News archive Page 6
918 articles · sorted newest first · page 6 of 39
Looking for a specific story? Search and filter the full archive.
Industrial Engineer Jailed for 20-Bitcoin Extortion
Former core infrastructure engineer deleted admin accounts, reset hundreds of passwords at an industrial firm, demanded 20 bitcoin for recovery. Now in prison.
CVSS 9.8 Code Injection in openapi-typescript-codegen
openapi-typescript-codegen through 0.31.0 lets attackers who control an OpenAPI spec inject JavaScript into generated clients. CVSS 9.8 critical.
FusionPBX Caller ID Bug Lets Attackers Run OS Commands
CVE-2026-108161, CVSS 7.5: unauthenticated OS command injection in FusionPBX 5.6.5 and earlier via crafted caller IDs. Update or restrict exposure.
Contao Patches Critical XSS in Four-CVE Update
Contao 5.3.50 and 5.7.12 fix a critical stored XSS in the comment module that executes in admin sessions, plus three medium-severity issues. Update now.
Three Critical WooCommerce Plugins Need Patching
An RCE, an auth bypass, and an arbitrary file deletion in three WooCommerce plugins this week. All rated CVSS 9.1 or higher. Patch all three now.
FBI Arrests ShinyHunters Suspect in FBI Breach Case
FBI Director Kash Patel announced Oct. 9 the arrest of a ShinyHunters co-conspirator tied to the September breach of FBI systems.
Germany Arrests Core Qilin Member After Japan Extradition
German authorities arrested a Russian national suspected of being a core Qilin ransomware member after extradition from Japan, confirmed by Japan's National Police Agency.
AhsayCBS Backup Platform Exploited, No Patch Ready
Two AhsayCBS flaws, including a CVSS 10.0 auth bypass, are chained to drop webshells and XMRig miners on MSP networks. No patch is available.
SonicWall SMA1000 Max-Severity Flaw Exploited
CVE-2026-102255 (CVSS 10.0) in SonicWall SMA1000 hit active exploitation within 72 hours of the October 7 patch. Patch immediately; attribution not yet confirmed.
CISA: Five Flax Typhoon CVEs Added, Feds Have Until Oct 11
CISA added five vulnerabilities tied to China's Flax Typhoon to its KEV catalog on Oct 8; federal agencies must patch or discontinue use by October 11.
Pwn2Own Ireland Closes: $1.26M for 98 Zero-Days
Pwn2Own Ireland 2026 wrapped with 98 unique zero-day vulnerabilities exploited and $1,262,000 in prizes paid out to competing security researchers.
IDCF Cloud Ransomware: 194 Customers Can Retrieve Backups
IDC Frontier's October 14 update says 194 of 495 affected customers can retrieve snapshot backups. The provider also found unauthorized queries of portal details for 48 customers, with no evidence those details left its systems.
Citrix NetScaler: Critical CVSS 9.5 RCE, Patch Now
CVE-2026-107406, CVSS 9.5, is a memory overflow in Citrix NetScaler that allows unauthenticated RCE or DoS in SAML-configured deployments. Patch now.
FBI Seizes Domains for Flax Typhoon Breach Tools
The FBI seized seven domains used by Chinese state-sponsored Flax Typhoon to operate MicroScan and FishHub tools in critical infrastructure intrusions.
Cisco Patches Five CVSS 9.8 Flaws in NX-OS
Cisco issued advisories for five critical NX-OS vulnerabilities, all CVSS 9.8, enabling unauthenticated remote code execution with root on Nexus data center switches.
Fake Rabby, OKX Extensions Steal Recovery Phrases
Researchers found 16 malicious Firefox extensions posing as Rabby and OKX wallets, capable of extracting recovery phrases and private keys from cryptocurrency users.
Pwn2Own Ireland Day 2: 45 More Zero-Days, $232K
Day two at Pwn2Own Ireland 2026 added 45 zero-day vulnerabilities and $232,500 in prizes. Samsung Galaxy S26 fell three more times. Vendors have 90 days to patch.
MonsterCloud CEO Charged for Secret Ransom Scheme
Zohar Pinhasi charged with wire fraud after prosecutors allege he secretly paid ransomware operators while billing victims over $19 million for proprietary recovery services.
Critical LMCache Flaw Exposes LLM Servers to Unauth RCE
CVE-2026-105192, a CVSS 9.8 flaw in LMCache's multiprocess server, lets unauthenticated attackers run code on LLM inference infrastructure. No patch exists.
Atlassian CVE-2026-21589: Exploits Active, Patch Now
Active exploitation of CVE-2026-21589 began within hours of a public PoC. All eight affected Atlassian Data Center products need patching immediately.
Chrome 155 Patches 4 Critical UAF Bugs, 247 Total
Google shipped Chrome 155 with 247 fixes, including four critical use-after-free bugs in core browser components. No active exploitation reported yet.
CERT-UA: 100+ Sites Hijacked to Drop LunexStealer
Ukraine's CERT-UA tracked 100+ compromised sites serving LunexStealer through fake Cloudflare verification pages. Attributed to UAC-0277, observed September 2026.
Android October Patches Fix 25 Flaws, 7 Critical
Google's October 2026 Android update patches 25 vulnerabilities, including a critical System flaw that enables local privilege escalation without user interaction.
Langflow Patches CVSS 9.9 RCE in MCP Tool Handler
Any authenticated Langflow user on versions before 1.9.0 could execute arbitrary code on the server by adding a crafted MCP tool. Upgrade to 1.9.0 now.