OpenSSH: authentication bypass on musl systems without PAM
OpenSSH before 10.6p2: on Linux with musl and no PAM, an attacker logs in with two passwords. Conditions, log checks and mitigations per CERT-FR.
3 min read
Apple: Pointer Authentication bypass exploited (CVE-2024-27834)
CISA adds CVE-2024-27834 to the KEV catalog: a Pointer Authentication bypass in iOS, macOS and Safari fixed in 2024. Affected versions and what to do.
4 min read
WordPress CVE-2026-119977: CISA confirms active exploitation
The WordPress core upgrade race condition is now CVE-2026-119977 and in CISA’s KEV catalog: affected versions, fixed releases and what to do.
4 min read
SMS of Death: an invisible text message crashes Android
CVE-2026-58882: a malformed WAP Push message crashes Android telephony, emergency calls included. Public exploit, no fix for Android 12 and 13.
4 min read
Claude Code for Cursor: version 2.1.313 shipped an SSH backdoor
For 11 hours Cursor’s marketplace served the Claude Code extension 2.1.313 with an SSH backdoor: how it works, indicators and what to check.
5 min read
Drupal Commerce Core: critical access bypass exploited
CVE-2026-118539 in Drupal Commerce Core: unauthenticated access bypass, already exploited. Affected versions, updates and how to audit your orders.
5 min read
Ivanti Connect Secure: two more exploited flaws added to CISA KEV
CISA adds Ivanti Connect Secure CVE-2026-118527 (file upload) and CVE-2026-111357 (root via dsinvoked) to the KEV catalog: technical details and what to do.
4 min read
TeamViewer CVE-2026-111585: malicious host attacks the technician
Integer overflow in TeamViewer (CVSS 8.8): a malicious host can run code on the computer of the technician who connects to it. Fixed versions and next steps.
5 min read
WordPress update race condition with RCE draws exploit attempts
A race condition in WordPress core updates allows unauthenticated RCE and is already being probed. Affected versions, detection and what to do now.
5 min read
Binance: record $6.3 billion theft traced to a DevOps laptop
A compromised DevOps laptop and an abused hot wallet signing system: how the $6.3 billion theft from Binance happened and what to do right now.
6 min read
Cisco ASA and FTD: exploited remote DoS, CVE-2026-76418
CERT-FR reports CVE-2026-76418 in Cisco Secure Firewall ASA and FTD: a remote DoS that Cisco says is actively exploited. Affected versions and what to do.
4 min read
Cisco ASA/FTD CVE-2026-76418: who is exposed, how to mitigate
The Cisco ASA and FTD DoS zero-day hits SSL VPN with secondary authentication: conditions, CVSS 8.6, fixed releases, mitigation and the CISA KEV listing.
5 min read
Cisco SD-WAN: KeyDrift malware steals keys from controllers
The UAT-11473 group exploited CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to install KeyDrift, malware that steals data-plane keys.
5 min read
GitLab CVE-2026-97229: Alpine attacked, Ruby must be updated too
Attempted exploitation of CVE-2026-97229 against Alpine Linux’s GitLab: if you run GitLab on your own Ruby, you must update Ruby too. What to do now.
5 min read
GitLab CVE-2026-97229 exploited: CISA adds it to the KEV
CISA confirms exploitation of GitLab CE/EE RCE CVE-2026-97229 (CVSS 10). Which versions to install and which checks to run right now.
5 min read
PHP2Shell on PAN-OS: fixes for five branches and Panorama
Palo Alto fixes PHP2Shell in five PAN-OS branches and Panorama: attacks hit exposed management interfaces. No known WordPress site compromised.
5 min read
Polymarket: tampered DebugBear RUM script steals crypto
A tampered DebugBear monitoring script hijacked Polymarket users’ sessions to drain their accounts: the attack chain, loss estimates and defences to apply.
5 min read
DHS: Icepick exposes 41,000 employees and their access groups
Data on over 41,000 DHS employees, which the authors say came from the Okta single sign-on, is online: contacts, roles and access groups. What to do.
5 min read
FBI seizes Virtualine, a bulletproof host used by ransomware
The FBI has seized virtualine.net, a bulletproof host paid by ransomware and infostealer groups. How it worked, what is still online and what to check.
5 min read
Gemini 4 Carbon: Google’s AI for flaws, exploits and patches
Google unveils Gemini 4 Carbon: 88.2% at finding vulnerabilities and 54.8% at exploitation in its own tests. Access limited to defenders, and what to do now.
5 min read
Linux kernel: CVE-2026-46300 exploited, writes to the page cache
CVE-2026-46300 in the Linux kernel: ESP decryption can write over page cache pages. CISA lists it as exploited: affected versions and what to do now.
5 min read
NIST IR 8547: the deadlines to retire RSA and elliptic curves
NIST sets the dates: quantum-vulnerable public-key cryptography deprecated after 2030 and disallowed after 2035. What changes and what to do now.
5 min read
PHP2Shell and Fragnesia: root on PAN-OS firewalls in 15 minutes
PHP2Shell and Fragnesia (CVE-2026-46300) chained by a suspected Chinese group: root on 25 systems, PAN-OS firewalls included, and an Active Directory attack.
5 min read
So-net (Sony): 2.6 million customer records stolen
Unauthorised access to the customer database of So-net, Sony’s Japanese ISP: 2.58 million records and 54,401 email passwords stolen. Details and what to do.
5 min read
Veeam: nine vulnerabilities with RCE and privilege escalation
CERT-FR: nine CVEs in Veeam Backup & Replication, Agent for Linux, Backup for Microsoft 365 and Veeam ONE. Affected versions, fixed builds and what to do.
4 min read
VMware ESX: logging flaw exploited, CVE-2026-41709 in KEV
CVE-2026-41709: in VMware ESX a malicious administrator can perform operations without leaving a trace in the logs. CISA lists it as already exploited.
4 min read
Volt Typhoon: the Silent Train network and zero-days on consoles
Black Lotus Labs details Silent Train, Volt Typhoon’s ephemeral relay chains, and four zero-days in SD-WAN and management consoles. What to check now.
5 min read
WatchGuard Fireware OS: seven flaws, six critical, patch now
INCIBE-CERT reports seven vulnerabilities in WatchGuard Firebox Fireware OS, six critical: SIP proxy, Access Portal, FireCluster. Versions and what to do.
5 min read
Yoba: fake ChatGPT and Claude apps abuse signed binaries
Fake ChatGPT and Claude desktop apps on GitHub use executables signed by OpenAI and Anthropic to load the Yoba malware: attack chain and defenses.
5 min read
Adobe Commerce and Magento: CVE-2026-48356 exploited (CISA KEV)
CISA added CVE-2026-48356 (CVSS 9.3), a dangerous file upload flaw in Adobe Commerce and Magento, to the KEV catalog: affected versions and what to do.
4 min read
Apple iOS and macOS 27.2: 286 flaws, zero-day fix reaches iOS 18
Apple fixes 286 vulnerabilities in iOS and macOS 27.2 and brings the patch for CoreGraphics zero-day CVE-2026-86950 to iOS 18.7.11. Versions and priorities.
5 min read
EDK2 UEFI: CVE-2026-97631 flaw in server PXE boot
CVE-2026-97631 (CVSS 9.5) in the TianoCore EDK2 PXE driver: a malicious ICMP error runs code before Secure Boot. Who is affected and what to do now.
5 min read
ENGIE: partner platform breached, French customer data stolen
ENGIE confirms the theft of French customer data from a marketing tool used by its partners: what was exposed, what is still unknown and what to do now.
5 min read
GMO Internet: Onamae Desktop Cloud breached, data posted online
Unauthorized access to GMO Internet’s virtual desktop service for traders: 26,739 servers affected, an 8 billion yen ransom demand and data leaked.
4 min read
Italy’s Chamber of Deputies: mailboxes hit, Meloni’s included
Attack on three email accounts at Italy’s Chamber of Deputies on 27 October, Meloni’s included: what is known, unknown vector, urgent patches, what to do.
5 min read
Microsoft Authenticator Android: token theft without permissions
CVE-2026-80097: on Android, a malicious app could pose as a Microsoft app and obtain work account tokens from Authenticator, with no permissions needed.
4 min read
NetScaler ADC and Gateway: new builds for the PHP2Shell flaws
CERT-FR: NetScaler ADC and Gateway hit by CVE-2026-109618 and CVE-2026-109619, PHP flaws with RCE. Fixed builds 14.1-73.49 and 13.1-64.32: what to do.
4 min read
PHP2Shell added to CISA KEV catalog: first shells on honeypots
CISA adds CVE-2026-109618 and CVE-2026-109619 to its KEV catalog with an October 29 deadline. First successful RCE on mod_php honeypots: what to do.
6 min read
UNM Health cyberattack: ambulances diverted, clinics closed
On 26 October UNM Health diverted ambulances and halted more than 30 clinics. The BYOD group claims the attack: facts, doubts and what to do now.
5 min read
Anthropic files for IPO: the cyber risks it disclosed to the SEC
In its IPO filing Anthropic lists the risks of its models: prompt injection in agents, misuse in cyberattacks, gaps in its defenses. What to do now.
5 min read
Brotli CVE-2026-111497 added to KEV: .NET, PHP and Node.js fixes
Brotli flaw CVE-2026-111497 (Node2Shell): out-of-band fixes for .NET, Node.js, Python and PHP on Windows, public PoCs and addition to the CISA KEV catalog.
5 min read
CISA 2030: US strategy bets on detection and resilience
CISA publishes CISA 2030: three pillars, OT, software security and 60- and 180-day deadlines. What changes and what European companies should do.
4 min read
Compaction smuggling: OpenAI reasoning traces extracted via API
Xint bypassed OpenAI’s defences for encrypted reasoning using compaction, enabling distillation. Technical details and what to ask your AI providers.
4 min read
CERT-UA: Dahua cameras hijacked through the Easy4IP cloud
CERT-UA reports Dahua cameras and NVRs taken over via the Easy4IP P2P feature, even with no exposed ports. Attack vector, indicators and what to do.
5 min read
DreamHost resets email and FTP passwords after an incident
DreamHost reset passwords for some email and FTP/SFTP accounts after an unexplained incident. Timeline, what is known and what to check right now.
5 min read
Gheist: stolen GitHub tokens leak secrets through Actions logs
With stolen GitHub tokens, Gheist plants workflows in private repositories and prints secrets into Actions logs: how it works, how to spot it, what to do.
4 min read
Kali Linux 2026.3: six new tools and kernel 7.1.5
Kali Linux 2026.3 adds six tools, including snaffler-ng and rustscan, kernel 7.1.5, containerised builds and smartwatch wardriving with NetHunter.
5 min read
Magento: 953 online stores hit by a scanner-evading loader
Since July 2025 a group has planted a JavaScript loader in the CMS blocks of 953 stores, mostly Magento: domains, techniques, indicators and what to do.
5 min read