83 casos · pág. 1/5
On October 19, 2026, Cloudflare learned that the private keys of eight eMudhra intermediate certificates had been compromised. The certificates were widely trusted by browsers, operating systems and Cloudflare itself. Because the keys are weak, an attacker could forge a certificate for any domain and impersonate servers to intercept or mo…
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Four affect Plex Media Server: CVE-2026-96652 and CVE-2026-96655 (SSRF), CVE-2026-96654 (improper neutralization of encoded URI schemes) and CVE-2026-96656 (external control of file name or path). The other two are…
Zeabur, a developer hosting and deployment platform, disclosed that on October 14-15, 2026 an attacker used leaked internal credentials stored in plaintext to compromise its shared clusters, some Dedicated Servers and internal systems, and ultimately read the production database. The breach affected shared clusters in nine regions, 321,81…
An attacker holding valid UpdraftCentral dashboard private keys installed backdoor plugins on connected WordPress sites in an 18-hour campaign on 18-19 October 2026. Patchstack telemetry shows installations across a broad set of sites between 18 Oct 15:32 and 19 Oct 09:23 UTC. This is not a vulnerability in UpdraftPlus: the commands are c…
CERT-FR advisory CERTFR-2026-AVI-1325, published 15 October 2026, reports a vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows a remote attacker to execute arbitrary code and compromise data integrity. Cisco states that CVE-2026-76519 is actively exploited. The advisory is based on Cisco security advisory c…
CERT-FR advisory CERTFR-2026-AVI-1317 is not the source here; this record covers CERTFR-2026-AVI-1326, which reports multiple vulnerabilities in Palo Alto Networks products fixed in vendor bulletins of October 14, 2026. Some flaws allow remote arbitrary code execution, privilege escalation and remote denial of service. Other impact classe…
CERT-FR advisory CERTFR-2026-AVI-1314 reports multiple vulnerabilities in Microsoft Windows and related components, covered by Microsoft's October 13, 2026 security bulletins (ADV260001 and dozens of CVEs). Some of them allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass and compro…
CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being activ…
CERT-FR advisory CERTFR-2026-AVI-1311 reports multiple vulnerabilities in Ivanti products, covering Connect Secure (ICS), Neurons for UEM and Xtraction. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality and integrity. Ivanti states that CVE-2026-104935 is bein…
iRhythm Technologies, maker of the Zio wearable ECG monitor, has had a June 2026 data breach confirmed at roughly 8.18 million individuals, according to the Oregon Attorney General breach list. This is close to its entire customer base of about 8 million patients in the US and Europe. The company first identified unauthorized access on Ju…
A cyber-attack that began on October 11 against refrigeration controllers in French supermarkets is larger than first reported. It now appears to affect Dixell Electronics (a Copeland brand) temperature regulation devices as well as Danfoss controllers. CERT-FR named Danfoss AK-SC and AK-SM series, Dixell xweb and Copeland xweb as affecte…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by …
Microsoft's October 2026 Patch Tuesday is a record release of roughly 1,415 new CVEs, the first four-digit volume ever, larger than any previous full year of Microsoft patches. Only one flaw is under active attack: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web (MotW) protections. Two others are public…
Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64.128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
A threat actor obtained a highly sensitive API secret for ConnectWise Cloud Backup (formerly SkyKick) and used it to sign in to customers' Microsoft 365 tenants, forcing ConnectWise to suspend its Cloud Backup, SaaS Security and Cloud Management services. Huntress saw sign-in activity from the malicious infrastructure across almost 1,000 …
Researchers at Horizon3.ai have published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM that lets an unauthenticated attacker achieve remote code execution through specially crafted packets. Fortinet patched the flaw last week. The public PoC lowers the barrier to exploitat…
A Chinese-speaking attacker has reportedly compromised hundreds of websites worldwide by abusing Cairn, an AI-driven penetration-testing tool, to automate the attacks. Reported victims include large industrial and consumer brands such as John Deere, SharkNinja and engine manufacturer Cummins, from which the attacker is said to have looted…
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…
