273 casos · pág. 2/14
Rust 1.100, scheduled for November 12, 2026, will stabilize Cargo dependency cooldowns. Developers can reject newly published crate versions until they reach a configurable minimum age. The aim is to give researchers, maintainers and registries time to detect malicious releases before automated updates spread them across development envir…
Robert Wayne Boling Jr., a 45-year-old US citizen living in Angeles City, Philippines, pleaded guilty to conspiracy to commit wire fraud and money laundering, the US Department of Justice announced. Prosecutors call him the principal orchestrator of a scheme that used stolen PII to compromise bank accounts of thousands of US servicemember…
Google, Mozilla, Apple, the Go project and other organizations moved quickly to block certificates issued by the Indian certificate authority eMudhra. The certificates are tied to 8 compromised keys. It is unclear how the keys were compromised. The source text available is limited to the headline and a short summary, so the scope of the a…
Automotive AI startup IQ.Lvbs claims that between October 7 and 14, 2026 it faced repeated attempts to steal its NovaSpark driving model, access users' devices and private driving files, and exploit its sign-in system. The company says the first requests came from an IP address assigned to Comma.ai Inc., a rival whose camera hardware Nova…
A 40-year-old Nigerian national, Chukwuemeka Victor Amachukwu, was sentenced to eight years in prison by a US federal court for a 2019-2023 scheme that combined hacking of US tax preparation businesses, filing of fraudulent tax returns and fake investment fraud. He used identities stolen from victim organizations to file false returns wit…
A former OpenAI engineer with reported Saudi ties was detained after allegedly planting a secret recording device in a conference room at OpenAI's headquarters. Dark Reading presents the case as an example of a preventable insider threat vector. The available text is only a short teaser, so it gives no detail on the device, how long it wa…
Objective-See analyzed Heartbreaker, a previously unknown macOS ransomware sample (ad hoc-signed ARM64 Mach-O written in Rust). It was uploaded to VirusTotal in May 2025 and remains undetected by all AV engines. It was found by researcher Megan Carney. It encrypts files in ~/Downloads with AES-256-GCM, renames them to .heartbreaker, drops…
Hardware hacker Joe Grand found tampered Trezor Model T and Trezor One wallets sold through unauthorized third-party channels (Facebook Marketplace in Canada in 2025, and a TikTok shop in August 2026, shipped from China). The attackers replaced the microcontroller with one running malicious firmware that hands users one of about a dozen p…
Palo Alto Networks PSIRT published advisory CVE-2026-0318, a denial-of-service (DoS) vulnerability in PAN-OS affecting Panorama management appliances. The excerpt lists affected builds across the 11.1, 11.2, 12.1 and 12.2 release trains, including many hotfix (h) builds. It gives no CVSS score, attack vector, authentication requirements, …
Palo Alto Networks disclosed CVE-2026-0313, an OS command injection vulnerability (CWE-78) in the OS Query content pack for Cortex XSOAR and Cortex XSIAM. An authenticated administrator can execute arbitrary OS commands on remote endpoints. The vendor rates it MEDIUM with MODERATE suggested urgency (CVSS-BT 6.1 / CVSS-B 8.6) and states it…
Palo Alto Networks PSIRT published advisory CVE-2026-0314, a local denial-of-service (DoS) vulnerability in the GlobalProtect App for Windows. The advisory lists a wide range of affected releases across the 6.0, 6.2 and 6.3 branches. The excerpt gives no CVSS score, exploitation status, attacker prerequisites or fixed versions. Defenders …
Palo Alto Networks published advisory CVE-2026-0312 describing path traversal vulnerabilities (CWE-22) in Checkov by Prisma Cloud that let an unauthenticated local user write files to arbitrary locations on the scanning filesystem. No special configuration is required to be exposed. The vendor rates it MEDIUM (CVSS-B 6.8, CVSS-BT 4.3) wit…
Palo Alto Networks PSIRT published advisory CVE-2026-0315, a local privilege escalation vulnerability in the GlobalProtect App on macOS. The excerpt lists affected versions only, in the 6.2.x and 6.3.x branches. It gives no CVSS score, root cause, exploitation status, or fixed versions. Defenders running GlobalProtect on macOS endpoints s…
Palo Alto Networks PSIRT published an advisory for CVE-2026-0317, a denial-of-service vulnerability in PAN-OS, the operating system of its firewalls. The text provided contains only the advisory title and a list of affected-version CPE entries. It does not give a CVSS score, attack conditions, exploitation status or fixed versions. Defend…
Palo Alto Networks PSIRT published advisory CVE-2026-0320, an authenticated admin command injection vulnerability in PAN-OS. The advisory lists a wide range of affected releases across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches, including many hotfix builds. The excerpt provided does not mention active exploitation, a CVSS score, or fix…
Palo Alto Networks PSIRT published advisory CVE-2026-0307 covering local privilege escalation vulnerabilities in the GlobalProtect App. The affected product list spans Linux, macOS, Windows, iOS, Android and ChromeOS clients. The advisory excerpt provided contains no CVSS score, exploitation status, technical root cause or fix details, so…
The FBI issued a Public Service Announcement through IC3 cautioning that threats against election workers endanger individuals and jeopardize the stability of the US electoral process ahead of the November 2026 midterm election. The FBI defines election workers broadly: elected and appointed officials, staff, volunteers, contractors, vend…
The FBI warns that scammers are likely to exploit the 2026 US Midterm Election to run financial fraud schemes against victims across the United States. The PSA updates alert I-102924-PSA from 29 October 2024. Scammers use candidates' names, images, logos and slogans to solicit fake campaign contributions, sell merchandise that is never de…
The FBI and CISA issued a joint Public Service Announcement warning that malicious cyber actors may use phishing and smishing against election officials, candidates and political organizations ahead of the 2026 U.S. midterm elections. These targets are attractive because of their access to voter registration data, current government offic…
CERT-FR advisory CERTFR-2026-AVI-1328, published 16 October 2026, reports multiple vulnerabilities in the Mattermost Desktop App. The vendor did not specify the security impact, and the advisory only states that an attacker could cause an unspecified security problem. It is based on Mattermost security bulletins MMSA-2026-00778 and MMSA-2…
