Friday, October 16, 2026
Published 7:01 AM · 120 articles from 14 sources · about 5 min to read in full
Cyber security
Perimeter and server software supplied most of the day's exploitation and patching, across BeyondTrust, Collabora, FortiOS and Atlassian, plus a large batch of patches for web infrastructure. Supply-chain and ICS advisories round out the list.
What happened
Drupal fixed a critical RCE in Field UI in versions 11.4.10, 11.3.19 and 10.6.19. A no-login exploit path exists via contributed modules, so core patching alone may not settle exposure. The Hacker News ↗
Next.js shipped an out-of-band patch for two critical unauthenticated RCE flaws, in React Server Components caching and in librsvg SVG processing. Separately, NGINX 1.30.6 and 1.31.7 fix five bugs, including a possible RCE and a TLS bug that may skip client-certificate checks. The Hacker News ↗
A suspected advanced actor is exploiting Fortinet FortiOS flaw CVE-2025-61624 to deploy PEERSTITCH, memory-resident ARM64 malware. The flaw bypasses checks on tagged VPN sessions. The Hacker News ↗
CISA added Atlassian's CVE-2026-21589, a multi-product flaw that exposes files or directories to external parties, to the KEV catalog because of active exploitation. CISA Advisories ↗
A threat actor uploaded malicious AUR packages impersonating the yay and paru helpers. The packages run malware with root privileges, so Arch users should check what they installed. BleepingComputer ↗
Seven stable Linux kernels shipped with a fix for a critical skb_checksum_help() flaw that corrupts network headers. The summary does not say whether this is the PwnEscape fix, so check the changelogs. LWN.net ↗
CISA ICS advisories: EseeCloud IP camera app and firmware use hard-coded credentials (CVSS 9.8), and J4Care dcm4chee-arc-light 5.35.1 has flaws (CVSS 9.1) enabling medical image deletion and patient data disclosure. CISA Advisories ↗
Hackers behind the UK Legal Aid Agency breach stole records dating back to 1978, including probation service data. The Register ↗
Articles the model saw · 45
China-nexus group Armory Castle exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support as a zero-day to take over servers.
The Hacker Newscvezero-dayaptbeyondtrustchinaFeed excerpt
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a
Attackers are actively exploiting CVE-2026-110447, a critical RCE in Collabora Online CODE Server for Nextcloud, to install backdoors.
BleepingComputercvenextcloudcollaboraexploitedrceFeed excerpt
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
A critical Linux kernel networking flaw, CVE-2026-99999 (PwnEscape), lets VM guests read host memory, confirmed exploitable on Vercel sandboxes.
The Hacker NewscvelinuxkernelvirtualizationvercelFeed excerpt
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
Drupal fixed a critical remote code execution flaw in Field UI in versions 11.4.10, 11.3.19, and 10.6.19, with a no-login exploit path via contributed modules.
The Hacker NewsdrupalrcecvepatchFeed excerpt
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
A cyberattack on government contractor BAE Systems took down the notice system used by federal bankruptcy courts.
BleepingComputercyberattackbae-systemsgovernmentFeed excerpt
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
BeyondTrust urged customers to patch a critical Remote Support flaw exploited as a zero-day since late August.
BleepingComputercvezero-daybeyondtrustexploitedFeed excerpt
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
A suspected advanced threat actor exploits Fortinet FortiOS flaw CVE-2025-61624 to deploy memory-resident ARM64 malware PEERSTITCH.
The Hacker NewscvefortinetmalwareaptFeed excerpt
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Targeted ads were used to deliver zero-click exploits installing mercenary spyware, likely the first confirmed case of this delivery method.
Ars Technicaspywarezero-clickexploitFeed excerpt
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.
A threat actor uploaded malicious AUR packages impersonating the yay and paru helpers, running malware with root privileges.
BleepingComputersupply-chainmalwarearch-linuxFeed excerpt
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
An Israeli firm reportedly delivers zero-click spyware through online ads, per a Verge report.
Hacker News (front page)spywarezero-clickadsFeed excerpt
Article URL: https://www.theverge.com/tech/1011956/discover-tech-zero-click-ads-spyware Comments URL: https://news.ycombinator.com/item?id=50106676 Points: 82 # Comments: 7
Citizen Lab found Israeli spyware maker Candiru infected Al Jazeera devices via zero-click malicious online ads that executed without user interaction.
The Hacker Newsspywarezero-clickcitizen-labadvertisingFeed excerpt
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen
Citizen Lab and Confiant report Israeli ad firm Discover-Tech delivered zero-click spyware via online ads, including to Al Jazeera.
The Vergespywarezero-clickadtechFeed excerpt
An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, by simply showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. It's the first time researchers have found technical evidence of a zero-click attack - a form of hacking that requires no action by users - delivered through targeted advertising, as reported earlier by NBC News. The ad firm, called Discover-Tech, presents itself as a typical online advertising agency, but researchers say it actually provides a pipeline for hacking groups to plant malicious ads across the web. It operat … Read the full story at The Verge.
Seven stable kernels released include a fix for a critical skb_checksum_help() flaw that corrupts network headers.
LWN.netlinuxkernelcvepatchFeed excerpt
Greg Kroah-Hartman has announced the release of the 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223, and 5.10.272 stable kernels. This series includes, among other things, a fix for a critical vulnerability (CVE-2026-99999). The flaw in skb_checksum_help() would allow an IPv4 packet with bad checksum metadata to "corrupt the network header and cause a bunch of mischief" in the words of patch author Michael S. Tsirkin. As usual, all users are advised to upgrade.
NGINX 1.30.6 and 1.31.7 fix five vulnerabilities, including possible RCE and a TLS client-cert bypass.
The Hacker NewsnginxcvetlspatchFeed excerpt
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could
Next.js shipped an out-of-band patch fixing two critical unauthenticated RCE flaws in React Server Components and librsvg.
The Hacker NewsnextjsrcecvepatchFeed excerpt
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in
CISA advisory: J4Care dcm4chee-arc-light 5.35.1 has multiple flaws (CVSS 9.1) enabling medical image deletion and patient data disclosure.
CISA Advisoriescvehealthcaremedical-imagingFeed excerpt
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versions of J4Care dcm4che are affected: dcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667) CVSS Vendor Equipment v3 9.1 J4Care dcm4chee-arc-light 4 Vulnerabilities Missing Authorization, Loop with Unreachable Exit Condition ('Infinite Loop'), Inefficient Algorithmic Complexity, Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: Austria Vulnerabilities Expand All + CVE-2026-97851 The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database. Read More …
CISA advisory: EseeCloud IP camera app and firmware use hard-coded credentials, allowing attackers to gain control (CVSS 9.8).
CISA Advisoriescveiothard-coded-credentialscamerasFeed excerpt
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) EseeCloud Firmware <=4.9.86.0 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) CVSS Vendor Equipment v3 9.8 Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App 3 Vulnerabilities Use of Hard-coded Credentials, Improperly Controlled Modification of Dynamically-Determined Object Attributes, Observable Response Discrepancy Background Critical Infrastructure Sectors: Energy, Communications, Transportation Systems, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-107617 An attacker can use a hard-coded credential to log in to EseeCloud devices. Read More 2 Affected Products Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App: <=4.9.6 Product Status: known_affected Remediations Mitigation Guangzhou Juan IoT Technology Co., Ltd. did not respond to CISA's coordination attempts. EseeCloud u…
CISA added CVE-2026-21589, an Atlassian multi-product flaw exposing files or directories to external parties, to the KEV catalog due to active exploitation.
CISA Advisoriescvekevatlassianactively-exploitedFeed excerpt
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to …
Hackers behind a UK Legal Aid Agency breach stole records dating back to 1978, including probation service data.
The Registerbreachdata-theftukFeed excerpt
Nearly 50 years of data caught up in breach, with probation service records also among the haul
Linux 7.4 will add support for Intel Instruction Timeout to mitigate denial-of-service attacks against Intel TDX virtual machines.
PhoronixlinuxinteltdxkernelFeed excerpt
Linux 7.4 is enabling support for a new Intel CPU feature for providing safety against possible denial of service attacks using Trust Domain Extensions "TDX" VMs. The new feature is Intel Instruction Timeout and previously in-development known as Notify VM Exit...
Microsoft warns the October KB5127648 Windows 11 update may prevent some users from enabling Smart App Control.
BleepingComputerwindowsmicrosoftupdateknown-issueFeed excerpt
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
An arXiv paper demonstrates GPS Signal Nullification, a blind physical-layer attack that suppresses satellite signals via destructive interference.
arXiv cs.CR (Cryptography & Security)gpsphysical-layerresearchFeed excerpt
arXiv:2610.20831v1 Announce Type: new Abstract: The Global Positioning System (GPS) provides critical positioning, navigation, and timing (PNT) services for numerous safety- and mission-critical applications, making it an attractive target for physical-layer attacks. While GPS spoofing and jamming have been extensively studied, GPS Signal Nullification (GSN)-a physical-layer attack that suppresses authentic satellite signals through destructive interference prior to acquisition-remains largely unexplored. Existing wireless signal nullification techniques target conventional communication systems and typically require victim-side information, such as channel estimates or synchronization parameters, making them impractical for GPS. Furthermore, many GPS spoofing defenses assume authentic satellite signals remain available as trusted references, an assumption invalidated by GSN. To address this gap, we present GhostLock, a learning-assisted blind GSN framework requiring only an approximate target location estimate. GhostLock integrates a Blind Adaptive Filter (BAF) with a deep learning-based synchronization module to generate and align an anti-signal using only the attacker's locally …
Does Client Diversity Protect the Lightning Network? Evidence from the 2026 Core Lightning Shutdown3
Study uses a 2026 Core Lightning shutdown as a natural experiment to test whether client diversity protects the Lightning Network.
arXiv cs.CR (Cryptography & Security)lightning-networkbitcoinresearchFeed excerpt
arXiv:2610.20952v1 Announce Type: new Abstract: Client diversity is often cited as the Lightning Network's defence against a bug in any one implementation, yet LND runs 84% of public nodes and holds 84% of public channel capacity, a share that has barely moved since 2023. We test what diversity buys with a natural experiment. On 26 August 2026, amid security fixes in every implementation, Core Lightning (CLN) maintainers told operators who could not upgrade to disconnect their nodes. Using 805 daily gossip snapshots, 132,360 on-chain channel closes and a client classifier validated against self-identifying aliases and against the wallet that builds each node's funding transactions, we find that 22% of CLN nodes went dark overnight, ten times the usual rate, mostly Tor-reachable ones; a third were still dark five weeks later. The rest of the network barely noticed. Reachability among all node pairs fell by 7.8 percentage points, a loss exceeded in 4 of 94 ordinary two-day windows and half that of a Tor denial-of-service wave in July, while among CLN pairs it fell by 24.5 points, more than in any ordinary window. Calibrated failure scenarios explain the containment: the blast radius …
PAGE404 attack shows how NVIDIA Grace Hopper GH200 hardware-assisted page migration can be abused to break GPU isolation.
arXiv cs.CR (Cryptography & Security)gpunvidiaside-channelFeed excerpt
arXiv:2610.20962v1 Announce Type: new Abstract: NVIDIA's Grace Hopper (GH200) superchip represents a new generation of heterogeneous computing, tightly integrating a 72-core Arm-based CPU with a Hopper GPU on a single module via a high-bandwidth, cache-coherent interconnect. By eliminating the conventional PCIe bottleneck for CPU-GPU data movement, this design establishes a unified memory domain that scales to the capacities demanded by generative AI and high-performance computing (HPC) workloads. The architecture also introduces hardware-assisted page migration: driven by access counters, the system dynamically promotes frequently accessed pages from host CPU memory to GPU DRAM to improve memory locality. We study the security of this emerging architecture against new side- and covert-channel attacks targeting its page migration support. We analyze counter-driven migration across both the hardware mechanisms and the UVM driver's interrupt-handling pipeline, and identify two side-channel vulnerabilities: one rooted in the shared structure of access counters, and the other in the driver's response to migration interrupts. We further show that both channels are exploitable across Mul…
Studies filesystem capability laundering in MCP servers, where attacker-steered arguments reach sensitive host files beyond declared tool scope.
arXiv cs.CR (Cryptography & Security)arxivmcpai-agentsFeed excerpt
arXiv:2610.22301v1 Announce Type: new Abstract: The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluate exploitability and sandbox containment via paired dynamic execution. Across 21,097 MCP servers from nine registries, 787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite non-filesystem functional classifications. Dynamic three-…
GoLeash proposes enforcing per-package least-privilege runtime policies to mitigate Go software supply chain attacks.
arXiv cs.CR (Cryptography & Security)golangsupply-chainresearchruntime-policyFeed excerpt
arXiv:2505.11016v2 Announce Type: replace Abstract: Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package dependency chain. These attacks are especially concerning for the Go language ecosystem, which is extensively used in critical cloud infrastructures. We present GoLeash, a novel system that applies the principle of least privilege at the package-level granularity, by enforcing distinct security policies for each package in the supply chain. This finer granularity enables GoLeash to detect malicious packages more precisely than traditional sandboxing that handles security policies at process- or container-level. Moreover, GoLeash remains effective under obfuscation, can overcome the limitations of static analysis, and incurs acceptable runtime overhead.
Commenters report Epic's EAC2 v2 anti-cheat appears fairly easily bypassable.
Lobstersanti-cheatgamingbypassFeed excerpt
Comments
Google introduced AI-powered Android defenses against scam messages and call-forwarding abuse, rolling out to eligible devices.
BleepingComputerandroidgooglescamsaiFeed excerpt
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
Researchers had warned in August that attackers could disrupt refrigeration systems, months before French supermarkets were hit by an attack.
The Registerot-securityincidentfranceFeed excerpt
They tried to sound the alarm in August
The Hacker News weekly roundup covers Adobe RCE, DNS wallet theft, an NVIDIA container escape, and a self-healing backdoor among 23 other stories.
The Hacker NewsroundupweeklyvulnerabilitiesFeed excerpt
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
A proxyjacking campaign hijacked D-Link and Ubiquiti devices across 34 countries, reselling victims' bandwidth through a commercial residential proxy network.
BleepingComputerproxyjackingiotbotnetFeed excerpt
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
Silent Lynx is conducting attacks on CIS government organizations using crafted WinRAR archives, macro documents, and PowerShell to deploy reverse shells.
The Hacker Newsaptwinrarespionagereverse-shellFeed excerpt
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives
Research analyzing 217M web responses finds prompt injection attempts embedded in HTTP headers.
Hacker News (front page)prompt-injectionhttpllmFeed excerpt
Article URL: https://www.signalscorps.com/blog/prompt-injection-in-http-headers/ Comments URL: https://news.ycombinator.com/item?id=50104310 Points: 13 # Comments: 0
The Help TDS traffic distribution system, linked to the Hotejka affiliate program, has abused over 20,000 Cloudflare Pages domains for tech support scams.
The Hacker NewsscamcloudflaretdsFeed excerpt
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting
Security updates were issued across AlmaLinux, Debian, Fedora, Mageia, and Oracle Linux distributions.
LWN.netadvisorieslinuxpatchesFeed excerpt
Security updates have been issued by AlmaLinux (environment-modules, flatpak-builder, kernel, kernel-rt, librabbitmq, libreoffice, libsoup, mod_auth_openidc:2.3, nodejs:22, nodejs:24, OpenEXR, opentelemetry-collector, pki-core:10.6, postgresql:12, python-tornado, python36:3.6, ruby:3.3, tftp, and xorg-x11-server), Debian (buildstream, firefox-esr, mariadb, and sogo), Fedora (exim, freerdp, python3-docs, and python3.14), Mageia (drakx-installer-images, kernel, kmod-nvidia-current-wopengpu, kmod-virtualbox), Oracle (curl, emacs, environment-modules, flatpak, flatpak-builder, gd, hplip, kbd, kernel, librabbitmq, libreoffice, libxml2, microcode_ctl, mod_auth_openidc:2.3, nodejs:22, OpenEXR, pcre2, perl-DBI, python-tornado, rsyslog, tftp, thunderbird, and xorg-x11-server), Red Hat (compat-libtiff3, firefox, ghostscript, idm:DL1, ipa, kernel, kernel-rt, libtiff, lrzsz, and mariadb-connector-c), Slackware (libarchive), SUSE (amazon-cloudwatch-agent, bind, container-suseconnect, containerd, glibc, google-osconfig-agent, helm, kernel, python312, python313-oletools, python313-openpyxl, python313-orjson, python313-paramiko, python313-pipreqs, python313-py, python313-pycryptodome, python313-py…
X removed 13,000 accounts it linked to suspected Iran, Russia, and China meddling ahead of US midterms, without public evidence.
The Registerxinfluence-operationselectionsFeed excerpt
Platform points to Iran, Russia, and China but provides no public evidence for attribution
CISA advisory: Thermo Fisher Torrent Suite <=5.18 has a path traversal flaw (CVE-2026-107777, CVSS 6.5) allowing arbitrary file reads.
CISA Advisoriescvepath-traversalhealthcareicsFeed excerpt
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software <=5.18 (CVE-2026-107777) CVSS Vendor Equipment v3 6.5 Thermo Fisher Torrent Suite Software 1 Vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities CVE-2026-107777 The affected product is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account. Read More 1 Affected Product Thermo Fisher Torrent Suite Software: <=5.18 Product Status: known_affected Remediations Vendor fix Thermo Fisher has fixed the vulnerability and recommends users update Torrent Suite Software to version 5.22 or later. Mitigation For more information, refer to Thermo Fisher's Security bulletin. Additional Metrics Relevant CWE: CWE-22 Improper Limitation of a Pathname …
CISA advisory: Eclipse Milo OPC UA Java stack vulnerabilities could allow data deletion, credential recovery, or server denial of service.
CISA Advisoriescveopc-uaicsopen-sourceFeed excerpt
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Eclipse Milo are affected: Eclipse Milo >=0.6.0| =1.0.0| =1.0.0| =1.0.0| =0.6.0| =1.0.0| =0.6.0| =1.0.0| =1.0.0| =0.6.0| =1.0.0| =0.6.0| =1.0.0| =0.6.0| =1.0.0| =0.6.0| =0.6.0| =1.0.0| =0.6.0| =1.0.0| =0.6.0| =0.6.0| =1.0.0|<=1.1.4 Product Status: known_affected Remediations Vendor fix The Eclipse Foundation recommends users upgrade to Eclipse Milo 1.1.5 https://github.com/eclipse-milo/milo/releases/tag/v1.1.5. Mitigation For users on Milo 0.6.x, there are no 0.6.x releases with the fixes, which requires users to migrate to Milo 1.1.5 or later. Additional Metrics Relevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N View CVE Details Acknowledgments Abhinav Agarwal reported these vulnerabilities to CISA.…
CISA advisory: CISA Malcolm network traffic analysis tool versions up to v26.08.0 has six flaws, including authentication bypass and SSRF (CVSS 8.1).
CISA Advisoriescveauthentication-bypassssrfFeed excerpt
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362) CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification) Background Critical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-107336 Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one …
INTERPOL-coordinated operation in 17 countries arrested 95 suspects for distributing child sexual abuse material via messaging groups.
BleepingComputercsaminterpollaw-enforcementFeed excerpt
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. [...]
ANY.RUN linked 1,258 sandbox analyses from April to October 2026 to fake AI-product campaigns distributing malware against US businesses.
The Hacker NewsmalwarephishingmspFeed excerpt
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks
A Register anecdote describes a school user who resisted password changes, and staff suspected a second ransomware attempt.
The RegisterransomwarepasswordseducationFeed excerpt
School staff seemed to be trying to get ransomware – for a second time
An arXiv paper gives the first peer-reviewed forensic analysis of microSD artifacts from HackRF One devices running Mayhem firmware.
arXiv cs.CR (Cryptography & Security)forensicssdrresearchFeed excerpt
arXiv:2610.20647v1 Announce Type: new Abstract: Software-defined radios (SDRs) have become an inexpensive, portable platform for replay attacks, location spoofing and jamming. The HackRF One can operate stand-alone when fitted with a PortaPack interface board running the open-source Mayhem firmware. No peer-reviewed study has addressed the forensic analysis of this device family. This work establishes, at source-code level, where forensically relevant data reside on the microSD card of a device running Mayhem v2.0.1, in which format, when they are written and how they should be interpreted. The methodology is applied to an SD card image that the author acquired from their own device after four months of real use, and every inference is drawn from the image alone. The workflow covers timestamp rules that depend on the real-time clock (RTC) battery state, traces of on-device trimming and text editing, cluster-level recovery of deleted in-phase/quadrature (IQ) captures, and decoding of recorded signals cross-checked with an independent decoder. In the example image, the final part of a deleted IQ capture and a trimmed-away capture segment are recovered, and six captures are attributed…
An arXiv paper empirically evaluates six classical ML models for cloud cryptojacking detection using proxy datasets.
arXiv cs.CR (Cryptography & Security)cryptojackingmlresearchFeed excerpt
arXiv:2610.20658v1 Announce Type: new Abstract: Artificial intelligence (AI) has been widely applied to cloud cryptojacking detection. Classical machine learning models remain among the most widely used approaches for cloud cryptojacking detection. This paper presents an empirical evaluation of six widely used classical machine learning models for AI-based cloud cryptojacking detection under different preprocessing and evaluation settings. Because no public cloud-native cryptojacking dataset is currently available, experiments were conducted using two publicly available proxy datasets, DS2OS and NSL-KDD. The evaluated models include Random Forest, XGBoost, LightGBM, Gradient Boosting, Decision Tree, and K-Nearest Neighbors (KNN). Experimental results show that preprocessing choices and evaluation protocols have a measurable impact on model performance. On DS2OS, removing identifier-related features reduced the accuracy of most models to approximately 96%, while KNN achieved higher accuracy with lower attack recall. On NSL-KDD, models obtained 77 to 80\% accuracy on the official test set containing unseen attack types, compared with above 99.5% under a random train-test split. Attac…
An arXiv paper proposes CKKS homomorphic encryption for privacy-preserving health-misinformation classification and semantic retrieval.
arXiv cs.CR (Cryptography & Security)homomorphic-encryptionprivacyresearchFeed excerpt
arXiv:2610.20796v1 Announce Type: new Abstract: Health-misinformation analysis presents a dual challenge: misleading claims can affect public well-being, while systems designed to detect them may expose sensitive user-submitted text. This motivates privacy-preserving inference for public-health applications in which user queries may contain confidential medical information and trained models and reference databases are maintained on organizational servers. We design a privacy-preserving text inference framework based on CKKS homomorphic encryption for health-misinformation classification and semantic retrieval. The classification pipeline fuses BioBERT embeddings, PCA-reduced MPNet embeddings, and SVD-reduced TF-IDF features, while the retrieval pipeline combines MPNet embeddings with ISCC-SCT semantic fingerprints through late fusion. We evaluate predictive performance and benchmark plaintext versus ciphertext-based execution. The hybrid classifier achieved an accuracy of 0.971 and a macro-F1 score of 0.950, with identical reported metrics under plaintext and ciphertext-based inference. The hybrid late-fusion similarity model achieved a Pearson correlation of 0.8691 with human sen…