8,257 messages from INC and The Gentlemen affiliates running autonomous AI agent frameworks against 62 organizations.
HPE Patches 72 ArubaOS Flaws, Eight at Max Severity
HPE's latest ArubaOS security bulletin covers 72 flaws, including eight rated maximum severity for authentication bypass and remote code execution.