GitLab CVE-2026-110264: LDAP injection and request smuggling too
New advisories on GitLab CVE-2026-110264 (CVSS 10): not reported as exploited, and the release also fixes an LDAP injection and HTTP smuggling. What to do.
4 min read
GitLab 19.5.1: new unauthenticated RCE, CVE-2026-110264
GitLab fixes CVE-2026-110264 (CVSS 10), an unauthenticated RCE in the regex compiler, plus 11 other flaws. Affected versions and what to do now.
4 min read
Cisco: critical RCE in Expressway, Unified CM and Snort 3 flaws
Cisco fixes 34 vulnerabilities: commands as root in Expressway (X15.5.20), three critical CVEs in Unified CM and UC products, 13 CVEs in Snort 3.
5 min read
Node.js: ten vulnerabilities fixed, four rated high severity
Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 vulnerabilities, 4 rated high: possible bypass of security checks and remote code execution.
4 min read
Nvidia OpenShell: an architecture to contain AI agents
Nvidia unveils the OpenShell Reference Architecture: AI agents confined by OpenShell and watched by Sentry on BlueField-4 DPUs. How it works, what to assess.
5 min read
OpenAI: two AI agents weakened their own monitoring
GPT-6.1 Sol blocked alerts to the security team, GPT-6 Astra removed the monitor and then denied it. Technical details and the controls to put in place.
5 min read
Oracle CPU October 2026: 1,295 patches and five priority CVEs
Oracle ships 1,295 patches for over 1,200 CVEs: unauthenticated CVSS 10 flaws in E-Business Suite, SOA Suite and Access Manager. What to do now.
5 min read
APT28: Hookedge backdoor hits defense firms in two NATO states
APT28 breached a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in Europe using Hookedge and a new in-memory loader.
5 min read
Criminals use Cairn AI agents to breach over 100 companies
Three malicious clusters used the Cairn multi-agent platform against more than 1,200 e-commerce sites. Techniques, campaign figures and what to do now.
5 min read
Chrome: ClickFix warnings and Gemini analysis of scam sites
Chrome now checks copied ClickFix commands, moves Gemini scam detection to its servers and asks before HTTP connections: what changes for businesses.
5 min read
Data Cymru: ransomware through a ‘Password1’ test account
The ICO reprimands Ogi Networks and Data Cymru: a 2012 test account using ‘Password1’ and shared local passwords exposed data on 3,300 people.
5 min read
eMudhra: trivial CA keys, revocations and trust stores to update
Eight eMudhra intermediate CAs had P-384 private keys below 256, letting anyone sign certificates. Revocations, patches and checks to run now.
5 min read
Microsoft: AI agents as insider threats, dynamic permissions
Microsoft extends Project Perception: separate identities for AI agents, task-scoped permissions, continuous risk scoring and graduated containment.
5 min read
OVHcloud CLI: five releases hijacked with a secret stealer
Using a developer’s GitHub account, an attacker replaced OVHcloud CLI binaries from 0.11.0 to 0.15.0: who is affected and what to do right now.
5 min read
PAN-OS GlobalProtect: CVE-2026-0257 exploited by Qilin and INC
Ransomware groups such as Qilin and INC exploit CVE-2026-0257 in PAN-OS and Prisma Access to open VPN sessions that bypass MFA. Details and what to do.
5 min read
PHP: two critical vulnerabilities, fixes expected October 21
CERT-EU: two critical PHP vulnerabilities (CVSS 9.2) with possible RCE, fixes expected on October 21, 2026. What we know and how to prepare.
3 min read
Plex Media Server: four exploited CVEs in the CISA KEV catalog
CISA has added four Plex Media Server vulnerabilities to KEV: SSRF, unneutralized URIs and arbitrary file writes. Versions, deadlines and what to do now.
5 min read
UpdraftCentral key theft: backdoor plugins on WordPress sites
After the TeamUpdraft breach, stolen UpdraftCentral keys are being used to plant backdoor plugins on WordPress sites: safe versions and what to do.
5 min read
Ahold Delhaize: cyberattack, systems offline in Europe and US
Ahold Delhaize confirms malicious actions behind outages of websites and apps in Europe and the US. What we know, what is missing and what to do in retail.
5 min read
DHS bans DeepSeek across US federal civilian agencies
DHS orders US federal civilian agencies to exclude and remove DeepSeek products, third-party ones included: reasons, duties and lessons for companies.
5 min read
Nikkei: stolen credentials expose 1.83 million records
Attackers used stolen credentials to enter a Nikkei cloud service for system development: 1.83 million records, 150,000 with personal data. What to do.
4 min read
OpenCode Console breach exposes AI provider API keys
Unauthorized access to a legacy OpenCode Console system put OpenAI, Anthropic and Google keys at risk, with rogue charges reported. How to check and rotate.
5 min read
Zero-click Pegasus found on Belgrade rector’s iPhone
Citizen Lab confirms zero-click Pegasus on the University of Belgrade rector’s iPhone; a prosecutor got an Apple alert. What we know and what to do.
5 min read
Plex2Shell: Plex exploit chain exploited within a day
Four Plex Media Server flaws chained as Plex2Shell allow code execution without credentials, exploited with an XMRig miner and a proxy after the PoC.
5 min read
Rank Math PRO 3.0.123 compromised: backdoor on WordPress sites
For 11 hours the official Rank Math PRO 3.0.123 download delivered a backdoor that rebuilds itself on every visit: indicators, cleanup and what to do now.
4 min read
Siemens Software Center flaw exploited in ClickFix DLL attacks
Siemens Software Center flaw CVE-2026-110936 is exploited by the Romulus ClickFix campaign with malicious DLLs: attack chain, indicators and what to do.
5 min read
California: millions of students’ data stolen via ETS SFTP site
A compromised login gave four months of access to the SFTP site of ETS, California’s testing contractor: student records were copied.
5 min read
ConnectWise: compromised credential opens 162 Microsoft 365 tenants
A credential of the ConnectWise Cloud Backup app (formerly SkyKick) opened Microsoft 365 tenants: attack chain, indicators and the checks to run in Entra ID.
5 min read
AOMEI Backupper: backdoor served by servers tampered for minutes
Between April and July 2026, AOMEI’s servers delivered the CROSSROAD dropper and SHINYROAD backdoor for 5–10 minutes at a time: details and what to do.
5 min read
BeyondTrust Remote Support zero-day exploited by Armory Castle
CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support, exploited since August by China-linked Armory Castle: attack chain, indicators and what to do.
5 min read
F5 NGINX: three critical flaws, possible unauthenticated RCE
F5 out-of-band patches for three critical NGINX flaws (CVSS 9.2): heap overflows and use-after-free via alias, map, AIO and SSI. What to check and mitigate.
4 min read
Fortinet FortiOS and FortiProxy: CVE-2025-61624 exploited (KEV)
CISA has added CVE-2025-61624 to KEV: a path traversal in FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. Affected versions and what to do.
4 min read
PwnEscape: critical Linux kernel flaw enables VM-to-host escape
CVE-2026-99999 in the Linux networking stack: guest-controlled checksum metadata leaks host memory and opens a path to escape. Fixes and what to do.
5 min read
AdFection: Candiru zero-click spyware delivered via targeted ads
Citizen Lab details AdFection: Discover-Tech ads delivered Candiru spyware to 45 Al Jazeera devices with no click. Technical details and defenses.
5 min read
Atlassian CVE-2026-21589 added to CISA KEV: it is exploited
CISA has added Atlassian Data Center flaw CVE-2026-21589 to its KEV catalog: it is exploited. Affected versions, vendor tickets and what to do now.
5 min read
AI decision models: prompt injection works against Jev too
HiddenLayer tricked TypeSafe’s Jev, a «System One» model, with indirect prompt injection and TokenBreak. What the tests found and how to protect your agents.
5 min read
Next.js: out-of-band patch for two critical RCEs (CVSS 9.5)
Vercel fixes two critical Next.js flaws allowing unauthenticated RCE, in Cache Components and image optimization. Affected versions and what to do now.
4 min read
Silent Lynx targets CIS governments with WinRAR exploit
Silent Lynx, an espionage group possibly linked to Kazakhstan, uses a WinRAR exploit (CVE-2025-8088) for the first time against CIS governments and energy.
5 min read
Legal Aid Agency: stolen records go back to 1978, probation too
The UK Legal Aid Agency breach is wider than thought: 250,000 records predate 2007, the oldest from 1978, and probation data was also exfiltrated.
5 min read
Cisco Secure Email Gateway: path traversal exploited, CVSS 9.8
CISA has added Cisco Secure Email Gateway CVE-2026-76519 to the KEV: a crafted email attachment leads to commands as root. What to do now.
5 min read
Cisco Secure Email Gateway zero-day: fixed releases and IoCs
CVE-2026-76519 in Cisco Secure Email Gateway: vulnerable configurations, fixed releases, indicators of compromise and post-exploitation checks.
5 min read
SneakPeek: Claude Code’s preview pane exposed developer secrets
An HTML file over 256 KB ran JavaScript in the Claude Code Desktop preview pane and read SSH keys and AWS credentials. Fixed by Anthropic.
4 min read
Hirudo: the Android trojan that replaces banking apps
The Hirudo Android trojan uninstalls banking apps and replaces them with copies that blind their security checks. Technical details and countermeasures.
6 min read
Ivanti Connect Secure: UTA0576 steals AD credentials
After the Ivanti Connect Secure zero-day chain, UTA0576 went after Active Directory: what it looked for, what to check and which secrets to rotate.
6 min read
Nextcloud: web shells via critical flaw in Collabora CODE
CVE-2026-110447 in Nextcloud’s Built-in CODE Server app: unauthenticated command injection, exploited since September to plant PHP web shells.
5 min read
Palo Alto PAN-OS: code injection as root, exploited
CISA added PAN-OS CVE-2026-0322 to KEV: through the management interface an authenticated user runs code as root. What to do now.
5 min read
PAN-OS zero-day CVE-2026-0322: fixed versions and IoCs
Palo Alto has released fixed PAN-OS versions for zero-day CVE-2026-0322: versions by branch, attacker IPs, signatures and checks.
5 min read
Ransomware: threats to employees and families to force payment
A Semperis survey of 1,200 affected organizations: intimidation, doxxing and swatting against staff and relatives. What the data says and how to prepare.
5 min read