48 casos · pág. 3/3
CERT-FR advisory CERTFR-2026-AVI-1315 reports multiple vulnerabilities in Microsoft Azure components, published on 14 October 2026. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft published the corresponding security bulletins on 13 October 2026. …
CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being activ…
CERT-FR advisory CERTFR-2026-AVI-1333, published 16 October 2026, reports multiple vulnerabilities in the Ubuntu Linux kernel. Per the advisory, some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and compromise of data confidentiality. The advisory also lists data integrity compromise and secur…
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…
F5 released NGINX 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026 to fix five vulnerabilities. Three are memory-corruption bugs that F5 scores 9.2 (Critical) on CVSS v4.0, and they can crash a worker process or, in some conditions, allow code execution. The others are a TLS session-ticket flaw that can bypass client-certificate …
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
This SentinelOne weekly roundup covers three developments. The FBI arrested Edward Dubrovsky, a former CYPFER executive, on conspiracy and extortion charges. Kash Patel described him as a suspected co-conspirator of ShinyHunters, though he has not been officially named as one. The FBI says the group breached more than 140 organizations an…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
