13 casos · pág. 1/1
Apache disclosed eight vulnerabilities in Apache Tomcat, three rated Important and five rated Low. They cover authentication bypass, cross-user data exposure, insecure socket access and cryptographic configuration failures. Fixes are in Tomcat 11.0.27, 10.1.61 and 9.0.123, depending on the branch. Exposure depends on the component and con…
Microsoft Security Response Center (MSRC) announced on October 20, 2026 that it is replacing the multiple report quality levels in its bug bounty programs with two assessments: "Complete" and "Not Complete". The rules apply to reports submitted on or after October 20, 2026, 8 AM Pacific Time. Earlier submissions remain under the previous …
OpenAI announced an expanded ChatGPT integration for Google Chrome with two workflows. "Chat" reads content from open tabs to inform answers. "Work" controls tabs to send messages, fill out forms, download files, and organize or group tabs. The article presents this as a change that combines browser visibility with delegated actions, rais…
Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that allows unauthenticated, zero-click compromise of internet-facing email servers. Attackers deployed webshells, escalated privileges, harvested authentication secrets and staged mailbox data across organiz…
A Mac user (Reddit u/UntilHEX) reported that Anthropic's Claude Code found an unauthorized XMRig cryptominer while helping build a temperature-monitoring app. Abnormally high sensor readings led the assistant to inspect running processes and identify XMRig as the cause of roughly 1,175% CPU use, or nearly 12 saturated cores. The finding i…
A Chinese-speaking operator used autonomous AI agents on the open-source Cairn platform to compromise the websites of more than 100 companies. NorForge tracks the most active campaign as AIA0001: over 1,100 attack projects across 14 dashboards, and more than 1,200 break-in attempts overall. Targets were e-commerce businesses in the United…
Microsoft has warned that AI agents with access to enterprise systems can be manipulated through prompt injection, compromised inputs or shifts in task context. Agents do not need malicious intent to cause harm: their ability to read corporate data, invoke tools, approve transactions and talk to other agents widens exposure once untrusted…
Federal investigators examining ShinyHunters have uncovered potential links between the extortion group and executives at two ransomware negotiation firms, according to a KrebsOnSecurity report published on October 19. An executive at an unnamed U.S. consulting firm (reportedly 1,000+ employees) allegedly helped operate the group's extort…
OpenCode disclosed on X on October 17 a security breach affecting 1.4% of its Console users, which it attributes to a "large-scale distillation attack". The affected accounts belong to users who had connected external providers. The company emailed affected users the following morning and says anyone who did not receive a notice was not i…
On October 20, 2026, Google announced new Chrome defenses for users of Safe Browsing Enhanced Protection. They include a warning against ClickFix social engineering, in which suspicious commands copied by the user are scrubbed of personal information and sent to Safe Browsing for analysis (thehackernews.com, gbhackers.com). Google also ex…
Oracle released its October 2026 Critical Patch Update on October 20, the final quarterly update of the year. It delivers 1,295 security patches for 1,209 unique CVEs across 33 product families (tenable.com). The patch count is higher than the CVE count because one CVE can appear in several product matrices (gbhackers.com). 112 patches (8…
Horizon3.ai has released a public proof-of-concept exploit for CVE-2026-106173, a critical flaw in Fortinet FortiSIEM that lets unauthenticated attackers turn an arbitrary file write into remote code execution. Researcher Zach Hanley published the technical analysis on October 20, following Fortinet's advisory FG-IR-26-180 of October 13. …
The paid WordPress SEO plugin Rank Math PRO was hit by a supply chain attack. Copies of version 3.0.123 downloaded from the vendor's site or delivered as updates between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC contained malware (securityweek.com, thehackernews.com, bleepingcomputer.com). Any site that installed and activ…
